@classytic/arc 2.32.0 → 2.33.0

package/dist/{EventTransport-2uVV34WU.d.mts → EventTransport-BEVP50ka.d.mts}

@@ -4,6 +4,21 @@ import { DeadLetteredEvent, DomainEvent, DomainEvent as DomainEvent$1, EventHand
 interface MemoryEventTransportOptions {
   /** Logger for error/warning messages (default: console) */
   logger?: EventLogger;
+  /**
+   * What a THROWING subscriber does to `publish()`.
+   *
+   * - `'log'` (default) — logged, `publish()` still resolves. The
+   *   fire-and-forget bus contract: one broken analytics subscriber must not
+   *   fail a publisher's request.
+   * - `'throw'` — REJECTS with an `AggregateError` after running every
+   *   handler. Required for at-least-once PROCESSING: with this transport
+   *   `publish()` IS the handling, so a swallowed error reads to an outbox
+   *   relay as delivery and the row is acknowledged, never retried.
+   *
+   * Retry redelivers to ALL matching handlers (no per-handler cursor), so
+   * handlers must be idempotent. Every handler runs before the rejection.
+   */
+  onHandlerError?: "log" | "throw";
 }
 /**
  * In-memory event transport (default).
@@ -16,6 +31,7 @@ declare class MemoryEventTransport implements EventTransport {
   readonly name = "memory";
   private handlers;
   private logger;
+  private onHandlerError;
   constructor(options?: MemoryEventTransportOptions);
   publish(event: DomainEvent): Promise<void>;
   /**

package/dist/{EventTransport-BV10D0oG.mjs → EventTransport-tq4CEB-q.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**
@@ -45,6 +45,29 @@ import { createEvent, matchEventPattern } from "@classytic/primitives/events";
 * public `events/index.ts` barrel stays clean.
 */
 /**
+* Decorator key holding the RAW `EventTransport` an app registered.
+*
+* `fastify.events` is a request-facing FACADE — different signature
+* (`publish(type, payload, meta?)`) and fail-open by design — so machinery
+* that must observe publish failure (the outbox relay) resolves the transport
+* through this key instead. `Symbol.for` so it still matches across two arc
+* copies in one dependency graph; deliberately NOT on the public
+* `EventsDecorator` surface.
+*/
+const ARC_EVENT_TRANSPORT = Symbol.for("arc.eventTransport");
+/**
+* Read the raw transport an app registered, or `undefined` when the events
+* plugin was never registered (or predates this key).
+*
+* Callers decide what absence means: the outbox treats it as "no transport",
+* which is a boot-time error rather than a silent no-op relay.
+*/
+function resolveEventTransport(fastify) {
+	if (typeof fastify !== "object" || fastify === null) return void 0;
+	const found = Reflect.get(fastify, ARC_EVENT_TRANSPORT);
+	return typeof found === "object" && found !== null ? found : void 0;
+}
+/**
 * In-memory event transport (default).
 *
 * Events are delivered synchronously within the process. Not suitable for
@@ -55,17 +78,31 @@ var MemoryEventTransport = class {
 	name = "memory";
 	handlers = /* @__PURE__ */ new Map();
 	logger;
+	onHandlerError;
 	constructor(options) {
 		this.logger = options?.logger ?? console;
+		this.onHandlerError = options?.onHandlerError ?? "log";
 	}
 	async publish(event) {
 		const allHandlers = /* @__PURE__ */ new Set();
 		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		const failures = [];
 		for (const handler of allHandlers) try {
 			await handler(event);
 		} catch (err) {
 			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+			failures.push(err);
 		}
+		/**
+		* Rejecting is what lets an OUTBOX see the failure. With this transport,
+		* `publish()` IS the handling — synchronous and in-process — so resolving
+		* after a handler threw tells the relay the event was delivered, and the
+		* row is acknowledged and never retried. Measured: handler throws once,
+		* `relayBatch()` reports `relayed: 1, publishFailed: 0`, and the next tick
+		* finds nothing. A broker-backed transport has no such ambiguity — publish
+		* means "durably handed off" and redelivery is the consumer group's job.
+		*/
+		if (failures.length > 0 && this.onHandlerError === "throw") throw new AggregateError(failures, `[EventTransport] ${failures.length} handler(s) failed for ${event.type}`);
 	}
 	/**
 	* Reference `publishMany` implementation — delegates to `publish()` in order.
@@ -101,4 +138,4 @@ var MemoryEventTransport = class {
 	}
 };
 //#endregion
-export { createEvent as n, MemoryEventTransport as t };
+export { resolveEventTransport as i, MemoryEventTransport as n, createEvent as r, ARC_EVENT_TRANSPORT as t };

package/dist/{HookSystem-vimw5D7Z.mjs → HookSystem-DqXkMXkB.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-BVr7PgA0.mjs → ResourceRegistry-DoALUlOO.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import "./constants-J99LGTJI.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import "./constants-BxCoxmiN.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry
@@ -60,6 +60,7 @@ var ResourceRegistry = class {
 				summary: r.summary,
 				description: r.description,
 				permissions: r.permissions,
+				capability: r.capability,
 				raw: r.rawHandler !== void 0,
 				schema: r.schema
 			})),

package/dist/{actionPermissions-Dti7ebyv.mjs → actionPermissions-CUeCmpUd.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/core/actionPermissions.ts
 /**
 * Return the effective `PermissionCheck` for a single action, or `undefined`

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
-import "../index-CpzxqePp.mjs";
-import { a as UserBase } from "../types-B7XeLEgK.mjs";
+import { d as UserBase } from "../base-Csjc2oF-.mjs";
+import "../index-BcR2bFZQ.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-BvLKvOIL.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-BYtWnwAS.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,6 +1,6 @@
 
-import { Ut as AuthHelpers, Wt as AuthPluginOptions } from "../index-CpzxqePp.mjs";
-import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
+import { Ft as AuthPluginOptions, Pt as AuthHelpers } from "../index-BcR2bFZQ.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -1,9 +1,10 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Bh1KK5ps.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BXjQYbeC.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-BNsOXzOd.mjs";
-import { o as toJsonSchema } from "../schemaConverter-Crjvczi_.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-Dl_m0NCe.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-Cd_yy7aW.mjs";
+import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
+import { o as toJsonSchema } from "../schemaConverter-XH1RZRyu.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-BAfwgBxc.mjs";
+import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts
@@ -861,6 +862,25 @@ function createBetterAuthAdapter(options) {
 	if (openapiOpt === false) extractedOpenApi = void 0;
 	else if (typeof openapiOpt === "object") extractedOpenApi = openapiOpt;
 	const betterAuthPlugin = async (fastify) => {
+		/**
+		* `orgContext` without the `organization()` plugin is a SILENT
+		* misconfiguration, so it fails at boot instead.
+		*
+		* Arc resolves org membership through `auth.api.getActiveMember` /
+		* `getActiveMemberRole`. Absent the plugin those methods do not exist,
+		* every lookup returns null, and `request.scope` silently stays
+		* `'authenticated'` — so `requireOrgId()` throws 403 on every
+		* tenant-scoped route. It fails CLOSED (no data leak), but the symptom
+		* points nowhere near the cause: the host sees blanket 403s and no
+		* indication that a plugin is missing. One check at registration turns
+		* that into a sentence.
+		*/
+		if (orgEnabled) {
+			if (!(pickApiMethod(auth, "getActiveMember", "organization") !== void 0 || pickApiMethod(auth, "getActiveMemberRole", "organization") !== void 0)) throw new ArcError("createBetterAuthAdapter({ orgContext: true }) requires Better Auth's `organization()` plugin — `auth.api.getActiveMember` / `getActiveMemberRole` are missing. Without it arc can never resolve membership, so request.scope stays 'authenticated' and every tenant-scoped route answers 403. Add `organization()` to your betterAuth({ plugins }), or drop `orgContext`.", {
+				code: "BETTER_AUTH_ORG_PLUGIN_MISSING",
+				statusCode: 500
+			});
+		}
 		const routeOpts = options.rateLimit && typeof options.rateLimit === "object" ? { config: { rateLimit: options.rateLimit } } : {};
 		fastify.all(`${normalizedBase}/*`, routeOpts, async (request, reply) => {
 			try {
@@ -994,7 +1014,19 @@ function buildSetCookieHeader(name, value, maxAgeSeconds, options) {
 		`Path=${options.path ?? "/"}`
 	];
 	if (options.httpOnly !== false) parts.push("HttpOnly");
-	if (options.secure ?? process.env.NODE_ENV === "production") parts.push("Secure");
+	/**
+	* `Secure` defaults to "is this a production environment?" — via the shared classifier, NOT a
+	* raw `NODE_ENV === "production"` comparison.
+	*
+	* The raw form shipped session cookies WITHOUT `Secure` on any deployment using `NODE_ENV=prod`,
+	* because that comparison recognises only the long spelling. A cookie without `Secure` is sent
+	* over plaintext HTTP, so a session token becomes interceptable — and nothing anywhere reports
+	* it: the cookie is set, login works, the app behaves normally.
+	*
+	* `options.secure` still wins when stated (`??`), including an explicit `false` for local HTTP
+	* development. Only the DEFAULT changed, and only in the direction of being correct more often.
+	*/
+	if (options.secure ?? isProductionEnv(process.env.NODE_ENV)) parts.push("Secure");
 	parts.push(`SameSite=${capitalize(options.sameSite ?? "lax")}`);
 	if (options.domain) parts.push(`Domain=${options.domain}`);
 	return parts.join("; ");

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-__T3EJDA.mjs → authorizationDecision-B3mP_QTy.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
+import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
 //#region src/permissions/filter-merge.ts
 /**
 * Policy-filter composition — logical AND, never last-writer-wins.

package/dist/{types-B7XeLEgK.d.mts → base-Csjc2oF-.d.mts}

@@ -1,79 +1,6 @@
 
 import { i as RequestScope } from "./types-ChuShpCP.mjs";
 import { FastifyRequest } from "fastify";
-//#region src/types/base.d.ts
-declare module "fastify" {
-  interface FastifyRequest {
-    /** Request scope — set by auth adapter, read by permissions/presets/guards */
-    scope: RequestScope;
-    /**
-     * Current user — set by auth adapter (Better Auth, JWT, custom).
-     * `undefined` on public routes (`auth: false`) or unauthenticated requests.
-     * Guard with `if (request.user)` on routes that allow anonymous access.
-     *
-     * Kept as required (not `user?`) because `@fastify/jwt` declares it
-     * as required — declaration merges must have identical modifiers.
-     * The `| undefined` in the type achieves the same DX.
-     */
-    user: Record<string, unknown> | undefined;
-    /** Policy-injected query filters (e.g. ownership, org-scoping) */
-    _policyFilters?: Record<string, unknown>;
-    /** Field mask — fields to include/exclude in responses */
-    fieldMask?: {
-      include?: string[];
-      exclude?: string[];
-    };
-    /** Arbitrary policy metadata for downstream consumers */
-    policyMetadata?: Record<string, unknown>;
-    /** Document loaded by policy middleware for ownership checks */
-    document?: unknown;
-    /** Ownership check context (field name + user field) */
-    _ownershipCheck?: Record<string, unknown>;
-  }
-}
-type AnyRecord = Record<string, unknown>;
-/** MongoDB ObjectId — accepts string or any object with a `toString()` (e.g. mongoose ObjectId). */
-type ObjectId = string | {
-  toString(): string;
-};
-/**
- * Flexible user type that accepts any object with id/_id properties.
- * The actual user structure is defined by your app's auth system.
- */
-type UserLike = UserBase & {
-  /** User email (optional) */
-  email?: string;
-};
-interface UserOrganization {
-  userId: string;
-  organizationId: string;
-  [key: string]: unknown;
-}
-interface JWTPayload {
-  sub: string;
-  [key: string]: unknown;
-}
-/**
- * Typed Fastify request with Arc decorations. Use in `rawHandler` routes
- * instead of `(req as any).user`.
- *
- * @example
- * ```typescript
- * import type { ArcRequest } from '@classytic/arc';
- *
- * handler: async (req: ArcRequest, reply) => {
- *   req.user?.id;                    // typed
- *   req.scope.organizationId;        // typed (when member)
- *   req.signal;                      // AbortSignal (Fastify 5)
- * }
- * ```
- */
-type ArcRequest = FastifyRequest & {
-  scope: RequestScope;
-  user: Record<string, unknown> | undefined;
-  signal: AbortSignal;
-};
-//#endregion
 //#region src/utils/userHelpers.d.ts
 /**
  * Extract a user ID from a user object. Accepts `id` or `_id` — returns
@@ -324,4 +251,77 @@ interface PermissionCheckMeta {
   _conditional?: boolean;
 }
 //#endregion
-export { UserBase as a, normalizeRoles as c, JWTPayload as d, ObjectId as f, PermissionContext as i, AnyRecord as l, UserOrganization as m, DataPolicy as n, getUserId as o, UserLike as p, PermissionCheck as r, getUserRoles as s, AuthorizationDecision as t, ArcRequest as u };
+//#region src/types/base.d.ts
+declare module "fastify" {
+  interface FastifyRequest {
+    /** Request scope — set by auth adapter, read by permissions/presets/guards */
+    scope: RequestScope;
+    /**
+     * Current user — set by auth adapter (Better Auth, JWT, custom).
+     * `undefined` on public routes (`auth: false`) or unauthenticated requests.
+     * Guard with `if (request.user)` on routes that allow anonymous access.
+     *
+     * Kept as required (not `user?`) because `@fastify/jwt` declares it
+     * as required — declaration merges must have identical modifiers.
+     * The `| undefined` in the type achieves the same DX.
+     */
+    user: Record<string, unknown> | undefined;
+    /** Policy-injected query filters (e.g. ownership, org-scoping) */
+    _policyFilters?: Record<string, unknown>;
+    /** Field mask — fields to include/exclude in responses */
+    fieldMask?: {
+      include?: string[];
+      exclude?: string[];
+    };
+    /** Arbitrary policy metadata for downstream consumers */
+    policyMetadata?: Record<string, unknown>;
+    /** Document loaded by policy middleware for ownership checks */
+    document?: unknown;
+    /** Ownership check context (field name + user field) */
+    _ownershipCheck?: Record<string, unknown>;
+  }
+}
+type AnyRecord = Record<string, unknown>;
+/** MongoDB ObjectId — accepts string or any object with a `toString()` (e.g. mongoose ObjectId). */
+type ObjectId = string | {
+  toString(): string;
+};
+/**
+ * Flexible user type that accepts any object with id/_id properties.
+ * The actual user structure is defined by your app's auth system.
+ */
+type UserLike = UserBase & {
+  /** User email (optional) */
+  email?: string;
+};
+interface UserOrganization {
+  userId: string;
+  organizationId: string;
+  [key: string]: unknown;
+}
+interface JWTPayload {
+  sub: string;
+  [key: string]: unknown;
+}
+/**
+ * Typed Fastify request with Arc decorations. Use in `rawHandler` routes
+ * instead of `(req as any).user`.
+ *
+ * @example
+ * ```typescript
+ * import type { ArcRequest } from '@classytic/arc';
+ *
+ * handler: async (req: ArcRequest, reply) => {
+ *   req.user?.id;                    // typed
+ *   req.scope.organizationId;        // typed (when member)
+ *   req.signal;                      // AbortSignal (Fastify 5)
+ * }
+ * ```
+ */
+type ArcRequest = FastifyRequest & {
+  scope: RequestScope;
+  user: Record<string, unknown> | undefined;
+  signal: AbortSignal;
+};
+//#endregion
+export { UserLike as a, DataPolicy as c, UserBase as d, getUserId as f, ObjectId as i, PermissionCheck as l, normalizeRoles as m, ArcRequest as n, UserOrganization as o, getUserRoles as p, JWTPayload as r, AuthorizationDecision as s, AnyRecord as t, PermissionContext as u };

package/dist/{buildHandler-Dn7rzUJo.mjs → buildHandler-DLE9xX-V.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-__T3EJDA.mjs";
-import { t as toRepositoryFilter } from "./repositoryFilter-DotlxG3L.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-PMCPR9El.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-B3mP_QTy.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-DKny7PDn.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CdQlz52F.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B-HBTGXl.mjs";
-import { t as MemoryCacheStore } from "../memory-DsuWnj4T.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-Dhps-Ldt.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-WeKvY1dE.mjs";
+import { t as MemoryCacheStore } from "../memory-qYSB7rMQ.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DhsZ0ZIc.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-DFJqHyFs.mjs → caching-BcGmvnHh.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,7 +1,7 @@
 
-import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
-import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
-import { t as ArcModule } from "../types-CT5vu6M0.mjs";
+import { L as RequestWithExtras } from "../index-BcR2bFZQ.mjs";
+import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
+import { t as ArcModule } from "../types-BcTumAz_.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
@@ -75,7 +75,9 @@ type CleanupErrorCode =
 /** No authenticated actor could be resolved for a destructive action (fail-closed). */
 "CLEANUP_ACTOR_REQUIRED" |
 /** Caller lacks permission for the operation. */
-"CLEANUP_FORBIDDEN";
+"CLEANUP_FORBIDDEN" |
+/** The exclusion list names an unknown or protective step (fail-closed). */
+"CLEANUP_INVALID_EXCLUSION";
 /**
  * A framework error carrying BOTH `status` (read directly in code/tests) and
  * `statusCode` (the Fastify convention arc's global error handler recognizes,
@@ -112,6 +114,16 @@ declare const CleanupErrors: {
   readonly alreadyRunning: (runId: string) => CleanupError;
   readonly runNotFound: (id: string) => CleanupError;
   readonly invalidAction: (action: string, status: string) => CleanupError;
+  /**
+   * The operator's exclusion list cannot be honoured as written.
+   *
+   * A 400 rather than a filter: dropping an unrecognised exclusion leaves
+   * someone believing they narrowed a destructive run when they did not, and
+   * dropping a PROTECTIVE one would let a guard be switched off from the same
+   * request that starts the run. `steps` carries the offending ids so a UI can
+   * point at them.
+   */
+  readonly invalidExclusion: (reason: string, steps: readonly string[]) => CleanupError;
   readonly forbidden: (operation: string) => CleanupError;
 };
 //#endregion
@@ -333,4 +345,4 @@ declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
  */
 declare function computeManifestDigest(manifest: Record<string, unknown>): string;
 //#endregion
-export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepResult, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };