@classytic/arc 2.43.0 → 2.44.0

package/dist/{EventTransport-tzA7CAB4.mjs → EventTransport-DZWDsaPa.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-zpPyge4t.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as workSeedFromEvent, t as runWorkScope } from "./workScope-n9a7d_lZ.mjs";
 import { createEvent, createEventRouter } from "@classytic/primitives/events";
 //#region src/events/EventTransport.ts
 /**

package/dist/{HookSystem-B6UaKRbF.mjs → HookSystem-yjEgn7Cm.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as buildRequestScopeProjection } from "./projection-Ce4aQhQk.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as buildRequestScopeProjection } from "./projection-wFoLqdss.mjs";
 //#region src/hooks/HookSystem.ts
 /**
 * Hook System

package/dist/{ResourceRegistry-CuCARu2B.mjs → ResourceRegistry-DJxHUpE4.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import "./constants-Cu7Mx7_U.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import "./constants-B2QHb6u6.mjs";
 //#region src/registry/ResourceRegistry.ts
 /**
 * Resource Registry

package/dist/acquire-BozJ-9yt.mjs

@@ -0,0 +1,35 @@
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+//#region src/idempotency/acquire.ts
+async function acquireIdempotencyKey(store, key, requestId, lockTtlMs) {
+	if (typeof store.acquire === "function") return store.acquire(key, requestId, lockTtlMs);
+	return acquireBySteps(store, key, requestId, lockTtlMs);
+}
+/** `get` → `tryLock` → `get`, for stores without an atomic `acquire`. */
+async function acquireBySteps(store, key, requestId, lockTtlMs) {
+	const cached = await store.get(key);
+	if (cached) return {
+		status: "completed",
+		result: cached
+	};
+	if (!await store.tryLock(key, requestId, lockTtlMs)) return { status: "locked" };
+	let completed;
+	try {
+		completed = await store.get(key);
+	} catch (err) {
+		await store.unlock(key, requestId);
+		throw err;
+	}
+	if (!completed) return { status: "acquired" };
+	await store.unlock(key, requestId);
+	return {
+		status: "completed",
+		result: completed
+	};
+}
+/** Release a held lock — skipped after a completion that already released it. */
+async function releaseIdempotencyLock(store, key, requestId, completed) {
+	if (completed && store.completionReleasesLock === true) return;
+	await store.unlock(key, requestId);
+}
+//#endregion
+export { acquireIdempotencyKey as n, releaseIdempotencyLock as r, acquireBySteps as t };

package/dist/{actionPermissions-BotX1YOa.mjs → actionPermissions-5N04zBL4.mjs}

@@ -1,16 +1,16 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { f as createError } from "./errors-CtrywMHP.mjs";
-import { n as getUserRoles } from "./userHelpers-aklawRaK.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, u as getRequestScope, x as isMember } from "./types-Bk9NOgOC.mjs";
-import { a as resolveEffectiveRoles, r as deriveHiddenFieldPermissions, t as applyFieldReadPermissions } from "./fields-ToPYpMqS.mjs";
-import { t as buildRequestScopeProjection } from "./projection-Ce4aQhQk.mjs";
-import { n as requestContext } from "./requestContext-Dsu9P1bV.mjs";
-import { n as isTenantPreparation } from "./tenantPreparation-BKon6Yox.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-DQYrkl5f.mjs";
-import { t as executePipeline } from "./pipe-BqeGT6UO.mjs";
-import { n as idempotencyConfigProblem, t as declaresIdempotencyFence } from "./requirement-KDdoRcOP.mjs";
-import { i as resolveResourceRateLimiter, r as recordUnenforcedRateLimit } from "./resourceRateLimit-dSjVr1pk.mjs";
-import { n as arcRouteValidatorCompiler } from "./routeValidator-D36SW8qt.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { f as createError } from "./errors-CW4anJBy.mjs";
+import { n as getUserRoles } from "./userHelpers-C76zD5pa.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, u as getRequestScope, x as isMember } from "./types-fvO6Ovzx.mjs";
+import { a as resolveEffectiveRoles, r as deriveHiddenFieldPermissions, t as applyFieldReadPermissions } from "./fields-A5crhsJb.mjs";
+import { t as buildRequestScopeProjection } from "./projection-wFoLqdss.mjs";
+import { n as requestContext } from "./requestContext-C10UeFe5.mjs";
+import { n as isTenantPreparation } from "./tenantPreparation-CBvvAcAj.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-wX3SA9w_.mjs";
+import { t as executePipeline } from "./pipe-D81zMtWs.mjs";
+import { n as idempotencyConfigProblem, t as declaresIdempotencyFence } from "./requirement-Bu50QALH.mjs";
+import { i as resolveResourceRateLimiter, r as recordUnenforcedRateLimit } from "./resourceRateLimit-urWPJxrt.mjs";
+import { n as arcRouteValidatorCompiler } from "./routeValidator-DHtpzrzk.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -657,10 +657,6 @@ function buildRateLimitConfig(rateLimit) {
 //#endregion
 //#region src/core/middlewares/registerRoute.ts
 /**
-* Route registration — the one place every arc router hands a route to Fastify: arc's request
-* validator, the idempotency-declaration fence, and duplicate-route diagnostics.
-*/
-/**
 * Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
 *
 * Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD

package/dist/audit/index.d.mts

@@ -1,6 +1,6 @@
 
 import { d as UserBase } from "../base-CZyixEQR.mjs";
-import "../index-mqaqZNpe.mjs";
+import "../index-WH7xgvxS.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts
@@ -88,7 +88,7 @@ interface AuditQueryOptions {
 /**
  * Create audit entry from context
  */
-declare function createAuditEntry(resource: string, documentId: string, action: AuditAction, context: AuditContext, data?: {
+export declare function createAuditEntry(resource: string, documentId: string, action: AuditAction, context: AuditContext, data?: {
   before?: Record<string, unknown>;
   after?: Record<string, unknown>;
   metadata?: Record<string, unknown>;
@@ -253,7 +253,7 @@ interface AuditRequestLike {
  * The audit context of a request, from its VALIDATED scope: the actor is the scope's user
  * (or service client) and the organization is the scope's active organization.
  */
-declare function auditContextOf(request: AuditRequestLike): AuditContext;
+export declare function auditContextOf(request: AuditRequestLike): AuditContext;
 declare const _default: FastifyPluginAsync<AuditPluginOptions>;
 //#endregion
 //#region src/audit/repository-audit-adapter.d.ts
@@ -275,14 +275,14 @@ interface RepositoryAuditStoreOptions {
    */
   readonly sessionProvider?: () => unknown;
 }
-declare function repositoryAsAuditStore(repository: RepositoryLike, options?: RepositoryAuditStoreOptions): AuditStore;
+export declare function repositoryAsAuditStore(repository: RepositoryLike, options?: RepositoryAuditStoreOptions): AuditStore;
 //#endregion
 //#region src/audit/stores/memory.d.ts
 interface MemoryAuditStoreOptions {
   /** Maximum entries to keep (default: 1000) */
   maxEntries?: number;
 }
-declare class MemoryAuditStore implements AuditStore {
+export declare class MemoryAuditStore implements AuditStore {
   readonly name = "memory";
   private entries;
   private maxEntries;
@@ -297,4 +297,4 @@ declare class MemoryAuditStore implements AuditStore {
   clear(): void;
 }
 //#endregion
-export { type AuditAction, type AuditContext, type AuditEntry, type AuditLogger, type AuditPluginOptions, type AuditQueryOptions, type AuditRequestLike, type AuditStore, type AuditStoreOptions, MemoryAuditStore, type MemoryAuditStoreOptions, type RepositoryAuditStoreOptions, type RequestAuditLogger, auditContextOf, _default as auditPlugin, createAuditEntry, repositoryAsAuditStore };
+export { type AuditAction, type AuditContext, type AuditEntry, type AuditLogger, type AuditPluginOptions, type AuditQueryOptions, type AuditRequestLike, type AuditStore, type AuditStoreOptions, type MemoryAuditStoreOptions, type RepositoryAuditStoreOptions, type RequestAuditLogger, _default as auditPlugin };

package/dist/audit/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { g as getUserId, i as getClientId } from "../types-Bk9NOgOC.mjs";
-import { t as transactionContext } from "../transactionContext-DjFkrNG6.mjs";
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { g as getUserId, i as getClientId } from "../types-fvO6Ovzx.mjs";
+import { t as transactionContext } from "../transactionContext-orvnGu4F.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DIMKMV2G.mjs";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
 import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts

package/dist/auth/audit.d.mts

@@ -9,13 +9,13 @@ import { FastifyInstance } from "fastify";
  * unknown events still flow through when matched, just with the BA-supplied
  * name verbatim. Use this list for autocomplete-friendly defaults.
  */
-type AuthEventName = "session.create" | "session.delete" | "session.update" | "user.create" | "user.update" | "user.delete" | "mfa.enroll" | "mfa.verify" | "mfa.failed" | "mfa.disable" | "password.reset.request" | "password.reset.complete" | "email.verify" | "org.create" | "org.delete" | "org.invite.create" | "org.invite.accept" | "org.invite.reject" | "org.member.add" | "org.member.remove" | "org.member.role.update" | "apikey.create" | "apikey.delete" | "apikey.failed" | "endpoint.before" | "endpoint.after" | "endpoint.error";
+export type AuthEventName = "session.create" | "session.delete" | "session.update" | "user.create" | "user.update" | "user.delete" | "mfa.enroll" | "mfa.verify" | "mfa.failed" | "mfa.disable" | "password.reset.request" | "password.reset.complete" | "email.verify" | "org.create" | "org.delete" | "org.invite.create" | "org.invite.accept" | "org.invite.reject" | "org.member.add" | "org.member.remove" | "org.member.role.update" | "apikey.create" | "apikey.delete" | "apikey.failed" | "endpoint.before" | "endpoint.after" | "endpoint.error";
 /**
  * Resolved auth event ready for audit. The bridge constructs this from
  * BA's hook context, then forwards to `app.audit.custom('auth', subjectId,
  * event.name, event.payload)`.
  */
-interface AuthEvent {
+export interface AuthEvent {
   /** Canonical name (see {@link AuthEventName}). */
   name: string;
   /**
@@ -34,7 +34,7 @@ interface AuthEvent {
 /**
  * Options for `wireBetterAuthAudit`.
  */
-interface WireBetterAuthAuditOptions {
+export interface WireBetterAuthAuditOptions {
   /**
    * Glob patterns selecting which events to audit. `*` matches a single
    * segment (`session.*` matches `session.create` but not `session.create.foo`),
@@ -72,7 +72,7 @@ interface WireBetterAuthAuditOptions {
  * Result of `wireBetterAuthAudit` — duck-typed BA `hooks` + `databaseHooks`
  * config plus an `attach(app)` method to connect the live audit logger.
  */
-interface BetterAuthAuditBridge {
+export interface BetterAuthAuditBridge {
   /**
    * Spread into `betterAuth({ hooks })`. BA's top-level `hooks.before` /
    * `hooks.after` slots take a single async function each (not an array).
@@ -157,7 +157,7 @@ interface BetterAuthAuditBridge {
  * Single BA hook entry — duck-typed to avoid pinning a BA major version.
  * The shape mirrors `better-auth`'s public `hooks.{before,after}` API.
  */
-interface BetterAuthHookEntry {
+export interface BetterAuthHookEntry {
   matcher: (ctx: BetterAuthHookContext) => boolean;
   /**
    * Returns a (possibly empty) object so BA's `runBeforeHooks` /
@@ -169,7 +169,7 @@ interface BetterAuthHookEntry {
   handler: (ctx: BetterAuthHookContext) => Promise<Record<string, unknown>> | Record<string, unknown>;
 }
 /** Subset of BA's hook context the bridge actually reads. */
-interface BetterAuthHookContext {
+export interface BetterAuthHookContext {
   path?: string;
   method?: string;
   body?: Record<string, unknown>;
@@ -198,6 +198,6 @@ interface SessionLike {
   userAgent?: string;
   impersonatedBy?: string;
 }
-declare function wireBetterAuthAudit(opts?: WireBetterAuthAuditOptions): BetterAuthAuditBridge;
+export declare function wireBetterAuthAudit(opts?: WireBetterAuthAuditOptions): BetterAuthAuditBridge;
 //#endregion
-export { AuthEvent, AuthEventName, BetterAuthAuditBridge, BetterAuthHookContext, BetterAuthHookEntry, WireBetterAuthAuditOptions, wireBetterAuthAudit };
+export {};

package/dist/auth/audit.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/auth/audit.ts
 function compileGlobs(patterns) {
 	if (patterns.length === 0) return () => false;

package/dist/auth/index.d.mts

@@ -1,7 +1,7 @@
 
 import { i as RequestScope } from "../types-Ddl9OjmE.mjs";
 import { l as PermissionCheck } from "../base-CZyixEQR.mjs";
-import { At as AuthHelpers, jt as AuthPluginOptions } from "../index-mqaqZNpe.mjs";
+import { At as AuthHelpers, jt as AuthPluginOptions } from "../index-WH7xgvxS.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-CmGOxOtD.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-qimlKV0P.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";
@@ -203,7 +203,7 @@ declare module "fastify" {
  */
 /** Verifies one credential scheme's value; the scope to install, or `null` when it is not valid. */
 type CredentialVerifier = (credentials: string, request: FastifyRequest) => Promise<RequestScope | null>;
-declare function createBetterAuthAdapter(options: BetterAuthAdapterOptions): BetterAuthAdapterResult;
+export declare function createBetterAuthAdapter(options: BetterAuthAdapterOptions): BetterAuthAdapterResult;
 //#endregion
 //#region src/auth/betterAuthOpenApi.d.ts
 interface BetterAuthOpenApiOptions {
@@ -241,7 +241,7 @@ interface BetterAuthOpenApiOptions {
  * endpoints, converts their Zod schemas to JSON Schema via `z.toJSONSchema()`,
  * and returns a complete `ExternalOpenApiPaths` object ready for Arc's spec builder.
  */
-declare function extractBetterAuthOpenApi(authApi: Record<string, unknown>, options?: BetterAuthOpenApiOptions): ExternalOpenApiPaths;
+export declare function extractBetterAuthOpenApi(authApi: Record<string, unknown>, options?: BetterAuthOpenApiOptions): ExternalOpenApiPaths;
 //#endregion
 //#region src/auth/trustedOrigins.d.ts
 /**
@@ -318,6 +318,6 @@ interface MirrorTrustedOriginsOptions {
  *     array.
  *   - `[canonicalUrl]` when `corsOrigins` is `false` / `undefined`.
  */
-declare function mirrorTrustedOriginsFromCors(options: MirrorTrustedOriginsOptions): string[];
+export declare function mirrorTrustedOriginsFromCors(options: MirrorTrustedOriginsOptions): string[];
 //#endregion
-export { type AuthPluginOptions, type BetterAuthAdapterOptions, type BetterAuthAdapterResult, type BetterAuthHandler, type BetterAuthOpenApiOptions, type CorsOriginsConfig, type CredentialVerifier, MemorySessionStore, type MemorySessionStoreOptions, type MirrorTrustedOriginsOptions, type SessionCookieOptions, type SessionData, type SessionManagerOptions, type SessionManagerResult, type SessionStore, _default as authPlugin, createBetterAuthAdapter, createSessionManager, extractBetterAuthOpenApi, mirrorTrustedOriginsFromCors };
+export { type AuthPluginOptions, type BetterAuthAdapterOptions, type BetterAuthAdapterResult, type BetterAuthHandler, type BetterAuthOpenApiOptions, type CorsOriginsConfig, type CredentialVerifier, MemorySessionStore, type MemorySessionStoreOptions, type MirrorTrustedOriginsOptions, type SessionCookieOptions, type SessionData, type SessionManagerOptions, type SessionManagerResult, type SessionStore, _default as authPlugin, createSessionManager };

package/dist/auth/index.mjs

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-CtrywMHP.mjs";
-import { n as requireSingleHeaderValue } from "../headers-BbkIF6vA.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-aklawRaK.mjs";
-import { o as toJsonSchema } from "../schemaConverter-BORek3O-.mjs";
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
-import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-Cm0uYHvd.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-CW4anJBy.mjs";
+import { n as requireSingleHeaderValue } from "../headers-DKZQKL-Z.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-C76zD5pa.mjs";
+import { o as toJsonSchema } from "../schemaConverter-BVjkQ5DD.mjs";
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DIMKMV2G.mjs";
+import { E as requireOrgRole, T as requireOrgMembership, k as requireTeamMembership } from "../permissions-C5ijIz5Q.mjs";
 import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import { isProductionEnv } from "@classytic/primitives/environment";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
@@ -48,7 +48,10 @@ const authPlugin = async (fastify, opts = {}) => {
 	let jwtContext = null;
 	if (jwtConfig?.secret) {
 		if (jwtConfig.secret.length < 32) throw new Error(`JWT secret must be at least 32 characters (current: ${jwtConfig.secret.length}).\nUse a strong random secret for production.`);
-		const jwtPlugin = await import("@fastify/jwt");
+		const jwtPlugin = await import("@fastify/jwt").catch((error) => {
+			if (error instanceof Error && "code" in error && error.code === "ERR_MODULE_NOT_FOUND" && error.message.includes("@fastify/jwt")) throw new Error("Arc JWT authentication requires @fastify/jwt. Run `npm install @fastify/jwt`. Better Auth and custom authenticators do not require this package.", { cause: error });
+			throw error;
+		});
 		await fastify.register(jwtPlugin.default ?? jwtPlugin, {
 			secret: jwtConfig.secret,
 			sign: {

package/dist/auth/redis-session.d.mts

@@ -2,7 +2,7 @@
 import { i as SessionData, s as SessionStore } from "../sessionManager-qimlKV0P.mjs";
 //#region src/auth/redis-session.d.ts
 /** Minimal Redis client interface — compatible with ioredis */
-interface RedisLike {
+export interface RedisLike {
   get(key: string): Promise<string | null>;
   set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
   del(...keys: string[]): Promise<number>;
@@ -11,7 +11,7 @@ interface RedisLike {
   srem(key: string, ...members: string[]): Promise<number>;
   expire(key: string, seconds: number): Promise<number>;
 }
-interface RedisSessionStoreOptions {
+export interface RedisSessionStoreOptions {
   /** Redis client instance (ioredis or compatible) */
   redis: RedisLike;
   /** Key prefix for session keys (default: 'arc:session:') */
@@ -28,7 +28,7 @@ interface RedisSessionStoreOptions {
  *
  * Session expiration is handled by Redis TTL — no cleanup interval needed.
  */
-declare class RedisSessionStore implements SessionStore {
+export declare class RedisSessionStore implements SessionStore {
   private redis;
   private prefix;
   private userPrefix;
@@ -39,5 +39,4 @@ declare class RedisSessionStore implements SessionStore {
   deleteAll(userId: string): Promise<void>;
   deleteAllExcept(userId: string, currentSessionId: string): Promise<void>;
 }
-//#endregion
-export { RedisLike, RedisSessionStore, RedisSessionStoreOptions };
+//#endregion

package/dist/auth/redis-session.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/auth/redis-session.ts
 /**

package/dist/{authorizationDecision-DQYrkl5f.mjs → authorizationDecision-wX3SA9w_.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as arcLog } from "./logger-DXjfIqjV.mjs";
-import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
-import { t as ArcError } from "./errors-CtrywMHP.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as arcLog } from "./logger-D4V1zGLI.mjs";
+import { t as conjoinPolicyFilters } from "./filter-merge-DGM-GQ1J.mjs";
+import { t as ArcError } from "./errors-CW4anJBy.mjs";
 //#region src/permissions/authorizationDecision.ts
 const log = arcLog("permissions:enforce");
 /**

package/dist/{boundedMap-BULzfXYU.mjs → boundedMap-DWiKW7lP.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/collections/boundedMap.ts
 /**
 * Insertion-order LRU on a plain `Map` — the two moves, written once.

package/dist/{buildHandler-CRQ8EcX5.mjs → buildHandler-Bswu_vNb.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as conjoinPolicyFilters } from "./filter-merge-IpGywvym.mjs";
-import { C as toRepositoryFilter } from "./plugin-BccET1tL.mjs";
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-9yzHC1e2.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as conjoinPolicyFilters } from "./filter-merge-DGM-GQ1J.mjs";
+import { C as toRepositoryFilter } from "./plugin-DALd9dcF.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-CWp-lsrm.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,

package/dist/cache/index.d.mts

@@ -12,18 +12,18 @@ import { n as UpstashKeyValueCommands, t as IoredisKeyValueCommands } from "../r
  * to ensure multi-tenant isolation and O(1) version-based invalidation.
  */
 /** Build a deterministic cache key for a query */
-declare function buildQueryKey(resource: string, operation: string, resourceVersion: number, params: Record<string, unknown>, userId?: string, orgId?: string): string;
+export declare function buildQueryKey(resource: string, operation: string, resourceVersion: number, params: Record<string, unknown>, userId?: string, orgId?: string): string;
 /** Resource version key — stored in CacheStore, bumped on mutations */
-declare function versionKey(resource: string): string;
+export declare function versionKey(resource: string): string;
 /** Tag version key — stored in CacheStore, bumped on cross-resource invalidation */
-declare function tagVersionKey(tag: string): string;
+export declare function tagVersionKey(tag: string): string;
 /**
  * Digest of the query params for a cache key — repo-core's canonical serialiser (escaped,
  * type-preserving, key-order-free) under SHA-256. Two different queries never share a key: a
  * delimiter inside a value, `1` vs `"1"`, two dates or two regexes all stay distinct, and a
  * cryptographic digest leaves no crafted collision onto another caller's cached result.
  */
-declare function hashParams(params: Record<string, unknown>): string;
+export declare function hashParams(params: Record<string, unknown>): string;
 //#endregion
 //#region src/cache/memory.d.ts
 interface MemoryCacheStoreOptions {
@@ -61,7 +61,7 @@ interface MemoryCacheStoreOptions {
  * - Entry size guard to avoid runaway memory usage
  * - Stats tracking for observability
  */
-declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
+export declare class MemoryCacheStore<TValue = unknown> implements CacheStore<TValue> {
   readonly name = "memory-cache";
   private readonly cache;
   private readonly defaultTtlSeconds;
@@ -149,7 +149,7 @@ interface RedisCacheStoreOptions {
  * Suitable for multi-instance and horizontally scaled deployments.
  * Uses pipeline batching when available for bulk operations.
  */
-declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
+export declare class RedisCacheStore<TValue = unknown> implements CacheStore<TValue> {
   readonly name = "redis-cache";
   private readonly client;
   private readonly prefix;
@@ -214,7 +214,7 @@ interface IoredisLike extends IoredisKeyValueCommands {
  * });
  * ```
  */
-declare function ioredisAsCacheClient(client: IoredisLike): RedisCacheClient;
+export declare function ioredisAsCacheClient(client: IoredisLike): RedisCacheClient;
 /**
  * Minimal `@upstash/redis` REST SDK shape the cache depends on — the shared
  * key/value commands (`utils/redisShapes.ts`) plus `incrby`. HTTP-based, so it
@@ -241,6 +241,6 @@ interface UpstashRedisLike extends UpstashKeyValueCommands {
  * });
  * ```
  */
-declare function upstashAsCacheClient(client: UpstashRedisLike): RedisCacheClient;
+export declare function upstashAsCacheClient(client: UpstashRedisLike): RedisCacheClient;
 //#endregion
-export { type CacheEnvelope, type CacheLogger, type CacheResult, type CacheStats, type CacheStatus, type CacheStore, type CrossResourceRule, type IoredisLike, MemoryCacheStore, type MemoryCacheStoreOptions, QueryCache, type QueryCacheConfig, type QueryCacheDefaults, type QueryCachePluginOptions, type RedisCacheClient, RedisCacheStore, type RedisCacheStoreOptions, type RedisPipeline, type UpstashRedisLike, buildQueryKey, hashParams, ioredisAsCacheClient, queryCachePlugin, tagVersionKey, upstashAsCacheClient, versionKey };
+export { type CacheEnvelope, type CacheLogger, type CacheResult, type CacheStats, type CacheStatus, type CacheStore, type CrossResourceRule, type IoredisLike, type MemoryCacheStoreOptions, QueryCache, type QueryCacheConfig, type QueryCacheDefaults, type QueryCachePluginOptions, type RedisCacheClient, type RedisCacheStoreOptions, type RedisPipeline, type UpstashRedisLike, queryCachePlugin };

package/dist/cache/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-B2KtgMLJ.mjs";
-import { t as MemoryCacheStore } from "../memory-9Cp7611C.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-CFWNH8aT.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-CpoiZ8hU.mjs";
+import { t as MemoryCacheStore } from "../memory-CTa5pOCW.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BATECpyh.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-Cc2M1DwO.mjs → caching-Drp68DIS.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as __exportAll } from "./rolldown-runtime-MYrLNGnq.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/{claimed-B10RTfkM.mjs → claimed-DYvQoZLv.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/events/outbox/claimed.ts
 function claimedAttempts(claimed) {
 	const value = claimed.attempts;

package/dist/cleanup/index.d.mts

@@ -1,5 +1,5 @@
 
-import { A as RequestWithExtras } from "../index-mqaqZNpe.mjs";
+import { A as RequestWithExtras } from "../index-WH7xgvxS.mjs";
 import { A as CleanupStepResult, B as VerificationResult, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeEvidence, I as PurgeResourceResult, L as PurgeStrategyKind, M as CleanupWriteFence, N as DEFAULT_CLEANUP_LIMITS, O as CleanupRunTransitionPatch, P as PurgeActor, R as PurgeVerificationSummary, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as CleanupStepRunStatus, k as CleanupStepProgress, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft, z as VerificationCheck } from "../types-DVLddu2q.mjs";
 import { n as ArcModule } from "../types-BJ-2XqVF.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
@@ -38,7 +38,7 @@ interface RecipeFromStepsInput {
   /** Provider steps in EXECUTION ORDER. */
   readonly steps: readonly CleanupStep[];
 }
-declare function recipeFromSteps(input: RecipeFromStepsInput): CleanupRecipe;
+export declare function recipeFromSteps(input: RecipeFromStepsInput): CleanupRecipe;
 //#endregion
 //#region src/cleanup/errors.d.ts
 /**
@@ -83,7 +83,7 @@ type CleanupErrorCode =
  * step 4 of its classifier — a numeric `statusCode` + a separatored domain
  * `code` maps to that exact status + code on the wire, never `arc.internal_error`).
  */
-declare class CleanupError extends Error {
+export declare class CleanupError extends Error {
   readonly code: CleanupErrorCode;
   readonly status: number;
   /** Alias of {@link status} — the property arc's error handler classifies on. */
@@ -96,11 +96,11 @@ declare class CleanupError extends Error {
  * durable `cancelRequested` flag is set. NOT a wire error — `processRun`
  * catches it and CAS-transitions the run to `cancelled`.
  */
-declare class CleanupCancelled extends Error {
+export declare class CleanupCancelled extends Error {
   readonly runId: string;
   constructor(runId: string);
 }
-declare const CleanupErrors: {
+export declare const CleanupErrors: {
   readonly unknownRecipe: (id: string) => CleanupError;
   readonly duplicateRecipe: (id: string) => CleanupError;
   readonly unavailable: (id: string, reason: string) => CleanupError;
@@ -131,7 +131,7 @@ declare const CleanupErrors: {
  * In-memory {@link CleanupRunStore}. Single-process only — see the module
  * docblock for the production caveat.
  */
-declare class MemoryCleanupRunStore implements CleanupRunStore {
+export declare class MemoryCleanupRunStore implements CleanupRunStore {
   #private;
   /** Live run state, keyed by run id. Exposed for tests/inspection. */
   readonly runs: Map<string, CleanupRun>;
@@ -148,7 +148,7 @@ declare class MemoryCleanupRunStore implements CleanupRunStore {
  * In-memory {@link CleanupEvidenceStore} — idempotent by
  * `evidence.operationId`, exactly as the port requires.
  */
-declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
+export declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
   #private;
   readonly evidence: PurgeEvidence[];
   readonly manifests: CleanupManifest[];
@@ -166,7 +166,7 @@ declare class MemoryCleanupEvidenceStore implements CleanupEvidenceStore {
  * gives you a microtask-deferred in-process queue that DOES auto-run
  * `processRun` off the request path.
  */
-declare class MemoryCleanupJobQueue implements CleanupJobQueue {
+export declare class MemoryCleanupJobQueue implements CleanupJobQueue {
   readonly jobs: CleanupJob[];
   enqueue(job: CleanupJob): Promise<void>;
   /** Take everything enqueued so far, clearing the buffer. */
@@ -195,7 +195,7 @@ interface CleanupRegistry {
  * construction if two recipes share an id — a boot-time failure, never a
  * silent last-wins overwrite.
  */
-declare function createCleanupRegistry(recipes: readonly CleanupRecipe[]): CleanupRegistry;
+export declare function createCleanupRegistry(recipes: readonly CleanupRecipe[]): CleanupRegistry;
 //#endregion
 //#region src/cleanup/service.d.ts
 interface CleanupServiceDeps {
@@ -259,7 +259,7 @@ interface CleanupService {
   cancel(id: string, input?: CancelInput): Promise<CleanupRun>;
   retry(id: string): Promise<CleanupRun>;
 }
-declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
+export declare function createCleanupService(deps: CleanupServiceDeps): CleanupService;
 //#endregion
 //#region src/cleanup/module.d.ts
 interface DataCleanupModuleDeps {
@@ -330,15 +330,15 @@ interface DataCleanupModuleDeps {
   /** Injected clock (tests). */
   now?: () => Date;
 }
-declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
+export declare function createDataCleanupModule(deps: DataCleanupModuleDeps): ArcModule<CleanupService>;
 //#endregion
 //#region src/cleanup/plan-digest.d.ts
 /** `sha256(canonical(planMaterial))` as a hex digest. */
-declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
+export declare function computePlanDigest(plan: Omit<CleanupPlan, "digest">): string;
 /**
  * Integrity checksum of a completed manifest (§5). Excludes the digest field
  * itself. Dates (e.g. `completedAt`) participate via the strict canonicalizer.
  */
-declare function computeManifestDigest(manifest: Record<string, unknown>): string;
+export declare function computeManifestDigest(manifest: Record<string, unknown>): string;
 //#endregion
-export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, CleanupCancelled, type CleanupContext, CleanupError, type CleanupErrorCode, CleanupErrors, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, MemoryCleanupEvidenceStore, MemoryCleanupJobQueue, MemoryCleanupRunStore, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult, computeManifestDigest, computePlanDigest, createCleanupRegistry, createCleanupService, createDataCleanupModule, recipeFromSteps };
+export { type Availability, CLEANUP_TERMINAL_STATUSES, type CancelInput, type CleanupCancelRequest, type CleanupContext, type CleanupErrorCode, type CleanupEvidenceStore, type CleanupExecutionContext, type CleanupFinalizationPayload, type CleanupInput, type CleanupJob, type CleanupJobQueue, type CleanupLease, type CleanupLimits, type CleanupLogger, type CleanupManifest, type CleanupOutcomeStatus, type CleanupPermissionCheck, type CleanupPermissions, type CleanupPlan, type CleanupPlanDraft, type CleanupPlanItem, type CleanupProgressSummary, type CleanupRecipe, type CleanupRecipeInfo, type CleanupRegistry, type CleanupResult, type CleanupRun, type CleanupRunCreateResult, type CleanupRunStatus, type CleanupRunStore, type CleanupRunTransitionPatch, type CleanupService, type CleanupServiceDeps, type CleanupStepProgress, type CleanupStepResult, type CleanupStepRunStatus, type CleanupWriteFence, DEFAULT_CLEANUP_LIMITS, type DataCleanupModuleDeps, type ExecuteInput, type PreviewInput, type PurgeActor, type PurgeEvidence, type PurgeResourceResult, type PurgeStrategyKind, type PurgeVerificationSummary, type RecipeFromStepsInput, type VerificationCheck, type VerificationResult };

package/dist/cleanup/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { g as getUserId } from "../types-Bk9NOgOC.mjs";
-import { t as defineResource } from "../defineResource-DIC7JZGU.mjs";
-import { t as defineModule } from "../module-BSvOQC7E.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-fvO6Ovzx.mjs";
+import { t as defineResource } from "../defineResource-gUp9ug66.mjs";
+import { t as defineModule } from "../module--L0iBIZz.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts

package/dist/cli/commands/describe.d.mts

@@ -1,7 +1,7 @@
 
-import { F as ResourceDefinition, X as RouteSchemaOptions, kt as RateLimitConfig } from "../../index-mqaqZNpe.mjs";
+import { F as ResourceDefinition, X as RouteSchemaOptions, kt as RateLimitConfig } from "../../index-WH7xgvxS.mjs";
 //#region src/cli/commands/describe.d.ts
-interface DescribedResource {
+export interface DescribedResource {
   name: string;
   displayName: string;
   prefix: string;
@@ -124,7 +124,7 @@ interface EventDescription {
  * Hosts that want a JSON dump of one resource without spawning the CLI
  * can call this directly.
  */
-declare function describeResource(resource: ResourceDefinition<unknown>, module?: string): DescribedResource;
-declare function describe(args: string[]): Promise<void>;
+export declare function describeResource(resource: ResourceDefinition<unknown>, module?: string): DescribedResource;
+export declare function describe(args: string[]): Promise<void>;
 //#endregion
-export { DescribedResource, describe, describeResource };
+export {};

package/dist/cli/commands/describe.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../../constants-Cu7Mx7_U.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-CuCARu2B.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-B2QHb6u6.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-DJxHUpE4.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts