@classytic/arc 2.32.0 → 2.34.0

package/dist/{types-C4QE8qnm.d.mts → types-DVLddu2q.d.mts}

@@ -40,6 +40,18 @@ interface CleanupExecutionContext extends CleanupContext {
    * commits, call this so the executor learns of a cancel request promptly.
    */
   onStep(step: CleanupStepResult): Promise<void>;
+  /**
+   * Report a STEP LIFECYCLE transition — running / completed / skipped / failed.
+   *
+   * Separate from {@link onStep}, which reports a committed CHUNK and drives the
+   * aggregate counters. Folding both into one call would double-count `steps`
+   * and conflate "a batch landed" with "this phase is now done" — two different
+   * facts an operator reads differently.
+   *
+   * OPTIONAL on the context so a recipe that does not model discrete steps is
+   * unaffected; `recipeFromSteps` drives it for every composed recipe.
+   */
+  onStepState?(state: CleanupStepProgress): Promise<void>;
   /**
    * Throw `CleanupCancelled` if a cancel has been requested for this run. Cheap
    * to call between chunks; backed by the durable `cancelRequested` flag (the
@@ -56,13 +68,72 @@ interface Availability {
 /** Operator-supplied recipe parameters (branch, module set, before-date, …). */
 interface CleanupInput {
   readonly parameters?: Readonly<Record<string, unknown>> | undefined;
+  /**
+   * Step ids the operator chose to LEAVE OUT of this run.
+   *
+   * The obvious shape for this is a free-text ignore-list, which carries one
+   * dangerous gap: anything can be ignored, including the checks. Here a step
+   * that PROTECTS is not excludable — see
+   * {@link CleanupPlanItem.excluded} — because being able to switch off the
+   * thing standing between you and a statutory record makes the guard advisory.
+   * An unknown or unexcludable id REFUSES the plan rather than being dropped: a
+   * silently-ignored exclusion is an operator believing they narrowed a
+   * destructive run when they did not.
+   *
+   * SEALED INTO THE DIGEST. The exclusion set is part of what was consented to,
+   * so a plan previewed with accounting excluded cannot be executed as one that
+   * includes it.
+   *
+   * Framework-level and deliberately NOT smuggled through `parameters`:
+   * parameters are the recipe's domain scope, this is the composition.
+   */
+  readonly excludeSteps?: readonly string[] | undefined;
 }
+/**
+ * What a line's `estimated` COUNTS. Absent ⇒ `'remove'`, so every existing
+ * recipe keeps its meaning.
+ *
+ * A protective guard step reports the records it DEFENDS, not records it would
+ * touch — and summing those into a "records to remove" headline overstates the
+ * damage by exactly the protected count. That is not cosmetic: a pre-live reset
+ * showed **540 records to remove** when 173 of them were posted journal entries
+ * the run would refuse to touch. The number was plausible, internally
+ * consistent, and wrong — this codebase's signature failure, in the one place an
+ * operator reads before authorising a destructive act.
+ *
+ * The count cannot be inferred from `blockers`: a guard that finds nothing still
+ * reports zero protected records, and a REMOVING line can carry a blocker too.
+ * The line has to say which quantity it is.
+ */
+type CleanupPlanItemDisposition = "remove" | "protect" | "rebuild";
 /** One logical line in the preview — a business record class, never a collection. */
 interface CleanupPlanItem {
+  /**
+   * The contributing step, when the recipe is composed from steps.
+   *
+   * Without it the exclusion list is enforceable but not DISCOVERABLE: a UI
+   * showing `resource` labels has no id to send, so the capability exists and
+   * nothing can reach it. Absent for a recipe that is not step-composed.
+   */
+  readonly stepId?: string | undefined;
   /** Logical module / resource label, e.g. `'orders'`, `'journal entries'`. */
   readonly resource: string;
   /** Estimated records affected. */
   readonly estimated: number;
+  /**
+   * Whether `estimated` counts records this line REMOVES, PROTECTS, or REBUILDS.
+   * Defaults to `'remove'` — only a line that does something else must say so.
+   */
+  readonly disposition?: CleanupPlanItemDisposition | undefined;
+  /**
+   * The operator excluded this line from the run.
+   *
+   * It still appears in the plan — showing what was left out is the point; a
+   * line that vanishes is indistinguishable from one that was never in scope.
+   * Its `estimated` is kept out of both totals, and at execute time the step is
+   * reported `skipped` with the reason rather than silently not run.
+   */
+  readonly excluded?: boolean | undefined;
   /** What is retained for this line (e.g. `'measures kept, PII redacted'`). */
   readonly retained?: string | undefined;
   /** Domain blockers preventing this line (e.g. `'OPEN_TRANSFER'`). */
@@ -101,7 +172,26 @@ interface CleanupPlan {
   readonly blockers: readonly string[];
   readonly rebuildActions: readonly string[];
   readonly warnings: readonly string[];
+  /**
+   * Records this plan would REMOVE — the headline an operator authorises against.
+   *
+   * Counts only `disposition: 'remove'` lines. It used to sum every line, so a
+   * protective guard's count landed in the removal total (see
+   * {@link CleanupPlanItemDisposition}).
+   */
   readonly estimatedTotal: number;
+  /**
+   * Records a guard step is DEFENDING in this plan, reported separately so it
+   * can be shown as reassurance rather than as damage. Zero when no line
+   * protects anything.
+   */
+  readonly protectedTotal: number;
+  /**
+   * Step ids the operator left out, SEALED.  re-resolves from here,
+   * never from a fresh caller input, so a run cannot be widened past what was
+   * previewed and confirmed.
+   */
+  readonly excludeSteps: readonly string[];
   readonly confirmationPhrase: string;
   /** Deterministic checksum of the plan's material content — see `computePlanDigest`. */
   readonly digest: string;
@@ -122,11 +212,64 @@ interface CleanupStepResult {
  * fixed-size aggregate, never an unbounded per-chunk array. Detailed steps, if a
  * host wants them, go to a separate capped sink — not this document.
  */
+/**
+ * One step's lifecycle within a run.
+ *
+ * `skipped` and `failed` are DISTINCT from each other and from `completed`,
+ * because collapsing them is what makes a long destructive run unreadable: an
+ * operator watching "1,204 processed" cannot tell whether accounting ran, was
+ * deliberately not applicable, or blew up and left the rest half-done.
+ */
+type CleanupStepRunStatus = "pending" | "running" | "completed" | "skipped" | "failed";
+/**
+ * Per-step progress — the readable half of a run.
+ *
+ * The conventional shape is one FIXED COLUMN per phase, each holding
+ * `Pending | Completed | Skipped`. That works for a fixed pipeline and breaks
+ * the moment the pipeline is composed: adding a phase means a schema migration,
+ * and a recipe assembled from contributed steps has no fixed phase list at all.
+ *
+ * So this is a bounded LIST keyed by step id rather than columns. Two further
+ * properties, both deliberate:
+ *
+ *   - a `Skipped` with no reason is unreadable — "nothing to do" and
+ *     "deliberately excluded" are opposite facts, and a bare status enum cannot
+ *     tell them apart. {@link detail} is REQUIRED for `skipped` and `failed`.
+ *   - per-step `processed` and timings, so a stalled step is visible while it is
+ *     still running instead of after the run ends.
+ *
+ * Bounded by construction: one entry per step in the SEALED plan, and the plan
+ * is already capped at `maxPlanItems`. This is not the unbounded per-chunk array
+ * the progress summary exists to avoid.
+ */
+interface CleanupStepProgress {
+  /** Stable id of the contributing step — survives relabelling of `resource`. */
+  readonly stepId: string;
+  /** Human-facing record class, e.g. `'journal entries'`. */
+  readonly resource: string;
+  readonly status: CleanupStepRunStatus;
+  /** Records this step has processed so far. */
+  readonly processed: number;
+  readonly startedAt?: Date | undefined;
+  readonly completedAt?: Date | undefined;
+  /**
+   * WHY, for any non-`completed` terminal state. Required for `skipped` and
+   * `failed`: an unexplained non-completion is the thing this field exists to
+   * prevent.
+   */
+  readonly detail?: string | undefined;
+}
 interface CleanupProgressSummary {
   /** Running total of processed records across all steps. */
   readonly processed: number;
   /** Count of steps reported so far. */
   readonly steps: number;
+  /**
+   * Per-step lifecycle. Bounded by the sealed plan's step count — see
+   * {@link CleanupStepProgress}. Absent on runs recorded before this existed,
+   * so a reader must treat it as optional rather than assume an empty run.
+   */
+  readonly stepProgress?: readonly CleanupStepProgress[] | undefined;
   /** Resource the last step touched. */
   readonly currentResource?: string | undefined;
   /** Last resume cursor reported. */
@@ -448,4 +591,4 @@ interface CleanupLimits {
 }
 declare const DEFAULT_CLEANUP_LIMITS: CleanupLimits;
 //#endregion
-export { CleanupWriteFence as A, CleanupResult as C, CleanupRunStore as D, CleanupRunStatus as E, PurgeStrategyKind$1 as F, PurgeVerificationSummary as I, VerificationCheck as L, PurgeActor as M, PurgeEvidence as N, CleanupRunTransitionPatch as O, PurgeResourceResult as P, VerificationResult as R, CleanupRecipe as S, CleanupRunCreateResult as T, CleanupPermissions as _, CleanupEvidenceStore as a, CleanupPlanItem as b, CleanupInput as c, CleanupLease as d, CleanupLimits as f, CleanupPermissionCheck as g, CleanupOutcomeStatus as h, CleanupContext as i, DEFAULT_CLEANUP_LIMITS as j, CleanupStepResult as k, CleanupJob as l, CleanupManifest as m, CLEANUP_TERMINAL_STATUSES as n, CleanupExecutionContext as o, CleanupLogger as p, CleanupCancelRequest as r, CleanupFinalizationPayload as s, Availability as t, CleanupJobQueue as u, CleanupPlan as v, CleanupRun as w, CleanupProgressSummary as x, CleanupPlanDraft as y };
+export { CleanupStepResult as A, VerificationResult as B, CleanupResult as C, CleanupRunStore as D, CleanupRunStatus as E, PurgeEvidence as F, PurgeResourceResult as I, PurgeStrategyKind$1 as L, CleanupWriteFence as M, DEFAULT_CLEANUP_LIMITS as N, CleanupRunTransitionPatch as O, PurgeActor as P, PurgeVerificationSummary as R, CleanupRecipe as S, CleanupRunCreateResult as T, CleanupPermissions as _, CleanupEvidenceStore as a, CleanupPlanItem as b, CleanupInput as c, CleanupLease as d, CleanupLimits as f, CleanupPermissionCheck as g, CleanupOutcomeStatus as h, CleanupContext as i, CleanupStepRunStatus as j, CleanupStepProgress as k, CleanupJob as l, CleanupManifest as m, CLEANUP_TERMINAL_STATUSES as n, CleanupExecutionContext as o, CleanupLogger as p, CleanupCancelRequest as r, CleanupFinalizationPayload as s, Availability as t, CleanupJobQueue as u, CleanupPlan as v, CleanupRun as w, CleanupProgressSummary as x, CleanupPlanDraft as y, VerificationCheck as z };

package/dist/usage/index.d.mts

@@ -1,6 +1,6 @@
 
 import { i as RequestScope } from "../types-ChuShpCP.mjs";
-import { i as PermissionContext, r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { l as PermissionCheck, u as PermissionContext } from "../base-Csjc2oF-.mjs";
 import { UsageBucket, UsageStore, usagePeriod } from "@classytic/repo-core/usage";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/usage/requireQuota.d.ts

package/dist/{userHelpers-BNsOXzOd.mjs → userHelpers-CWF5pbZD.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/utils/userHelpers.ts
 /**
 * Extract a user ID from a user object. Accepts `id` or `_id` — returns

package/dist/utils/index.d.mts

@@ -1,8 +1,8 @@
 
-import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-CpzxqePp.mjs";
 import { F as getHeader, I as requireSingleHeaderValue, P as ArcHeaders } from "../types-ChuShpCP.mjs";
-import { c as normalizeRoles, l as AnyRecord, o as getUserId, s as getUserRoles } from "../types-B7XeLEgK.mjs";
-import { n as ErrorMapper } from "../errorHandler-CpYUJmPA.mjs";
+import { f as getUserId, m as normalizeRoles, p as getUserRoles, t as AnyRecord } from "../base-Csjc2oF-.mjs";
+import { $ as OpenApiSchemas, S as QueryParserInterface, b as ParsedQuery } from "../index-BcR2bFZQ.mjs";
+import { n as ErrorMapper } from "../errorHandler-DI5AN2b5.mjs";
 import { a as NotFoundError, c as RateLimitError, d as ValidationError, f as createDomainError, i as ForbiddenError, l as ServiceUnavailableError, m as isArcError, n as ConflictError, o as OrgAccessDeniedError, p as createError, r as ErrorOptions, s as OrgRequiredError, t as ArcError, u as UnauthorizedError } from "../errors-BGdVwP25.mjs";
 import { errorContractSchema, errorDetailSchema } from "@classytic/repo-core/errors";
 import { scheduleBackground } from "@classytic/repo-core/cache";
@@ -478,6 +478,29 @@ interface ArcQueryParserOptions {
    * Also used by MCP to auto-derive filterable fields in tool schemas.
    */
   allowedFilterFields?: string[];
+  /**
+   * REFUSE a filter key that is not in {@link allowedFilterFields}, instead of
+   * dropping it (default: `false` — today's drop behaviour, kept because arc
+   * is published and an unconditional throw would reject requests that work).
+   *
+   * Dropping a filter does not fail, it **WIDENS**: the caller asked for a
+   * narrower set and is silently answered with a broader one, HTTP 200. Two
+   * live instances:
+   *
+   *   `?filters[status]=pending` → 200, every row `status:"verified"`
+   *   `?productId=…` (the param is `skuRef`) → a different product's 75 units,
+   *     filed for weeks as "quant leakage"
+   *
+   * Turn this on per-parser, or fleet-wide via `ARC_STRICT_QUERY_PARAMS`.
+   * Mirrors the `ARC_STRICT_PERMISSIONS` precedent: off by default here, and
+   * the HOST opts in from its env-loader so a forgotten `.env` line cannot
+   * silently disable enforcement.
+   *
+   * Only the FILTER whitelist is covered. `allowedSortFields` /
+   * `allowedOperators` keep dropping: a rejected sort or operator degrades
+   * ordering, it does not widen the row set.
+   */
+  strictFilterFields?: boolean;
   /**
    * Whitelist of fields that can be sorted on.
    * When set, sort fields not in this list are silently dropped.
@@ -527,7 +550,12 @@ interface ArcQueryParserOptions {
  * For advanced MongoDB features ($lookup, aggregations), use MongoKit's QueryParser.
  */
 declare class ArcQueryParser implements QueryParserInterface {
-  private readonly maxLimit;
+  /**
+   * PUBLIC, deliberately: `QueryResolver` reads it so it does not apply a second cap
+   * on top of this one. Three layers capping independently, lowest winning silently,
+   * is what made a 696-row chart of accounts render as 100.
+   */
+  readonly maxLimit: number;
   private readonly defaultLimit;
   private readonly maxRegexLength;
   private readonly maxSearchLength;
@@ -535,6 +563,7 @@ declare class ArcQueryParser implements QueryParserInterface {
   private readonly _allowedFilterFields?;
   private readonly _allowedSortFields?;
   private readonly _allowedOperators?;
+  private readonly strictFilterFields;
   /** Allowed filter fields (used by MCP for auto-derive) */
   readonly allowedFilterFields?: readonly string[];
   /** Allowed sort fields (used by MCP for sort descriptions) */
@@ -1105,6 +1134,29 @@ declare function getListQueryParams(): AnyRecord;
  */
 declare function getDefaultCrudSchemas(): Record<string, Record<string, unknown>>;
 //#endregion
+//#region src/utils/runtimeCapabilities.d.ts
+/** What a subsystem declares about the state it holds. */
+interface RuntimeCapabilityDeclaration {
+  /** Dotted subsystem id, e.g. `'webhooks.subscriptions'`, `'events.transport'`. */
+  subsystem: string;
+  /** Where the state lives: `'memory'` = this process only; `'shared'` = external/durable. */
+  durability: "memory" | "shared";
+  /**
+   * `'memory'` durability that is CORRECT by design (per-process micro-cache,
+   * declared single-process topology). Audited as info, never an error —
+   * acceptance must be stated by the declarant, not inferred by the audit.
+   */
+  accepted?: boolean;
+  /** One line for the audit output: what breaks multi-replica, or why accepted. */
+  detail?: string;
+}
+/**
+ * Declare a runtime capability. Callable from ANY registration context —
+ * arc's own plugins, host `plugins()` callbacks, module `plugins` phases —
+ * which is the point: the audit sees what the constructor-time guard cannot.
+ */
+declare function declareRuntimeCapability(fastify: FastifyInstance, decl: RuntimeCapabilityDeclaration): void;
+//#endregion
 //#region src/utils/schemaConverter.d.ts
 /**
  * Supported JSON Schema output targets for Zod v4's `toJSONSchema()`.
@@ -1514,4 +1566,4 @@ declare function hasEvents(instance: FastifyInstance): instance is FastifyInstan
   events: EventsDecorator;
 };
 //#endregion
-export { ArcError, type ArcHeaders, ArcQueryParser, type ArcQueryParserOptions, CircuitBreaker, CircuitBreakerError, type CircuitBreakerOptions, CircuitBreakerRegistry, type CircuitBreakerStats, CircuitState, type CompensationDefinition, type CompensationError, type CompensationHooks, type CompensationResult, type CompensationStep, ConflictError, type ErrorOptions, type EventsDecorator, type FilterDialect, ForbiddenError, type Guard, type GuardConfig, type JsonSchema, type JsonSchemaTarget, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, type PipeUIMessageStreamOptions, RateLimitError, type SchemaIo, ServiceUnavailableError, type SseStream, type SseStreamOptions, type StateMachine, type TransitionConfig, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };
+export { ArcError, type ArcHeaders, ArcQueryParser, type ArcQueryParserOptions, CircuitBreaker, CircuitBreakerError, type CircuitBreakerOptions, CircuitBreakerRegistry, type CircuitBreakerStats, CircuitState, type CompensationDefinition, type CompensationError, type CompensationHooks, type CompensationResult, type CompensationStep, ConflictError, type ErrorOptions, type EventsDecorator, type FilterDialect, ForbiddenError, type Guard, type GuardConfig, type JsonSchema, type JsonSchemaTarget, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, type PipeUIMessageStreamOptions, RateLimitError, type RuntimeCapabilityDeclaration, type SchemaIo, ServiceUnavailableError, type SseStream, type SseStreamOptions, type StateMachine, type TransitionConfig, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, declareRuntimeCapability, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };

package/dist/utils/index.mjs

@@ -1,11 +1,12 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-Bh1KK5ps.mjs";
-import { n as requireSingleHeaderValue, t as getHeader } from "../headers-BXjQYbeC.mjs";
-import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-BNsOXzOd.mjs";
-import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-C4KiMWUa.mjs";
-import { A as createCircuitBreakerRegistry, C as defineCompensation, D as CircuitBreakerRegistry, E as CircuitBreakerError, O as CircuitState, S as defineErrorMapper, T as CircuitBreaker, _ as createQueryParser, a as deleteResponse, b as NEUTRAL_DIALECT, c as getDefaultCrudSchemas, d as listResponse, f as offsetListResponse, g as ArcQueryParser, h as responses, i as bareListResponse, k as createCircuitBreaker, l as getListQueryParams, m as queryParams, n as scheduleBackground, o as errorContractSchema, p as paginationSchema, r as aggregateListResponse, s as errorDetailSchema, t as createStateMachine, u as keysetListResponse, v as handleRaw, w as withCompensation, x as defineGuard, y as MONGO_DIALECT } from "../utils-BtOha_Sp.mjs";
-import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-Crjvczi_.mjs";
-import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-DPZdQmDz.mjs";
-import { t as openSseStream } from "../sseStream-B3zb_d1h.mjs";
-import { t as hasEvents } from "../typeGuards-B_5-hKjJ.mjs";
-export { ArcError, ArcQueryParser, CircuitBreaker, CircuitBreakerError, CircuitBreakerRegistry, CircuitState, ConflictError, ForbiddenError, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
+import { n as requireSingleHeaderValue, t as getHeader } from "../headers-CveNO9gR.mjs";
+import { n as getUserRoles, r as normalizeRoles, t as getUserId } from "../userHelpers-CWF5pbZD.mjs";
+import { t as simpleEqualityMatcher } from "../simpleEqualityMatcher-Se8VrsaP.mjs";
+import { A as createCircuitBreakerRegistry, C as defineCompensation, D as CircuitBreakerRegistry, E as CircuitBreakerError, O as CircuitState, S as defineErrorMapper, T as CircuitBreaker, _ as createQueryParser, a as deleteResponse, b as NEUTRAL_DIALECT, c as getDefaultCrudSchemas, d as listResponse, f as offsetListResponse, g as ArcQueryParser, h as responses, i as bareListResponse, k as createCircuitBreaker, l as getListQueryParams, m as queryParams, n as scheduleBackground, o as errorContractSchema, p as paginationSchema, r as aggregateListResponse, s as errorDetailSchema, t as createStateMachine, u as keysetListResponse, v as handleRaw, w as withCompensation, x as defineGuard, y as MONGO_DIALECT } from "../utils-h1V_sT-t.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-Dm88DaTW.mjs";
+import { a as isZodSchema, i as isJsonSchema, n as convertRouteSchema, o as toJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-XH1RZRyu.mjs";
+import { a as promoteStreamTokenToHeader, i as pipeUIMessageStreamToReply, n as forwardedStreamHeaders, r as isReadableStream, t as UI_MESSAGE_STREAM_HEADERS } from "../streaming-DsT1B5zJ.mjs";
+import { t as openSseStream } from "../sseStream-Bvpi-UXQ.mjs";
+import { t as hasEvents } from "../typeGuards-jjKJDN13.mjs";
+export { ArcError, ArcQueryParser, CircuitBreaker, CircuitBreakerError, CircuitBreakerRegistry, CircuitState, ConflictError, ForbiddenError, MONGO_DIALECT, NEUTRAL_DIALECT, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, UI_MESSAGE_STREAM_HEADERS, UnauthorizedError, ValidationError, aggregateListResponse, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, declareRuntimeCapability, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, forwardedStreamHeaders, getDefaultCrudSchemas, getHeader, getListQueryParams, getUserId, getUserRoles, handleRaw, hasEvents, isArcError, isJsonSchema, isReadableStream, isZodSchema, keysetListResponse, listResponse, normalizeRoles, offsetListResponse, openSseStream, paginationSchema, pipeUIMessageStreamToReply, promoteStreamTokenToHeader, queryParams, requireSingleHeaderValue, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, withCompensation };

package/dist/{utils-BtOha_Sp.mjs → utils-h1V_sT-t.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { m as RESERVED_QUERY_PARAMS } from "./constants-J99LGTJI.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { m as RESERVED_QUERY_PARAMS } from "./constants-BxCoxmiN.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
+import { t as ArcError, u as ValidationError } from "./errors-Cd_yy7aW.mjs";
 import { errorContractSchema as errorContractSchema$1, errorDetailSchema as errorDetailSchema$1 } from "@classytic/repo-core/errors";
 import { scheduleBackground } from "@classytic/repo-core/cache";
 //#region src/utils/circuitBreaker.ts
@@ -591,6 +591,11 @@ const DANGEROUS_REGEX_PATTERNS = /(\{[0-9,]+\}|\*\+|\+\+|\?\+|(\(.+\))\+|\(\?:|\
 * For advanced MongoDB features ($lookup, aggregations), use MongoKit's QueryParser.
 */
 var ArcQueryParser = class {
+	/**
+	* PUBLIC, deliberately: `QueryResolver` reads it so it does not apply a second cap
+	* on top of this one. Three layers capping independently, lowest winning silently,
+	* is what made a 696-row chart of accounts render as 100.
+	*/
 	maxLimit;
 	defaultLimit;
 	maxRegexLength;
@@ -599,6 +604,7 @@ var ArcQueryParser = class {
 	_allowedFilterFields;
 	_allowedSortFields;
 	_allowedOperators;
+	strictFilterFields;
 	/** Allowed filter fields (used by MCP for auto-derive) */
 	allowedFilterFields;
 	/** Allowed sort fields (used by MCP for sort descriptions) */
@@ -621,6 +627,7 @@ var ArcQueryParser = class {
 		this.maxRegexLength = options.maxRegexLength ?? 200;
 		this.maxSearchLength = options.maxSearchLength ?? 200;
 		this.maxFilterDepth = options.maxFilterDepth ?? 10;
+		this.strictFilterFields = options.strictFilterFields ?? process.env.ARC_STRICT_QUERY_PARAMS === "true";
 		if (options.allowedFilterFields) {
 			this._allowedFilterFields = new Set(options.allowedFilterFields);
 			this.allowedFilterFields = options.allowedFilterFields;
@@ -787,7 +794,10 @@ var ArcQueryParser = class {
 		if (value === void 0 || value === null) return;
 		if (!/^[a-zA-Z_][a-zA-Z0-9_.]*(?:\[[a-z]+\])?$/.test(key)) return;
 		const bareKey = key.replace(/\[[a-z]+\]$/, "");
-		if (this._allowedFilterFields && !this._allowedFilterFields.has(bareKey)) return;
+		if (this._allowedFilterFields && !this._allowedFilterFields.has(bareKey)) {
+			if (this.strictFilterFields) throw new ValidationError(`Unknown filter field: ${bareKey}. Allowed: ${[...this._allowedFilterFields].sort().join(", ")}`);
+			return;
+		}
 		if (this.exceedsDepth(value)) return;
 		if (typeof value === "object" && value !== null && !Array.isArray(value)) {
 			const operatorObj = value;
@@ -879,10 +889,31 @@ var ArcQueryParser = class {
 				},
 				limit: {
 					type: "integer",
-					description: "Number of items per page",
+					/**
+					* The cap is DOCUMENTED here, not enforced — deliberately.
+					*
+					* Both layers that handle `limit` CLAMP it: this parser
+					* (`Math.min(…, this.maxLimit)`) and `QueryResolver`. Emitting
+					* `maximum` contradicted them, because arc layers this schema as the
+					* route's `listQuery` and Fastify validates the querystring BEFORE
+					* either runs — so the clamp was unreachable and `?limit=200` became a
+					* hard 400.
+					*
+					* That combination is worse than either policy alone. Asking for more
+					* rows than allowed is a benign over-ask with an obvious right answer
+					* (give the maximum); turning it into a validation failure means a UI
+					* passing a generous page size gets NOTHING, and a caller that does not
+					* inspect the error body renders it as an empty list — a 400 disguised
+					* as "no results", which is the hardest kind to find.
+					*
+					* A deployment wanting refusal instead of clamping should say so in the
+					* parser's policy, where both halves can agree, not in a schema that
+					* silently outranks them. Mirrors the same fix in mongokit's
+					* `buildQuerySchema`.
+					*/
+					description: `Number of items per page (values above ${this.maxLimit} are capped to ${this.maxLimit})`,
 					default: this.defaultLimit,
-					minimum: 1,
-					maximum: this.maxLimit
+					minimum: 1
 				},
 				sort: {
 					type: "string",

package/dist/{validate-PMCPR9El.mjs → validate-CdQlz52F.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 //#region src/core/aggregation/normalize.ts
 /**
 * Framework cap on URL-driven aggregation limits when the host opts

package/dist/{versioning-D_rhHfZm.d.mts → versioning-DEs-_hFi.d.mts}

@@ -1,5 +1,5 @@
 
-import { n as DomainEvent } from "./EventTransport-2uVV34WU.mjs";
+import { n as DomainEvent } from "./EventTransport-BEVP50ka.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/plugins/caching.d.ts
 interface CachingRule {

package/dist/{versioning-CKv2jz_U.mjs → versioning-rZbyLVD-.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
-import { d as createDomainError } from "./errors-Bh1KK5ps.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+import { d as createDomainError } from "./errors-Cd_yy7aW.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/versioning.ts
 var versioning_exports = /* @__PURE__ */ __exportAll({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.32.0",
+  "version": "2.34.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -336,13 +336,14 @@
     "test:smoke:redis": "node scripts/smoke-ws-redis.mjs",
     "smoke": "node scripts/smoke-test.mjs",
     "smoke:consumer": "node scripts/smoke-test.mjs --consumer",
+    "smoke:mcp": "node scripts/mcp-e2e.mjs",
     "push": "classytic-push",
     "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
     "release": "npm run push -- main && npm run release:tag && npm publish",
     "check:peer-skew": "node scripts/check-peer-skew.mjs",
     "check:docs-drift": "node scripts/check-docs-drift.mjs",
     "check:boundaries": "node scripts/check-boundaries.mjs",
-    "prepublishOnly": "npm run check:peer-skew && npm run check:docs-drift && npm run check:route-api && npm run check:boundaries && npm run typecheck && npm run lint && npm run build && npm run check:api-surface && npm run check:forgotten-exports && npm run check:package && npm run test:ci && npm run smoke:consumer",
+    "prepublishOnly": "npm run check:peer-skew && npm run check:docs-drift && npm run check:route-api && npm run check:boundaries && npm run typecheck && npm run lint && npm run build && npm run check:api-surface && npm run check:forgotten-exports && npm run check:package && npm run test:ci && npm run smoke:consumer && npm run smoke:mcp",
     "check:route-api": "node scripts/check-removed-route-api.mjs",
     "check:forgotten-exports": "node scripts/check-forgotten-exports.mjs"
   },
@@ -350,8 +351,8 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.20.0",
-    "@classytic/repo-core": ">=0.17.0",
+    "@classytic/primitives": ">=0.23.0",
+    "@classytic/repo-core": ">=0.24.0",
     "@classytic/streamline": ">=2.8.0",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
@@ -359,6 +360,7 @@
     "@fastify/multipart": ">=9.0.0",
     "@fastify/rate-limit": ">=10.0.0",
     "@fastify/sensible": ">=6.0.0",
+    "@fastify/static": ">=8.0.0",
     "@fastify/type-provider-typebox": ">=6.0.0",
     "@fastify/under-pressure": ">=9.0.0",
     "@fastify/websocket": ">=11.0.0",
@@ -378,9 +380,8 @@
     "jose": ">=5.0.0",
     "pino-pretty": ">=13.0.0",
     "typebox": ">=1.0.0",
-    "zod": ">=4.4.0",
-    "@fastify/static": ">=8.0.0",
-    "vitest": ">=3.0.0"
+    "vitest": ">=3.0.0",
+    "zod": ">=4.4.0"
   },
   "peerDependenciesMeta": {
     "better-auth": {
@@ -480,11 +481,11 @@
     "@biomejs/biome": "^2.5.7",
     "@classytic/dev-tools": "^0.2.0",
     "@classytic/gitkit": ">=0.1.0",
-    "@classytic/mongokit": "^3.30.0",
+    "@classytic/mongokit": "^3.33.0",
     "@classytic/pgkit": "^0.1.0",
-    "@classytic/primitives": "^0.20.0",
-    "@classytic/repo-core": "^0.20.0",
-    "@classytic/sqlitekit": "^0.6.0",
+    "@classytic/primitives": "^0.23.0",
+    "@classytic/repo-core": "^0.24.0",
+    "@classytic/sqlitekit": "^0.9.0",
     "@classytic/streamline": "^2.8.2",
     "@electric-sql/pglite": "^0.5.4",
     "@fastify/cors": "^11.2.0",
@@ -504,15 +505,15 @@
     "@vitest/coverage-v8": "^4.1.9",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.25",
-    "better-sqlite3": "^12.11.1",
-    "bullmq": "^5.81.2",
+    "better-sqlite3": "^13.0.3",
+    "bullmq": "^6.1.2",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "fast-check": "^4.8.0",
-    "fastify": "^5.11.2",
-    "fastify-raw-body": "^5.0.0",
+    "fastify": "^5.12.0",
+    "fastify-raw-body": "^6.0.1",
     "h3-js": "^4.4.0",
-    "ioredis": "^5.11.1",
+    "ioredis": "^6.0.0",
     "jose": "^6.2.3",
     "jsonwebtoken": "^9.0.3",
     "knip": "^6.31.0",