@classytic/arc 2.41.1 → 2.44.0

package/dist/boundedMap-DWiKW7lP.mjs

@@ -0,0 +1,57 @@
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+//#region src/collections/boundedMap.ts
+/**
+* Insertion-order LRU on a plain `Map` — the two moves, written once.
+*
+* A `Map` iterates in insertion order, so "move to most-recent" is
+* delete-then-set and "least-recent" is the first key. Seven places in arc
+* hand-rolled that, and hand-rolled copies drifted into real bugs:
+*
+*   - the response cache evicted with `while (size >= maxEntries)` BEFORE
+*     inserting, so `maxEntries: 0` spun forever on the first write — no key
+*     to evict, loop condition never changes, event loop frozen;
+*   - `maxEntries: NaN` made the same comparison always false: unbounded;
+*   - the MCP auth cache guarded eviction with `if (firstKey)`, a falsy check,
+*     so an empty-string key could never be evicted.
+*
+* These are functions over the caller's own `Map`, not a class, on purpose:
+* each site keeps its TTL, byte accounting and stats, and borrows only the
+* part that kept going wrong.
+*/
+/** Move `key` to most-recent and set it. Use on read-hit (LRU) or on overwrite. */
+function touch(map, key, value) {
+	map.delete(key);
+	map.set(key, value);
+}
+/**
+* Evict least-recent entries until `map.size <= maxSize`; returns how many.
+*
+* Call AFTER inserting. That ordering is what makes it total: with
+* `maxSize: 0` the just-inserted entry is evicted (a disabled cache), never an
+* infinite loop, and the loop terminates on the iterator running dry rather
+* than on the size comparison alone. A non-finite or negative `maxSize` is a
+* configuration bug — {@link assertCapacity} it where the option is read.
+*/
+function evictToSize(map, maxSize, onEvict) {
+	let evicted = 0;
+	while (map.size > maxSize) {
+		const oldest = map.entries().next();
+		if (oldest.done) break;
+		const [key, value] = oldest.value;
+		map.delete(key);
+		onEvict?.(key, value);
+		evicted++;
+	}
+	return evicted;
+}
+/**
+* Validate a capacity option at construction: a non-negative integer. `0` is
+* allowed and means "keep nothing". Throws with the option's name so the error
+* points at the host's config, not at a hang or an unbounded map later.
+*/
+function assertCapacity(name, value) {
+	if (!Number.isInteger(value) || value < 0) throw new Error(`[arc] ${name} must be a non-negative integer, got ${String(value)}.`);
+	return value;
+}
+//#endregion
+export { evictToSize as n, touch as r, assertCapacity as t };

package/dist/{buildHandler-CvxKOc0m.mjs → buildHandler-Bswu_vNb.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters } from "./authorizationDecision-DawKGoXb.mjs";
-import { g as toRepositoryFilter } from "./BaseController-CYEwjyjN.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-DrYWnOzI.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as conjoinPolicyFilters } from "./filter-merge-DGM-GQ1J.mjs";
+import { C as toRepositoryFilter } from "./plugin-DALd9dcF.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CWp-lsrm.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -1,7 +1,8 @@
 
 import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BOk3YnTz.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DFA-QrU9.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-BzqxconG.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache--5uAuYPW.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-C2lZjTxk.mjs";
+import { n as UpstashKeyValueCommands, t as IoredisKeyValueCommands } from "../redisShapes-CQksY67q.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities
@@ -11,17 +12,18 @@ import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOp
  * to ensure multi-tenant isolation and O(1) version-based invalidation.
  */
 /** Build a deterministic cache key for a query */
-declare function buildQueryKey(resource: string, operation: string, resourceVersion: number, params: Record<string, unknown>, userId?: string, orgId?: string): string;
+export declare function buildQueryKey(resource: string, operation: string, resourceVersion: number, params: Record<string, unknown>, userId?: string, orgId?: string): string;
 /** Resource version key — stored in CacheStore, bumped on mutations */
-declare function versionKey(resource: string): string;
+export declare function versionKey(resource: string): string;
 /** Tag version key — stored in CacheStore, bumped on cross-resource invalidation */
-declare function tagVersionKey(tag: string): string;
+export declare function tagVersionKey(tag: string): string;
 /**
- * Stable hash for query params.
- * Sorts keys recursively, serializes to JSON, then applies djb2 hash.
- * Returns hex string.
+ * Digest of the query params for a cache key — repo-core's canonical serialiser (escaped,
+ * type-preserving, key-order-free) under SHA-256. Two different queries never share a key: a
+ * delimiter inside a value, `1` vs `"1"`, two dates or two regexes all stay distinct, and a
+ * cryptographic digest leaves no crafted collision onto another caller's cached result.
  */
-declare function hashParams(params: Record<string, unknown>): string;
+export declare function hashParams(params: Record<string, unknown>): string;
 //#endregion
 //#region src/cache/memory.d.ts
 interface MemoryCacheStoreOptions {
@@ -37,9 +39,11 @@ interface MemoryCacheStoreOptions {
    */
   maxEntryBytes?: number;
   /**
-   * Total memory budget in bytes (default: 50 MiB).
-   * When exceeded, LRU entries are evicted until usage drops below watermark.
-   * Set to 0 to disable (rely on maxEntries only).
+   * Total budget in bytes (default: 50 MiB), counted as serialized value
+   * bytes plus key bytes — an estimate of payload, NOT a heap limit (Map
+   * and object overhead are not counted). When exceeded, LRU entries are
+   * evicted until usage drops to the watermark. Set to 0 to disable (rely
+   * on maxEntries only).
    */
   maxMemoryBytes?: number;
   /**
@@ -57,7 +61,7 @@ interface MemoryCacheStoreOptions {
  * - Entry size guard to avoid runaway memory usage
  * - Stats tracking for observability
  */
-declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
+export declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
   readonly name = "memory-cache";
   private readonly cache;
   private readonly defaultTtlSeconds;
@@ -91,8 +95,8 @@ declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
   close(): Promise<void>;
   stats(): CacheStats;
   private removeEntry;
-  private evictToLimit;
-  private evictToMemoryLimit;
+  /** Every write path ends here, so no path can skip a limit. */
+  private enforceLimits;
   private cleanupExpired;
   private estimateSize;
 }
@@ -145,7 +149,7 @@ interface RedisCacheStoreOptions {
  * Suitable for multi-instance and horizontally scaled deployments.
  * Uses pipeline batching when available for bulk operations.
  */
-declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
+export declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
   readonly name = "redis-cache";
   private readonly client;
   private readonly prefix;
@@ -179,22 +183,16 @@ declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
   private withPrefix;
 }
 /**
- * Minimal ioredis shape we depend on. We don't import ioredis itself so the
- * cache subpath stays peer-dep-free. The `scan` tail is `unknown[]` so a real
- * ioredis `Redis` (overloads with literal tokens + optional callback) is
- * assignable — see the same note on the idempotency `IoredisLike`.
+ * Minimal ioredis shape the cache depends on — the shared key/value commands
+ * (`utils/redisShapes.ts`, where the `unknown[]`-tail rule is explained) plus
+ * the cache's own extras. Not importing ioredis keeps the subpath peer-dep-free.
  */
-interface IoredisLike {
-  get(key: string): Promise<string | null>;
-  set(...args: unknown[]): Promise<string | null>;
-  del(...keys: string[]): Promise<number>;
-  scan(cursor: string | number, ...args: unknown[]): Promise<[string, string[]]>;
+interface IoredisLike extends IoredisKeyValueCommands {
   pipeline?(): {
     del(key: string): unknown;
     exec(): Promise<unknown>;
   };
   incrby?(key: string, by: number): Promise<number>;
-  eval?(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
 }
 /**
  * Wrap an ioredis instance as a `RedisCacheClient`.
@@ -216,24 +214,14 @@ interface IoredisLike {
  * });
  * ```
  */
-declare function ioredisAsCacheClient(client: IoredisLike): RedisCacheClient;
+export declare function ioredisAsCacheClient(client: IoredisLike): RedisCacheClient;
 /**
- * Minimal `@upstash/redis` REST SDK shape we depend on.
- *
- * `@upstash/redis` is HTTP-based and works on edge runtimes (Cloudflare
- * Workers, Vercel Edge, Deno Deploy) where TCP connections — and thus
- * ioredis — are unavailable.
+ * Minimal `@upstash/redis` REST SDK shape the cache depends on — the shared
+ * key/value commands (`utils/redisShapes.ts`) plus `incrby`. HTTP-based, so it
+ * works on edge runtimes where ioredis cannot.
  */
-interface UpstashRedisLike {
-  get(key: string): Promise<string | null | unknown>;
-  set(key: string, value: unknown, opts?: Record<string, unknown>): Promise<unknown>;
-  del(...keys: string[]): Promise<number>;
-  scan(cursor: number | string, opts?: {
-    match?: string;
-    count?: number;
-  }): Promise<[number, string[]] | [string, string[]]>;
+interface UpstashRedisLike extends UpstashKeyValueCommands {
   incrby?(key: string, by: number): Promise<number>;
-  eval?(script: string, keys: string[], args: (string | number)[]): Promise<unknown>;
 }
 /**
  * Wrap an `@upstash/redis` REST client as a `RedisCacheClient`.
@@ -253,6 +241,6 @@ interface UpstashRedisLike {
  * });
  * ```
  */
-declare function upstashAsCacheClient(client: UpstashRedisLike): RedisCacheClient;
+export declare function upstashAsCacheClient(client: UpstashRedisLike): RedisCacheClient;
 //#endregion
-export { type CacheEnvelope, type CacheLogger, type CacheResult, type CacheStats, type CacheStatus, type CacheStore, type CrossResourceRule, type IoredisLike, MemoryCacheStore, type MemoryCacheStoreOptions, QueryCache, type QueryCacheConfig, type QueryCacheDefaults, type QueryCachePluginOptions, type RedisCacheClient, RedisCacheStore, type RedisCacheStoreOptions, type RedisPipeline, type UpstashRedisLike, buildQueryKey, hashParams, ioredisAsCacheClient, queryCachePlugin, tagVersionKey, upstashAsCacheClient, versionKey };
+export { type CacheEnvelope, type CacheLogger, type CacheResult, type CacheStats, type CacheStatus, type CacheStore, type CrossResourceRule, type IoredisLike, type MemoryCacheStoreOptions, QueryCache, type QueryCacheConfig, type QueryCacheDefaults, type QueryCachePluginOptions, type RedisCacheClient, type RedisCacheStoreOptions, type RedisPipeline, type UpstashRedisLike, queryCachePlugin };

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-cpZCtcIE.mjs";
-import { t as MemoryCacheStore } from "../memory-Iotz0cCx.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DZHPOm9p.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-CpoiZ8hU.mjs";
+import { t as MemoryCacheStore } from "../memory-CTa5pOCW.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BATECpyh.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-DbCBxlgw.mjs → caching-Drp68DIS.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({
@@ -74,4 +74,4 @@ var caching_default = fp(cachingPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { caching_default as n, caching_exports as r, cachingPlugin as t };
+export { caching_exports as n, caching_default as t };

package/dist/claimed-DYvQoZLv.mjs

@@ -0,0 +1,8 @@
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+//#region src/events/outbox/claimed.ts
+function claimedAttempts(claimed) {
+	const value = claimed.attempts;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+//#endregion
+export { claimedAttempts as t };

package/dist/cleanup/index.d.mts

@@ -1,9 +1,8 @@
 
-import { L as RequestWithExtras } from "../index-DHbyPo5j.mjs";
+import { A as RequestWithExtras } from "../index-WH7xgvxS.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
-import { t as ArcModule } from "../types-DfVDvkdP.mjs";
+import { n as ArcModule } from "../types-BJ-2XqVF.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
-import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";
 //#region src/cleanup/compose.d.ts
 /** Metadata + steps for {@link recipeFromSteps}. */
@@ -39,7 +38,7 @@ interface RecipeFromStepsInput {
   /** Provider steps in EXECUTION ORDER. */
   readonly steps: readonly CleanupStep[];
 }
-declare function recipeFromSteps(input: RecipeFromStepsInput): CleanupRecipe;
+export declare function recipeFromSteps(input: RecipeFromStepsInput): CleanupRecipe;
 //#endregion
 //#region src/cleanup/errors.d.ts
 /**
@@ -84,7 +83,7 @@ type CleanupErrorCode =
  * step 4 of its classifier — a numeric `statusCode` + a separatored domain
  * `code` maps to that exact status + code on the wire, never `arc.internal_error`).
  */
-declare class CleanupError extends Error {
+export declare class CleanupError extends Error {
   readonly code: CleanupErrorCode;
   readonly status: number;
   /** Alias of {@link status} — the property arc's error handler classifies on. */
@@ -97,11 +96,11 @@ declare class CleanupError extends Error {
  * durable `cancelRequested` flag is set. NOT a wire error — `processRun`
  * catches it and CAS-transitions the run to `cancelled`.
  */
-declare class CleanupCancelled extends Error {
+export declare class CleanupCancelled extends Error {
   readonly runId: string;
   constructor(runId: string);
 }
-declare const CleanupErrors: {
+export declare const CleanupErrors: {
   readonly unknownRecipe: (id: string) => CleanupError;
   readonly duplicateRecipe: (id: string) => CleanupError;
   readonly unavailable: (id: string, reason: string) => CleanupError;
@@ -132,7 +131,7 @@ declare const CleanupErrors: {
  * In-memory {@link CleanupRunStore}. Single-process only — see the module
  * docblock for the production caveat.
  */
-declare class MemoryCleanupRunStore implements CleanupRunStore {
+export declare class MemoryCleanupRunStore implements CleanupRunStore {
   #private;
   /** Live run state, keyed by run id. Exposed for tests/inspection. */
   readonly runs: Map<string, CleanupRun>;
@@ -149,7 +148,7 @@ declare class MemoryCleanupRunStore implements CleanupRunStore {
  * In-memory {@link CleanupEvidenceStore} — idempotent by
  * `evidence.operationId`, exactly as the port requires.
  */
-declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
+export declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
   #private;
   readonly evidence: PurgeEvidence[];
   readonly manifests: CleanupManifest[];
@@ -167,7 +166,7 @@ declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
  * gives you a microtask-deferred in-process queue that DOES auto-run
  * `processRun` off the request path.
  */
-declare class MemoryCleanupJobQueue implements CleanupJobQueue {
+export declare class MemoryCleanupJobQueue implements CleanupJobQueue {
   readonly jobs: CleanupJob[];
   enqueue(job: CleanupJob): Promise<void>;
   /** Take everything enqueued so far, clearing the buffer. */
@@ -196,19 +195,18 @@ interface CleanupRegistry {
  * construction if two recipes share an id — a boot-time failure, never a
  * silent last-wins overwrite.
  */
-declare function createCleanupRegistry(recipes: readonly CleanupRecipe[]): CleanupRegistry;
+export declare function createCleanupRegistry(recipes: readonly CleanupRecipe[]): CleanupRegistry;
 //#endregion
 //#region src/cleanup/service.d.ts
 interface CleanupServiceDeps {
   registry: CleanupRegistry;
   runStore: CleanupRunStore;
   evidenceStore: CleanupEvidenceStore;
-  /** Optional write fence (§8). No-op when absent. */
+  /** Optional write fence. No-op when absent. */
   writeFence?: CleanupWriteFence | undefined;
   /**
-   * Durable job queue (§8). Defaults to a microtask-deferred in-process queue
-   * that calls `processRun` off the request path (single-process only). Inject
-   * BullMQ / SQS / repo-backed for cross-process durability + restart recovery.
+   * Durable job queue. Default: an in-process microtask queue (single-process,
+   * no restart recovery) — inject BullMQ / SQS / repo-backed for durability.
    */
   jobQueue?: CleanupJobQueue | undefined;
   /** Framework size caps. Defaults to {@link DEFAULT_CLEANUP_LIMITS}. */
@@ -261,9 +259,7 @@ interface CleanupService {
   cancel(id: string, input?: CancelInput): Promise<CleanupRun>;
   retry(id: string): Promise<CleanupRun>;
 }
-/** Admission key serializing every destructive run behind one slot. */
-declare const GLOBAL_DESTRUCTIVE_KEY = "global-destructive";
-declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
+export declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
 interface DataCleanupModuleDeps {
@@ -334,15 +330,15 @@ interface DataCleanupModuleDeps {
   /** Injected clock (tests). */
   now?: () => Date;
 }
-declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
+export declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
 //#endregion
 //#region src/cleanup/plan-digest.d.ts
 /** `sha256(canonical(planMaterial))` as a hex digest. */
-declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
+export declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
 /**
  * Integrity checksum of a completed manifest (§5). Excludes the digest field
  * itself. Dates (e.g. `completedAt`) participate via the strict canonicalizer.
  */
-declare function computeManifestDigest(manifest: Record<string, unknown>): string;
+export declare function computeManifestDigest(manifest: Record<string, unknown>): string;
 //#endregion
-export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, type CleanupContext, type CleanupErrorCode, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult };

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-CgenB1gv.mjs";
-import { t as defineResource } from "../defineResource-DxkMTjRn.mjs";
-import { t as defineModule } from "../module-DpLJG2_N.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-fvO6Ovzx.mjs";
+import { t as defineResource } from "../defineResource-gUp9ug66.mjs";
+import { t as defineModule } from "../module--L0iBIZz.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -612,8 +612,8 @@ function createCleanupRegistry(recipes) {
 * implementation (`Date`-explicit, strict-reject of `undefined`/`NaN`/`BigInt`/
 * `function`/`symbol`/`Map`/`Set`/cyclic). Two domains consume it — cleanup
 * manifests here + financial-close evidence manifests in arc-accounting — so it
-* lives in primitives, not duplicated per package. `canonicalJson` is re-exported
-* for existing importers; peer floor `@classytic/primitives >= 0.17.0`.
+* lives in primitives, not duplicated per package — import `canonicalJson` from
+* there; peer floor `@classytic/primitives >= 0.17.0`.
 */
 /**
 * The material content of a plan — everything an operator is consenting to.
@@ -656,33 +656,22 @@ function computeManifestDigest(manifest) {
 /**
 * Cleanup orchestration service — the framework's use-case core.
 *
-* Split into a REQUEST path and a WORKER path so the durability guarantees the
-* ports promise actually hold:
+* REQUEST path vs WORKER path:
 *
-*   preview()      → re-plan, seal a digest, surface blockers/retains/confirmation
-*   execute()      → validate (availability, digest, confirmation, reason,
-*                    blockers, limits), ATOMICALLY create the run (admission
-*                    guard by concurrencyKey), persist the sealed operation,
-*                    ENQUEUE `{ runId }`, and RETURN. It does NOT run the recipe.
-*   processRun()   → the worker entrypoint. Takes an EXCLUSIVE LEASE on the run
-*                    (`claim` — a live lease refuses duplicate workers), then
-*                    branches: a `finalizing` run RECOVERS finalization from the
-*                    persisted payload (never re-executes); a `queued` run (or a
-*                    crashed `running` run whose lease expired) executes the
-*                    recipe with cooperative cancellation, verifies, persists
-*                    the finalization payload, and finalizes idempotently.
-*   cancel()       → durable cancel request (+ actor/reason audit) + CAS a
-*                    not-yet-running run straight to `cancelled` WITH evidence.
-*                    A running run stops cooperatively and leaves evidence of
-*                    the committed chunks.
-*   retry()        → reload the SAME sealed operation, re-check availability +
-*                    recipe version + digest against a fresh plan (refuse if the
-*                    world changed), re-arm ATOMICALLY under the same admission
-*                    guard as creation, re-enqueue.
+*   preview()    → re-plan and seal a digest.
+*   execute()    → validate, ATOMICALLY create the run (admission guard by
+*                  concurrencyKey), ENQUEUE `{ runId }`, return. Never runs the recipe.
+*   processRun() → worker entrypoint. Takes an EXCLUSIVE lease; a `finalizing`
+*                  run only replays finalization from the persisted payload
+*                  (never re-executes); a `queued` or lease-expired `running`
+*                  run executes, verifies, persists the payload, finalizes.
+*   cancel()     → durable, audited request; a not-yet-running run goes straight
+*                  to `cancelled` WITH evidence, a running one stops cooperatively.
+*   retry()      → re-validate the SAME sealed operation against a fresh plan
+*                  (refuse if it changed), re-arm atomically under the same guard.
 *
-* Every status change goes through `compareAndTransition` (CAS) carrying the
-* worker's lease token, so a late `completed` write from a stalled ex-owner can
-* never clobber the new owner's `cancelled`/`running` state.
+* Every status change is a CAS carrying the lease token, so a stalled ex-owner's
+* late write can never clobber the new owner's state.
 */
 const EMPTY_PROGRESS = {
 	processed: 0,
@@ -724,20 +713,9 @@ function createCleanupService(deps) {
 	const generateId = deps.generateId ?? (() => globalThis.crypto.randomUUID());
 	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
 	/**
-	* Undefined-valued keys are DROPPED, not spread.
-	*
-	* `limits` is `Partial<CleanupLimits>`, which permits an EXPLICIT `undefined`
-	* — and a plain spread lets that overwrite the default rather than fall back
-	* to it. Every limit is then read in a comparison, and `n > undefined` is
-	* always `false`, so `{ limits: { maxPlanItems: undefined } }` did not raise
-	* the cap: it silently REMOVED it, on a framework whose whole job is deleting
-	* data. Same for `maxReasonLength` / `maxParamDepth`, and `maxResults` turned
-	* `slice(0, undefined)` into "keep everything".
-	*
-	* A host reaches this by forwarding an optional config through
-	* (`limits: { maxPlanItems: cfg.planCap }`) — no cast, no obvious mistake.
-	* `permissions/presets.ts` already filters for exactly this reason; this is
-	* the same rule applied to the destructive path.
+	* Undefined-valued keys are DROPPED, not spread: an explicit `undefined`
+	* would overwrite the default, and `n > undefined` is always false — so the
+	* cap would silently disappear on the path that deletes data.
 	*/
 	const limits = {
 		...DEFAULT_CLEANUP_LIMITS,
@@ -772,14 +750,6 @@ function createCleanupService(deps) {
 		}, ctx);
 		const items = draft.items;
 		if (items.length > limits.maxPlanItems) throw CleanupErrors.planTooLarge(`${items.length} items > maxPlanItems ${limits.maxPlanItems}`);
-		/**
-		* Partition by DISPOSITION — a protective guard's count is not damage.
-		*
-		* This was one `reduce` over every item, so a guard reporting the 173 posted
-		* journal entries it defends pushed the "records to remove" headline to 540
-		* on a plan that removes 367. Absent disposition means `'remove'`, so every
-		* pre-existing recipe is unchanged.
-		*/
 		const estimatedTotal = items.reduce((sum, i) => sum + ((i.disposition ?? "remove") === "remove" ? i.estimated : 0), 0);
 		const protectedTotal = items.reduce((sum, i) => sum + (i.disposition === "protect" ? i.estimated : 0), 0);
 		const blockers = new Set(draft.blockers ?? []);
@@ -907,13 +877,6 @@ function createCleanupService(deps) {
 		let processed = 0;
 		let steps = 0;
 		let failed = 0;
-		/**
-		* Per-step lifecycle, keyed by `stepId` and ordered by first sight.
-		*
-		* Seeded from the run's existing progress so a RESUMED run (crash recovery,
-		* retry) keeps the states it already recorded instead of presenting an
-		* operator with a blank pipeline for work that demonstrably happened.
-		*/
 		const stepStates = new Map((run.progress?.stepProgress ?? []).map((s) => [s.stepId, s]));
 		let cancelled = false;
 		let lastSummary = run.progress ?? EMPTY_PROGRESS;
@@ -960,18 +923,9 @@ function createCleanupService(deps) {
 				}
 			},
 			/**
-			* Upsert one step's lifecycle state, preserving FIRST-SEEN order.
-			*
-			* A `Map` keyed by `stepId` is what keeps this bounded and idempotent: a
-			* step transitioning running → completed updates its entry rather than
-			* appending, so the array length is the step count and never the
-			* transition count. Insertion order is the execution order, which is what
-			* an operator reads down the list.
-			*
-			* Persisted on the NEXT `onStep` (or the terminal write) rather than
-			* immediately — a lifecycle transition is not itself a committed chunk,
-			* and writing on every one would defeat the progress throttle that exists
-			* to keep a long run from hammering the store.
+			* Upsert a step's state (bounded: one entry per step, first-seen order).
+			* Persisted with the NEXT `onStep` or terminal write, so transitions
+			* don't bypass the progress throttle.
 			*/
 			async onStepState(state) {
 				stepStates.set(state.stepId, state);
@@ -1525,4 +1479,4 @@ function createDataCleanupModule(deps) {
 	});
 }
 //#endregion
-export { CLEANUP_TERMINAL_STATUSES, CleanupCancelled, CleanupError, CleanupErrors, DEFAULT_CLEANUP_LIMITS, GLOBAL_DESTRUCTIVE_KEY, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, canonicalJson, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { CLEANUP_TERMINAL_STATUSES, CleanupCancelled, CleanupError, CleanupErrors, DEFAULT_CLEANUP_LIMITS, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };

package/dist/cli/commands/describe.d.mts

@@ -1,7 +1,7 @@
 
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DHbyPo5j.mjs";
+import { F as ResourceDefinition, X as RouteSchemaOptions, kt as RateLimitConfig } from "../../index-WH7xgvxS.mjs";
 //#region src/cli/commands/describe.d.ts
-interface DescribedResource {
+export interface DescribedResource {
   name: string;
   displayName: string;
   prefix: string;
@@ -86,6 +86,8 @@ interface AggregationDescription {
 interface PermissionDescription {
   type: "public" | "requireAuth" | "requireRoles" | "custom";
   roles?: readonly string[];
+  /** `allowPublic({ policy })`: public, but a row policy narrows what anyone sees. */
+  rowFiltered?: true;
 }
 interface FieldDescription {
   type: string;
@@ -122,7 +124,7 @@ interface EventDescription {
  * Hosts that want a JSON dump of one resource without spawning the CLI
  * can call this directly.
  */
-declare function describeResource(resource: ResourceDefinition<unknown>, module?: string): DescribedResource;
-declare function describe(args: string[]): Promise<void>;
+export declare function describeResource(resource: ResourceDefinition<unknown>, module?: string): DescribedResource;
+export declare function describe(args: string[]): Promise<void>;
 //#endregion
-export { describe, describeResource };
+export {};

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-D5Ubn1fe.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-MGpXoxHZ.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-B2QHb6u6.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-DJxHUpE4.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts
@@ -21,7 +21,10 @@ import { pathToFileURL } from "node:url";
 function describePermission(check) {
 	if (!check || typeof check !== "function") return { type: "custom" };
 	const fn = check;
-	if (fn._isPublic === true) return { type: "public" };
+	if (fn._isPublic === true) return fn._rowPolicy ? {
+		type: "public",
+		rowFiltered: true
+	} : { type: "public" };
 	if (Array.isArray(fn._roles)) return {
 		type: "requireRoles",
 		roles: fn._roles

package/dist/cli/commands/docs.d.mts

@@ -6,6 +6,5 @@
  * Export OpenAPI specification from registered resources.
  * Requires an entry file that exports defineResource() results.
  */
-declare function exportDocs(args: string[]): Promise<void>;
-//#endregion
-export { exportDocs };
+export declare function exportDocs(args: string[]): Promise<void>;
+//#endregion

package/dist/cli/commands/docs.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as buildOpenApiSpec } from "../../openapi-CmFf3yq_.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-ixtfL3J2.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-CMegfsm8.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-MP8xEppu.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.d.mts

@@ -6,6 +6,5 @@
  * Health check utility that validates the development environment.
  * Checks Node.js version, dependencies, configuration, and env variables.
  */
-declare function doctor(_args?: string[]): Promise<void>;
-//#endregion
-export { doctor };
+export declare function doctor(_args?: string[]): Promise<void>;
+//#endregion

package/dist/cli/commands/doctor.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.mjs

@@ -1,3 +1,2 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as generate } from "../../generate-BLRf2m3y.mjs";
-export { generate };
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+export { t as generate } from "../../generate-BXKo2Gc8.mjs";