@classytic/arc 2.41.0 → 2.43.0

package/dist/cache/index.d.mts

@@ -1,7 +1,8 @@
 
 import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BOk3YnTz.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DFA-QrU9.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-BzqxconG.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache--5uAuYPW.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-C2lZjTxk.mjs";
+import { n as UpstashKeyValueCommands, t as IoredisKeyValueCommands } from "../redisShapes-CQksY67q.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities
@@ -17,9 +18,10 @@ declare function versionKey(resource: string): string;
 /** Tag version key — stored in CacheStore, bumped on cross-resource invalidation */
 declare function tagVersionKey(tag: string): string;
 /**
- * Stable hash for query params.
- * Sorts keys recursively, serializes to JSON, then applies djb2 hash.
- * Returns hex string.
+ * Digest of the query params for a cache key — repo-core's canonical serialiser (escaped,
+ * type-preserving, key-order-free) under SHA-256. Two different queries never share a key: a
+ * delimiter inside a value, `1` vs `"1"`, two dates or two regexes all stay distinct, and a
+ * cryptographic digest leaves no crafted collision onto another caller's cached result.
  */
 declare function hashParams(params: Record<string, unknown>): string;
 //#endregion
@@ -37,9 +39,11 @@ interface MemoryCacheStoreOptions {
    */
   maxEntryBytes?: number;
   /**
-   * Total memory budget in bytes (default: 50 MiB).
-   * When exceeded, LRU entries are evicted until usage drops below watermark.
-   * Set to 0 to disable (rely on maxEntries only).
+   * Total budget in bytes (default: 50 MiB), counted as serialized value
+   * bytes plus key bytes — an estimate of payload, NOT a heap limit (Map
+   * and object overhead are not counted). When exceeded, LRU entries are
+   * evicted until usage drops to the watermark. Set to 0 to disable (rely
+   * on maxEntries only).
    */
   maxMemoryBytes?: number;
   /**
@@ -91,8 +95,8 @@ declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
   close(): Promise<void>;
   stats(): CacheStats;
   private removeEntry;
-  private evictToLimit;
-  private evictToMemoryLimit;
+  /** Every write path ends here, so no path can skip a limit. */
+  private enforceLimits;
   private cleanupExpired;
   private estimateSize;
 }
@@ -179,22 +183,16 @@ declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
   private withPrefix;
 }
 /**
- * Minimal ioredis shape we depend on. We don't import ioredis itself so the
- * cache subpath stays peer-dep-free. The `scan` tail is `unknown[]` so a real
- * ioredis `Redis` (overloads with literal tokens + optional callback) is
- * assignable — see the same note on the idempotency `IoredisLike`.
+ * Minimal ioredis shape the cache depends on — the shared key/value commands
+ * (`utils/redisShapes.ts`, where the `unknown[]`-tail rule is explained) plus
+ * the cache's own extras. Not importing ioredis keeps the subpath peer-dep-free.
  */
-interface IoredisLike {
-  get(key: string): Promise<string | null>;
-  set(...args: unknown[]): Promise<string | null>;
-  del(...keys: string[]): Promise<number>;
-  scan(cursor: string | number, ...args: unknown[]): Promise<[string, string[]]>;
+interface IoredisLike extends IoredisKeyValueCommands {
   pipeline?(): {
     del(key: string): unknown;
     exec(): Promise<unknown>;
   };
   incrby?(key: string, by: number): Promise<number>;
-  eval?(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
 }
 /**
  * Wrap an ioredis instance as a `RedisCacheClient`.
@@ -218,22 +216,12 @@ interface IoredisLike {
  */
 declare function ioredisAsCacheClient(client: IoredisLike): RedisCacheClient;
 /**
- * Minimal `@upstash/redis` REST SDK shape we depend on.
- *
- * `@upstash/redis` is HTTP-based and works on edge runtimes (Cloudflare
- * Workers, Vercel Edge, Deno Deploy) where TCP connections — and thus
- * ioredis — are unavailable.
+ * Minimal `@upstash/redis` REST SDK shape the cache depends on — the shared
+ * key/value commands (`utils/redisShapes.ts`) plus `incrby`. HTTP-based, so it
+ * works on edge runtimes where ioredis cannot.
  */
-interface UpstashRedisLike {
-  get(key: string): Promise<string | null | unknown>;
-  set(key: string, value: unknown, opts?: Record<string, unknown>): Promise<unknown>;
-  del(...keys: string[]): Promise<number>;
-  scan(cursor: number | string, opts?: {
-    match?: string;
-    count?: number;
-  }): Promise<[number, string[]] | [string, string[]]>;
+interface UpstashRedisLike extends UpstashKeyValueCommands {
   incrby?(key: string, by: number): Promise<number>;
-  eval?(script: string, keys: string[], args: (string | number)[]): Promise<unknown>;
 }
 /**
  * Wrap an `@upstash/redis` REST client as a `RedisCacheClient`.

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cmv4cBRa.mjs";
-import { t as MemoryCacheStore } from "../memory-CpDZ9NPw.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-B5F09bYr.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B2KtgMLJ.mjs";
+import { t as MemoryCacheStore } from "../memory-9Cp7611C.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-CFWNH8aT.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-DsWDjIxx.mjs → caching-Cc2M1DwO.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({
@@ -74,4 +74,4 @@ var caching_default = fp(cachingPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { caching_default as n, caching_exports as r, cachingPlugin as t };
+export { caching_exports as n, caching_default as t };

package/dist/claimed-B10RTfkM.mjs

@@ -0,0 +1,8 @@
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+//#region src/events/outbox/claimed.ts
+function claimedAttempts(claimed) {
+	const value = claimed.attempts;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+//#endregion
+export { claimedAttempts as t };

package/dist/cleanup/index.d.mts

@@ -1,9 +1,8 @@
 
-import { L as RequestWithExtras } from "../index-DHbyPo5j.mjs";
+import { A as RequestWithExtras } from "../index-mqaqZNpe.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-DfVDvkdP.mjs";
+import { n as ArcModule } from "../types-BJ-2XqVF.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
-import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
 //#region src/cleanup/compose.d.ts
 /** Metadata + steps for {@link recipeFromSteps}. */
@@ -203,12 +202,11 @@ interface CleanupServiceDeps {
   registry: CleanupRegistry;
   runStore: CleanupRunStore;
   evidenceStore: CleanupEvidenceStore;
-  /** Optional write fence (§8). No-op when absent. */
+  /** Optional write fence. No-op when absent. */
   writeFence?: CleanupWriteFence | undefined;
   /**
-   * Durable job queue (§8). Defaults to a microtask-deferred in-process queue
-   * that calls `processRun` off the request path (single-process only). Inject
-   * BullMQ / SQS / repo-backed for cross-process durability + restart recovery.
+   * Durable job queue. Default: an in-process microtask queue (single-process,
+   * no restart recovery) — inject BullMQ / SQS / repo-backed for durability.
    */
   jobQueue?: CleanupJobQueue | undefined;
   /** Framework size caps. Defaults to {@link DEFAULT_CLEANUP_LIMITS}. */
@@ -261,8 +259,6 @@ interface CleanupService {
   cancel(id: string, input?: CancelInput): Promise<CleanupRun>;
   retry(id: string): Promise<CleanupRun>;
 }
-/** Admission key serializing every destructive run behind one slot. */
-declare const GLOBAL_DESTRUCTIVE_KEY = "global-destructive";
 declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
@@ -345,4 +341,4 @@ declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
  */
 declare function computeManifestDigest(manifest: Record<string, unknown>): string;
 //#endregion
-export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-CDy3-zw1.mjs";
-import { t as defineResource } from "../defineResource-DzGT-2LP.mjs";
-import { t as defineModule } from "../module-BkQEesNQ.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-Bk9NOgOC.mjs";
+import { t as defineResource } from "../defineResource-DIC7JZGU.mjs";
+import { t as defineModule } from "../module-BSvOQC7E.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -612,8 +612,8 @@ function createCleanupRegistry(recipes) {
 * implementation (`Date`-explicit, strict-reject of `undefined`/`NaN`/`BigInt`/
 * `function`/`symbol`/`Map`/`Set`/cyclic). Two domains consume it — cleanup
 * manifests here + financial-close evidence manifests in arc-accounting — so it
-* lives in primitives, not duplicated per package. `canonicalJson` is re-exported
-* for existing importers; peer floor `@classytic/primitives >= 0.17.0`.
+* lives in primitives, not duplicated per package — import `canonicalJson` from
+* there; peer floor `@classytic/primitives >= 0.17.0`.
 */
 /**
 * The material content of a plan — everything an operator is consenting to.
@@ -656,33 +656,22 @@ function computeManifestDigest(manifest) {
 /**
 * Cleanup orchestration service — the framework's use-case core.
 *
-* Split into a REQUEST path and a WORKER path so the durability guarantees the
-* ports promise actually hold:
+* REQUEST path vs WORKER path:
 *
-*   preview()      → re-plan, seal a digest, surface blockers/retains/confirmation
-*   execute()      → validate (availability, digest, confirmation, reason,
-*                    blockers, limits), ATOMICALLY create the run (admission
-*                    guard by concurrencyKey), persist the sealed operation,
-*                    ENQUEUE `{ runId }`, and RETURN. It does NOT run the recipe.
-*   processRun()   → the worker entrypoint. Takes an EXCLUSIVE LEASE on the run
-*                    (`claim` — a live lease refuses duplicate workers), then
-*                    branches: a `finalizing` run RECOVERS finalization from the
-*                    persisted payload (never re-executes); a `queued` run (or a
-*                    crashed `running` run whose lease expired) executes the
-*                    recipe with cooperative cancellation, verifies, persists
-*                    the finalization payload, and finalizes idempotently.
-*   cancel()       → durable cancel request (+ actor/reason audit) + CAS a
-*                    not-yet-running run straight to `cancelled` WITH evidence.
-*                    A running run stops cooperatively and leaves evidence of
-*                    the committed chunks.
-*   retry()        → reload the SAME sealed operation, re-check availability +
-*                    recipe version + digest against a fresh plan (refuse if the
-*                    world changed), re-arm ATOMICALLY under the same admission
-*                    guard as creation, re-enqueue.
+*   preview()    → re-plan and seal a digest.
+*   execute()    → validate, ATOMICALLY create the run (admission guard by
+*                  concurrencyKey), ENQUEUE `{ runId }`, return. Never runs the recipe.
+*   processRun() → worker entrypoint. Takes an EXCLUSIVE lease; a `finalizing`
+*                  run only replays finalization from the persisted payload
+*                  (never re-executes); a `queued` or lease-expired `running`
+*                  run executes, verifies, persists the payload, finalizes.
+*   cancel()     → durable, audited request; a not-yet-running run goes straight
+*                  to `cancelled` WITH evidence, a running one stops cooperatively.
+*   retry()      → re-validate the SAME sealed operation against a fresh plan
+*                  (refuse if it changed), re-arm atomically under the same guard.
 *
-* Every status change goes through `compareAndTransition` (CAS) carrying the
-* worker's lease token, so a late `completed` write from a stalled ex-owner can
-* never clobber the new owner's `cancelled`/`running` state.
+* Every status change is a CAS carrying the lease token, so a stalled ex-owner's
+* late write can never clobber the new owner's state.
 */
 const EMPTY_PROGRESS = {
 	processed: 0,
@@ -724,20 +713,9 @@ function createCleanupService(deps) {
 	const generateId = deps.generateId ?? (() => globalThis.crypto.randomUUID());
 	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
 	/**
-	* Undefined-valued keys are DROPPED, not spread.
-	*
-	* `limits` is `Partial<CleanupLimits>`, which permits an EXPLICIT `undefined`
-	* — and a plain spread lets that overwrite the default rather than fall back
-	* to it. Every limit is then read in a comparison, and `n > undefined` is
-	* always `false`, so `{ limits: { maxPlanItems: undefined } }` did not raise
-	* the cap: it silently REMOVED it, on a framework whose whole job is deleting
-	* data. Same for `maxReasonLength` / `maxParamDepth`, and `maxResults` turned
-	* `slice(0, undefined)` into "keep everything".
-	*
-	* A host reaches this by forwarding an optional config through
-	* (`limits: { maxPlanItems: cfg.planCap }`) — no cast, no obvious mistake.
-	* `permissions/presets.ts` already filters for exactly this reason; this is
-	* the same rule applied to the destructive path.
+	* Undefined-valued keys are DROPPED, not spread: an explicit `undefined`
+	* would overwrite the default, and `n > undefined` is always false — so the
+	* cap would silently disappear on the path that deletes data.
 	*/
 	const limits = {
 		...DEFAULT_CLEANUP_LIMITS,
@@ -772,14 +750,6 @@ function createCleanupService(deps) {
 		}, ctx);
 		const items = draft.items;
 		if (items.length > limits.maxPlanItems) throw CleanupErrors.planTooLarge(`${items.length} items > maxPlanItems ${limits.maxPlanItems}`);
-		/**
-		* Partition by DISPOSITION — a protective guard's count is not damage.
-		*
-		* This was one `reduce` over every item, so a guard reporting the 173 posted
-		* journal entries it defends pushed the "records to remove" headline to 540
-		* on a plan that removes 367. Absent disposition means `'remove'`, so every
-		* pre-existing recipe is unchanged.
-		*/
 		const estimatedTotal = items.reduce((sum, i) => sum + ((i.disposition ?? "remove") === "remove" ? i.estimated : 0), 0);
 		const protectedTotal = items.reduce((sum, i) => sum + (i.disposition === "protect" ? i.estimated : 0), 0);
 		const blockers = new Set(draft.blockers ?? []);
@@ -907,13 +877,6 @@ function createCleanupService(deps) {
 		let processed = 0;
 		let steps = 0;
 		let failed = 0;
-		/**
-		* Per-step lifecycle, keyed by `stepId` and ordered by first sight.
-		*
-		* Seeded from the run's existing progress so a RESUMED run (crash recovery,
-		* retry) keeps the states it already recorded instead of presenting an
-		* operator with a blank pipeline for work that demonstrably happened.
-		*/
 		const stepStates = new Map((run.progress?.stepProgress ?? []).map((s) => [s.stepId, s]));
 		let cancelled = false;
 		let lastSummary = run.progress ?? EMPTY_PROGRESS;
@@ -960,18 +923,9 @@ function createCleanupService(deps) {
 				}
 			},
 			/**
-			* Upsert one step's lifecycle state, preserving FIRST-SEEN order.
-			*
-			* A `Map` keyed by `stepId` is what keeps this bounded and idempotent: a
-			* step transitioning running → completed updates its entry rather than
-			* appending, so the array length is the step count and never the
-			* transition count. Insertion order is the execution order, which is what
-			* an operator reads down the list.
-			*
-			* Persisted on the NEXT `onStep` (or the terminal write) rather than
-			* immediately — a lifecycle transition is not itself a committed chunk,
-			* and writing on every one would defeat the progress throttle that exists
-			* to keep a long run from hammering the store.
+			* Upsert a step's state (bounded: one entry per step, first-seen order).
+			* Persisted with the NEXT `onStep` or terminal write, so transitions
+			* don't bypass the progress throttle.
 			*/
 			async onStepState(state) {
 				stepStates.set(state.stepId, state);
@@ -1525,4 +1479,4 @@ function createDataCleanupModule(deps) {
 	});
 }
 //#endregion
-export { CLEANUP_TERMINAL_STATUSES, CleanupCancelled, CleanupError, CleanupErrors, DEFAULT_CLEANUP_LIMITS, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { CLEANUP_TERMINAL_STATUSES, CleanupCancelled, CleanupError, CleanupErrors, DEFAULT_CLEANUP_LIMITS, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };

package/dist/cli/commands/describe.d.mts

@@ -1,5 +1,5 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DHbyPo5j.mjs";
+import { F as ResourceDefinition, X as RouteSchemaOptions, kt as RateLimitConfig } from "../../index-mqaqZNpe.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;
@@ -86,6 +86,8 @@ interface AggregationDescription {
 interface PermissionDescription {
   type: "public" | "requireAuth" | "requireRoles" | "custom";
   roles?: readonly string[];
+  /** `allowPublic({ policy })`: public, but a row policy narrows what anyone sees. */
+  rowFiltered?: true;
 }
 interface FieldDescription {
   type: string;
@@ -125,4 +127,4 @@ interface EventDescription {
 declare function describeResource(resource: ResourceDefinition<unknown>, module?: string): DescribedResource;
 declare function describe(args: string[]): Promise<void>;
 //#endregion
-export { describe, describeResource };
+export { DescribedResource, describe, describeResource };

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-BxLgNFF7.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-Cu7uTJp9.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-Cu7Mx7_U.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-CuCARu2B.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts
@@ -21,7 +21,10 @@ import { pathToFileURL } from "node:url";
 function describePermission(check) {
 	if (!check || typeof check !== "function") return { type: "custom" };
 	const fn = check;
-	if (fn._isPublic === true) return { type: "public" };
+	if (fn._isPublic === true) return fn._rowPolicy ? {
+		type: "public",
+		rowFiltered: true
+	} : { type: "public" };
 	if (Array.isArray(fn._roles)) return {
 		type: "requireRoles",
 		roles: fn._roles

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-C3LFRzPq.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-99fIMC3p.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-DT_G4VhY.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-3sLYbuse.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-D_YmiCNf.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-DRTkLlIl.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as init } from "../../init-Y2MlSN9n.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-B_oUYDXI.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-99fIMC3p.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-3sLYbuse.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-D_YmiCNf.mjs";
-import { t as init } from "../init-Y2MlSN9n.mjs";
+import { t as generate } from "../generate-DRTkLlIl.mjs";
+import { t as init } from "../init-B_oUYDXI.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-BxLgNFF7.mjs → constants-Cu7Mx7_U.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth
@@ -50,6 +50,8 @@ const DEFAULT_ID_FIELD = "_id";
 const DEFAULT_TENANT_FIELD = "organizationId";
 /** Default HTTP method for update routes */
 const DEFAULT_UPDATE_METHOD = "PATCH";
+/** Default version field under `concurrency: {}` (optimistic concurrency) */
+const DEFAULT_VERSION_FIELD = "__v";
 /** System-managed fields that cannot be set via request body */
 const SYSTEM_FIELDS = Object.freeze([
 	"_id",
@@ -88,4 +90,4 @@ const RESERVED_QUERY_PARAMS = Object.freeze(/* @__PURE__ */ new Set([
 	"_policyFilters"
 ]));
 //#endregion
-export { DEFAULT_SORT as a, HOOK_OPERATIONS as c, MAX_REGEX_LENGTH as d, MAX_SEARCH_LENGTH as f, SYSTEM_FIELDS as h, DEFAULT_MAX_LIMIT as i, HOOK_PHASES as l, RESERVED_QUERY_PARAMS as m, DEFAULT_ID_FIELD as n, DEFAULT_TENANT_FIELD as o, MUTATION_OPERATIONS as p, DEFAULT_LIMIT as r, DEFAULT_UPDATE_METHOD as s, CRUD_OPERATIONS as t, MAX_FILTER_DEPTH as u };
+export { DEFAULT_SORT as a, DEFAULT_VERSION_FIELD as c, MAX_FILTER_DEPTH as d, MAX_REGEX_LENGTH as f, SYSTEM_FIELDS as g, RESERVED_QUERY_PARAMS as h, DEFAULT_MAX_LIMIT as i, HOOK_OPERATIONS as l, MUTATION_OPERATIONS as m, DEFAULT_ID_FIELD as n, DEFAULT_TENANT_FIELD as o, MAX_SEARCH_LENGTH as p, DEFAULT_LIMIT as r, DEFAULT_UPDATE_METHOD as s, CRUD_OPERATIONS as t, HOOK_PHASES as u };

package/dist/context/index.d.mts

@@ -94,11 +94,8 @@ declare function getTraceHeaders(): Record<string, string> | undefined;
 //#endregion
 //#region src/context/requestScopedCache.d.ts
 /**
- * The cache for the CURRENT unit of work — a request, an event dispatch or a
- * job run (see `runWorkScope`) — or `undefined` outside one.
- *
- * Lazily created on first use, so a scope that never touches a cached
- * repository allocates nothing.
+ * The cache for the CURRENT unit of work (see `runWorkScope`), or `undefined`
+ * outside one. Lazily created on first use.
  */
 declare function requestScopedCache(): CacheAdapter | undefined;
 /**

package/dist/context/index.mjs

@@ -1,34 +1,23 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as transactionContext } from "../transactionContext-DCWMI6hV.mjs";
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-cSVKnYPk.mjs";
-import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-BhsWde4k.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "../transactionContext-DjFkrNG6.mjs";
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-Dsu9P1bV.mjs";
+import { n as evictToSize, r as touch } from "../boundedMap-BULzfXYU.mjs";
+import { n as scopedValue, r as workSeedFromEvent, t as runWorkScope } from "../workScope-zpPyge4t.mjs";
 //#region src/context/requestScopedCache.ts
 /** The memo slot the per-scope store hangs off. */
 const SLOT = Symbol.for("arc.requestScopedCache");
-/**
-* Entry cap for one scope's cache. A request touching this many distinct keys
-* is already pathological; a JOB RUN reaching it is ordinary, and that is the
-* case this exists for (see the eviction note below).
-*/
+/** Entry cap for one scope's cache — sized for long job runs, not requests. */
 const MAX_ENTRIES = 1e4;
 /**
 * A `Map`-backed `CacheAdapter` with NO TTL and LRU eviction above
 * {@link MAX_ENTRIES}.
 *
-* TTL is accepted and ignored because repo-core stamps freshness INTO the
-* envelope and re-checks on read — honouring it here too would put two clocks
-* on one question.
+* TTL is ignored: repo-core stamps freshness INTO the envelope and re-checks
+* on read, so honouring it here would put two clocks on one question.
 *
-* Eviction is newer than the rest of this file and the reason is worth
-* keeping. Unbounded was correct while a scope meant an HTTP REQUEST: the
-* store is unreachable once that async context ends, so it was garbage in
-* milliseconds and bounded by what one request touched, and an LRU would have
-* guarded a lifetime that could not occur. 2.40 extended scopes to job runs
-* and event dispatches — and `schedulesPlugin` wraps the WHOLE handler in one
-* scope, so a nightly job sweeping a million rows holds a single cache for the
-* duration. That is now a lifetime that occurs, and the old premise no longer
-* holds. Evicting is always safe here: this is a cache, so the worst a miss
-* costs is the re-read it was avoiding.
+* The cap matters because `schedulesPlugin` wraps a WHOLE job handler in one
+* scope, so a long sweep holds a single cache throughout. Evicting is always
+* safe — a miss costs only the re-read it was avoiding.
 */
 function createRequestCacheAdapter() {
 	const map = /* @__PURE__ */ new Map();
@@ -36,25 +25,19 @@ function createRequestCacheAdapter() {
 		async get(key) {
 			if (!map.has(key)) return void 0;
 			const value = map.get(key);
-			map.delete(key);
-			map.set(key, value);
+			touch(map, key, value);
 			return value;
 		},
 		async set(key, value, _ttlSeconds) {
-			map.delete(key);
-			map.set(key, value);
-			if (map.size > MAX_ENTRIES) {
-				const oldest = map.keys().next();
-				if (!oldest.done) map.delete(oldest.value);
-			}
+			touch(map, key, value);
+			evictToSize(map, MAX_ENTRIES);
 		},
 		async delete(key) {
 			map.delete(key);
 		},
 		/**
-		* Ignores the pattern and wipes the whole store. Over-invalidating within
-		* one request costs at most a re-read; pattern matching is complexity a
-		* store that dies in milliseconds does not earn.
+		* Ignores the pattern and wipes the whole store — over-invalidating a
+		* short-lived store costs at most a re-read.
 		*/
 		async clear(_pattern) {
 			map.clear();
@@ -62,11 +45,8 @@ function createRequestCacheAdapter() {
 	};
 }
 /**
-* The cache for the CURRENT unit of work — a request, an event dispatch or a
-* job run (see `runWorkScope`) — or `undefined` outside one.
-*
-* Lazily created on first use, so a scope that never touches a cached
-* repository allocates nothing.
+* The cache for the CURRENT unit of work (see `runWorkScope`), or `undefined`
+* outside one. Lazily created on first use.
 */
 function requestScopedCache() {
 	return scopedValue(SLOT, createRequestCacheAdapter);

package/dist/core/index.d.mts

@@ -1,4 +1,4 @@
 
-import { $t as AccessControlConfig, B as defineResource, Bt as BaseController, Cn as ControllerConstructionOptions, En as BodySanitizerConfig, Gt as SlugExt, Ht as SoftDeleteMixin, Jt as BulkMixin, Kt as SlugMixin, Qt as AccessControl, Sn as ControllerConfigurableOptions, Tn as BodySanitizer, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, Xt as QueryResolver, Yt as BaseCrudController, Zt as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, pt as AggregationMaterializedContext, qt as BulkExt, st as AggMeasureInput, ut as AggregationConfig, wn as ListResult, xn as BaseControllerOptions } from "../index-DHbyPo5j.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, D as createCrudRouter, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, O as createPermissionMiddleware, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, T as DefineActionConfig, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, _ as getEntityId, a as formatValidationErrors, b as defineResourceVariants, c as nativePolicyFilter, d as createCrudHandlers, f as createFastifyHandler, g as sendControllerResponse, h as getControllerScope, i as assertValidConfig, j as CrudOperation, k as defineAggregation, l as collectReadBlockedFields, m as getControllerContext, n as ValidateOptions, o as validateResourceConfig, p as createRequestContext, q as RESERVED_QUERY_PARAMS, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityIdField, w as mergeResourceConfig, x as AdapterLike, y as getEntityQuery, z as HOOK_PHASES } from "../index-D4u76eQW.mjs";
-export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };
+import { Bt as TreeMixin, Cn as ControllerConstructionOptions, Dn as BodySanitizerConfig, En as BodySanitizer, F as ResourceDefinition, Gt as BaseCrudController, Ht as SlugMixin, It as BaseController, Jt as AccessControl, Kt as QueryResolver, Lt as SoftDeleteExt, P as defineResource, Qt as FetchResult, Rt as SoftDeleteMixin, Sn as ControllerConfigurableOptions, Tn as MixinConstructor, Ut as BulkExt, Vt as SlugExt, Wt as BulkMixin, Xt as AccessControlRepository, Yt as AccessControlConfig, Zt as FetchDenialReason, at as AggregationCacheConfig, ct as AggregationIndexHint, dt as AggregationRateLimit, ft as AggregationsMap, it as AggMeasureShorthand, lt as AggregationMaterializedContext, ot as AggregationConfig, qt as QueryResolverConfig, rt as AggMeasureInput, st as AggregationDateRangeRequirement, ut as AggregationMaterializedResult, wn as ListResult, xn as BaseControllerOptions, zt as TreeExt } from "../index-mqaqZNpe.mjs";
+import { A as createPermissionMiddleware, B as DEFAULT_VERSION_FIELD, C as AdapterLike, D as DefineActionConfig, E as mergeResourceConfig, F as DEFAULT_LIMIT, G as MAX_FILTER_DEPTH, H as HOOK_PHASES, I as DEFAULT_MAX_LIMIT, J as MUTATION_OPERATIONS, K as MAX_REGEX_LENGTH, L as DEFAULT_SORT, M as CRUD_OPERATIONS, N as CrudOperation, O as defineAction, P as DEFAULT_ID_FIELD, R as DEFAULT_TENANT_FIELD, S as defineResourceVariants, T as SeamedResourceConfig, U as HookOperation, V as HOOK_OPERATIONS, W as HookPhase, X as RESERVED_QUERY_PARAMS, Y as MutationOperation, Z as SYSTEM_FIELDS, _ as getEntityIdField, a as formatValidationErrors, b as VariantsMap, c as nativePolicyFilter, d as createFastifyHandler, f as createRequestContext, g as getEntityId, h as sendControllerResponse, i as assertValidConfig, j as defineAggregation, k as createCrudRouter, l as collectReadBlockedFields, m as getControllerScope, n as ValidateOptions, o as validateResourceConfig, p as getControllerContext, q as MAX_SEARCH_LENGTH, r as ValidationResult, s as NativePolicyFilter, t as ConfigError, u as isFieldReadable, v as getEntityQuery, w as ResourceSeams, x as VariantsResult, y as VariantOverride, z as DEFAULT_UPDATE_METHOD } from "../index-CRoPtISf.mjs";
+export { AccessControl, type AccessControlConfig, type AccessControlRepository, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DEFAULT_VERSION_FIELD, type DefineActionConfig, type FetchDenialReason, type FetchResult, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MixinConstructor, MutationOperation, type NativePolicyFilter, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, type VariantOverride, type VariantsMap, type VariantsResult, assertValidConfig, collectReadBlockedFields, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };