@ultimat3/action 30.9.0 → 31.0.0

package/src/errors-idempotency.ts

@@ -4,7 +4,7 @@
  * `registerErrorCodes` call, because a second registration is how two modules end up deciding a
  * title by load order. Imported bare, so constructing one of these registers its title first.
  */
-import { renderCauseValue, UltimateError } from '@ultimat3/core';
+import { renderCauseValue, UltimateError } from '@ultimat3/core/page';
 import './error-titles';
 // Type-only: `idempotency.ts` imports the classes below, and a runtime edge here would close the
 // cycle. `verbatimModuleSyntax` is what makes that guarantee mechanical.
@@ -78,7 +78,7 @@ export class IdempotencyNotSharedError extends UltimateError {
       // positional form is `unsafe`), so that line compiled and would have thrown on the first
       // reservation. The framework's own boot already installs this store; a host booting the
       // framework itself wraps the client it opened.
-      fix: "the framework boot installs a shared store — reach this only from a host that boots it itself: setIdempotencyStore(postgresIdempotencyStore({ executor: { query: (text, values) => client.query({ text, values }) }, origin: () => client, reclaimAfterMs: requestDeadlineMs })) from '@ultimat3/action', or drop the declaration to configureIdempotency({ scope: 'process' })",
+      fix: "postgresIdempotencyStore({ executor: { query: (text, values) => client.query({ text, values }) }, origin: () => client, reclaimAfterMs: requestDeadlineMs })   # idempotencyStore: in apps/<app>/runtime.ts, or drop that field and the boot builds a shared one over DATABASE_URL — or declare configureIdempotency({ scope: 'process' })",
       meta: { storeScope: storeScope ?? null },
     });
   }

package/src/errors-meter.ts

@@ -3,7 +3,7 @@
  * declaration or a call-time limit that cannot be counted against (`X_METER_INVALID`, the app's).
  * Codes and titles stay in `error-titles.ts`'s one registration; imported bare for that reason.
  */
-import { renderCauseValue, renderFixShellArg, UltimateError } from '@ultimat3/core';
+import { renderCauseValue, renderFixShellArg, UltimateError } from '@ultimat3/core/page';
 import './error-titles';
 
 export interface MeterExceededInput {

package/src/errors-stream.ts

@@ -1,7 +1,7 @@
 // The streaming action's one refusal, `X_ACTION_STREAM_INVALID`: a declaration that says it streams
 // and a handler that does not, or a chunk its own `stream` schema refuses.
 
-import { UltimateError } from '@ultimat3/core';
+import { UltimateError } from '@ultimat3/core/page';
 
 const FIX =
   'async *handle({ input, ctx }) { yield chunk; return output; } — yield only what stream: declares';

package/src/errors.ts

@@ -5,7 +5,6 @@
  * and are re-exported here, so `./errors` stays the one import path for all of them.
  */
 import {
-  assertNever,
   deniedCallerFix,
   ERROR_DOCS_URL,
   hasErrorCode,
@@ -14,8 +13,8 @@ import {
   UltimateError,
   withRequestId,
   withStatedDelay,
-} from '@ultimat3/core';
-import type { SurfaceDenial } from '@ultimat3/policy';
+} from '@ultimat3/core/page';
+import type { PrimitiveDenial, SurfaceDenial } from '@ultimat3/policy';
 import type { ValidationIssue } from '@ultimat3/schema';
 // The titles are `error-titles.ts`, imported bare: this module is then side-effect-free and the
 // array does not list it, so a chunk keeps only the classes it constructs, and a chunk that
@@ -45,7 +44,7 @@ export class ActionUnregisteredError extends UltimateError {
     super({
       code: 'X_ACTION_UNREGISTERED',
       cause: 'an action was projected before it was registered, so it has no name',
-      fix: "call registerActions(await import('./actions')) at boot, before mounting routes",
+      fix: "list the action's module in defineApi({ actions }) in apps/<app>/api/index.ts — the boot names it before mounting routes",
     });
   }
 }
@@ -66,34 +65,6 @@ export class ActionForeignError extends UltimateError {
   }
 }
 
-export function denialCode(denial: SurfaceDenial): string {
-  switch (denial.surface) {
-    case 'http':
-      return denial.problem.code;
-    case 'live':
-    case 'job':
-      return denial.code;
-    case 'mcp':
-      return denial.content[0]?.text.split(':')[0] ?? 'X_FORBIDDEN';
-    default:
-      return assertNever(denial);
-  }
-}
-
-export function denialReason(denial: SurfaceDenial): string {
-  switch (denial.surface) {
-    case 'http':
-      return denial.problem.detail;
-    case 'live':
-    case 'job':
-      return denial.reason;
-    case 'mcp':
-      return denial.content[0]?.text ?? 'denied';
-    default:
-      return assertNever(denial);
-  }
-}
-
 /**
  * An authz denial, thrown by `guardAction()`. The code and reason come from the policy
  * decision — this package never invents an authz code — and the surface-shaped
@@ -102,15 +73,18 @@ export function denialReason(denial: SurfaceDenial): string {
 export class ActionDeniedError extends UltimateError {
   readonly denial: SurfaceDenial;
 
-  constructor(action: string, denial: SurfaceDenial) {
-    const code = denialCode(denial);
+  /**
+   * Built from `guardPrimitive`'s answer, which already read the code and the reason out of the
+   * surface shape — a type-only import, so the browser-reachable error module pulls in no policy.
+   */
+  constructor(refused: PrimitiveDenial<'action'>) {
     super({
-      code,
-      cause: `${action} denied: ${denialReason(denial)}`,
-      fix: `x policy explain ${action} --json   # shows which clause decided and why`,
+      code: refused.code,
+      cause: `${refused.name} denied: ${refused.reason}`,
+      fix: `x policy explain ${refused.name} --json   # shows which clause decided and why`,
       callerFix: deniedCallerFix(),
     });
-    this.denial = denial;
+    this.denial = refused.denial;
   }
 }
 
@@ -167,6 +141,11 @@ export class InputInvalidError extends UltimateError {
    * structured channel beside it.
    */
   readonly issues: readonly ValidationIssue[] | undefined;
+  /**
+   * `true` when validation stopped at its issue cap (`MAX_ISSUES`, `@ultimat3/schema`): `issues`
+   * is a prefix, and correcting all of it may surface more. Also on `meta` for an HTTP surface.
+   */
+  readonly issuesTruncated: boolean;
 
   /**
    * `detail` is the rendered form of `issues` and must stay so — `formatIssues(issues).join('; ')`,
@@ -186,6 +165,7 @@ export class InputInvalidError extends UltimateError {
      * action's.
      */
     subject: 'action' | 'tool' = 'action',
+    issuesTruncated = false,
   ) {
     super({
       code: 'X_INPUT_INVALID',
@@ -195,9 +175,12 @@ export class InputInvalidError extends UltimateError {
       // body — and cannot run `x actions show`.
       callerFix:
         'correct the fields named in cause to match the published input schema (the tool inputSchema, or the OpenAPI request body) and send again — the same input is refused the same way',
-      ...(issues === undefined ? {} : { meta: { issues } }),
+      ...(issues === undefined
+        ? {}
+        : { meta: issuesTruncated ? { issues, issuesTruncated: true } : { issues } }),
     });
     this.issues = issues;
+    this.issuesTruncated = issuesTruncated;
   }
 }
 
@@ -254,6 +237,8 @@ export interface RemoteFailure {
    * refuses to read, and in both cases `cause` still holds every rejection.
    */
   readonly issues?: readonly ValidationIssue[] | undefined;
+  /** The server cut `issues` at its cap (`MAX_ISSUES`): the list is a prefix. Only ever `true`. */
+  readonly issuesTruncated?: true | undefined;
   /**
    * The document's `meta` member — the keys the server's `registerProblemMeta` declared for the
    * code, already read as a plain JSON object by `client.ts`. Carried onto the error's own `meta`
@@ -340,6 +325,7 @@ export class RemoteActionError extends UltimateError {
             // Absent rather than `undefined`: `meta` is rendered into `--json` and the error
             // reporter, and a null member reads as "the server sent an empty list".
             ...(failure.issues === undefined ? {} : { issues: failure.issues }),
+            ...(failure.issuesTruncated === true ? { issuesTruncated: true } : {}),
           },
           failure.requestId,
         ),
@@ -361,7 +347,7 @@ export class RpcFailedError extends UltimateError {
     super({
       code: 'X_RPC_FAILED',
       cause: `${name} returned HTTP ${status} without a problem+json body`,
-      fix: `check the gateway in front of the app, then: x actions show ${renderFixShellArg(name, '<action-name>')} --json`,
+      fix: "match X_CLIENT_TRANSPORT_FAILED instead: isUltimateError(e) && e.code === 'X_CLIENT_TRANSPORT_FAILED', with isUltimateError from @ultimat3/core",
       retry: retryForStatus('X_RPC_FAILED', status),
     });
   }
@@ -379,7 +365,7 @@ export class AuditSinkMissingError extends UltimateError {
     super({
       code: 'X_AUDIT_SINK_MISSING',
       cause: `action "${action}" declares \`audit: true\` and no audit sink is installed`,
-      fix: "call setAuditSink(yourSink) from '@ultimat3/core' at boot, before registerActions()",
+      fix: 'auditSink: postgresAuditSink({ executor })   # in export const runtime = { … }, apps/<app>/runtime.ts',
     });
   }
 }
@@ -410,8 +396,8 @@ export class AuditSinkFailedError extends UltimateError {
       code: 'X_AUDIT_SINK_FAILED',
       cause: `"${action}" ran and its audit sink refused the record, so the change is unrecorded — the handler had already committed`,
       fix: replayable
-        ? `fix the sink installed by setAuditSink, then retry with the same Idempotency-Key — the replay re-records without re-running the handler`
-        : `fix the sink installed by setAuditSink, then reconcile this one change by hand — do NOT retry: ${action} ran with no Idempotency-Key, so a second call runs the committed handler again. Add \`idempotent: true\` and send the header to make retries safe`,
+        ? `fix the sink runtime.ts installs as auditSink (apps/<app>/runtime.ts), then retry with the same Idempotency-Key — the replay re-records without re-running the handler`
+        : `fix the sink runtime.ts installs as auditSink (apps/<app>/runtime.ts), then reconcile this one change by hand — do NOT retry: ${action} ran with no Idempotency-Key, so a second call runs the committed handler again. Add \`idempotent: true\` and send the header to make retries safe`,
       // Read by `--json` and the error reporter: whether a retry is safe is the one decision an
       // operator makes here, so it is a field and not only a sentence.
       meta: { action, replayable },

package/src/exercise.ts

@@ -14,7 +14,8 @@ import {
   tryUseContext,
 } from '@ultimat3/core';
 import type { ExerciseRequestOption } from '@ultimat3/http';
-import { statusFor, withRequestAs, withScratchRateLimitStore } from '@ultimat3/http';
+import { statusFor, withRequestAs } from '@ultimat3/http';
+import { withScratchRateLimitStore } from '@ultimat3/http/adapter';
 import { admitsAnonymous } from '@ultimat3/policy';
 import { arbitrary } from '@ultimat3/schema/sample';
 import type { AnyAction } from './action';

package/src/handler-override.ts

@@ -0,0 +1,18 @@
+// The handler-override slot: a stored declaration's `handle`, replaced for a test. Keyed by the
+// declaration `invoke` runs, read at call time — by `invoke` for a plain action and by the drain
+// for a stream-declaring one — so every surface reaches the double through the one execution path.
+
+import type { Ctx } from '@ultimat3/core';
+
+/** What stands where `handle` is: the declaration's own argument shape, any answer. */
+export type HandlerOverride = (args: { readonly input: unknown; readonly ctx: Ctx }) => unknown;
+
+const OVERRIDES = new WeakMap<object, HandlerOverride>();
+
+/** `undefined` puts the declared handler back. */
+export function setHandlerOverride(def: object, handle: HandlerOverride | undefined): void {
+  if (handle === undefined) OVERRIDES.delete(def);
+  else OVERRIDES.set(def, handle);
+}
+
+export const handlerOverrideOf = (def: object): HandlerOverride | undefined => OVERRIDES.get(def);

package/src/idempotency-memory.ts

@@ -3,7 +3,7 @@
  * and for tests, and refused at registration under a `shared` declaration — its `scope` says so.
  * Shaped after `@ultimat3/http`'s `memoryRateLimitStore`, including the deliberate eviction order.
  */
-import { finiteCount, uuidV7 } from '@ultimat3/core';
+import { finiteCount, liveClock, logger, uuidV7 } from '@ultimat3/core';
 import { IdempotencyReservationLostError } from './errors-idempotency';
 import type {
   IdempotencyFailure,
@@ -88,7 +88,7 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     );
     // Batched down to 90% so the eviction sort is paid once per 10% of the cap, not per write.
     this.#evictTo = Math.max(1, Math.floor(this.#maxKeys * 0.9));
-    this.#now = options.now ?? ((): number => Date.now());
+    this.#now = options.now ?? ((): number => liveClock.now().getTime());
     this.#reclaimAfterMs = options.reclaimAfterMs ?? requestDeadlineMs;
   }
 
@@ -161,6 +161,7 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     const tx = liveTransaction();
     if (tx === undefined) {
       if (existing !== undefined) this.#records.set(key, settled(existing));
+      else fenced(key, reservationId, 'settle');
       return Promise.resolve();
     }
     // Inside a transaction the record is settled BY the commit, as the Postgres store's is: a
@@ -188,6 +189,8 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
     const existing = this.#owned(key, reservationId);
     if (existing !== undefined) {
       this.#records.set(key, { ...existing, status: 'failed', value: undefined, failure });
+    } else {
+      fenced(key, reservationId, 'fail');
     }
     return Promise.resolve();
   }
@@ -245,6 +248,15 @@ export class MemoryIdempotencyStore implements IdempotencyStore {
   }
 }
 
+/**
+ * Logged, never thrown — the Postgres store's line, word for word (`idempotency-postgres.ts`), so
+ * an operator's alert does not depend on which store is installed. A fenced settlement means the
+ * value this attempt produced is stored nowhere; throwing would turn a done write into an error.
+ */
+function fenced(key: string, reservationId: string, statement: 'settle' | 'fail'): void {
+  logger.warn('action.idempotency.settlement-fenced', { key, reservationId, statement });
+}
+
 /**
  * The one way to build the memory store — the twin of `postgresIdempotencyStore()`. The class
  * stays a type in the barrel (`X_FACTORY_NAME_SPELLING`), so `new` is never a second spelling.

package/src/idempotency-postgres.ts

@@ -5,7 +5,7 @@
  * Statements are spelled out so an agent can run the exact one it saw in a log.
  */
 import type { PgExecutor } from '@ultimat3/core';
-import { finiteCount, logger, uuidV7 } from '@ultimat3/core';
+import { finiteCount, liveClock, logger, uuidV7 } from '@ultimat3/core';
 import { IdempotencyReservationLostError, IdempotencyStatusUnknownError } from './errors';
 import type {
   IdempotencyFailure,
@@ -172,7 +172,7 @@ export interface PostgresIdempotencyStore extends IdempotencyStore {
 /**
  * **The boot installs this for you — an app declares the scope and nothing else.**
  * `@ultimat3/cli`'s `startServices` builds a `PgExecutor` from the client it already resolved and
- * calls `setIdempotencyStore(postgresIdempotencyStore({ executor, origin, reclaimAfterMs }))` before `loadApp`, so the
+ * installs `postgresIdempotencyStore({ executor, origin, reclaimAfterMs })` before `loadApp`, so the
  * store is in place by the time `registerAction` evaluates a declaration against it. All an app
  * owes is the one line `x new` scaffolds into `apps/web/server.ts`:
  *
@@ -180,19 +180,19 @@ export interface PostgresIdempotencyStore extends IdempotencyStore {
  * configureIdempotency({ scope: 'shared' });
  * ```
  *
- * Installing one by hand is for a host that boots the framework itself, and it needs a real
+ * Handing one over is `idempotencyStore:` in `apps/<app>/runtime.ts`, and it needs a real
  * `PgExecutor` — never `Bun.sql`, which has no `.query`. Wrap the client this process already
  * opened, so a second pool is not opened against a URL the boot resolved once:
  *
  * ```ts
  * const client = db();
- * setIdempotencyStore(
- *   postgresIdempotencyStore({
+ * export const runtime = {
+ *   idempotencyStore: postgresIdempotencyStore({
  *     executor: { query: (text, values) => client.query({ text, values }) },
  *     origin: () => client,
  *     reclaimAfterMs: requestDeadlineMs, // the app's `requestTimeoutMs`, from '@ultimat3/action'
  *   }),
- * );
+ * };
  * ```
  */
 export function postgresIdempotencyStore(
@@ -219,7 +219,7 @@ export function postgresIdempotencyStore(
     const tx = liveTransaction();
     return tx !== undefined && tx.origin === options.origin() ? tx.executor : undefined;
   };
-  const now = options.now ?? ((): number => Date.now());
+  const now = options.now ?? ((): number => liveClock.now().getTime());
 
   const fetch = async (key: string): Promise<IdempotencyRecord | undefined> => {
     const rows = await exec.query<IdempotencyRow>(SQL_IDEMPOTENCY_GET, [key, windowSecs]);

package/src/idempotency.ts

@@ -4,6 +4,7 @@
  * a value or a failure — and a concurrent duplicate is refused rather than run twice, because a
  * double charge is worse than a 409.
  */
+
 import {
   compareFingerprint,
   finiteCount,
@@ -15,6 +16,7 @@ import {
   runToCompletion,
   tryUseContext,
 } from '@ultimat3/core';
+import { adapterSlot } from '@ultimat3/core/adapter';
 import {
   IdempotencyConflictError,
   IdempotencyNotSharedError,
@@ -178,7 +180,9 @@ export interface IdempotencyConfig {
 export const DEFAULT_IDEMPOTENCY_CONFIG: IdempotencyConfig = Object.freeze({ scope: 'process' });
 
 let config: IdempotencyConfig = DEFAULT_IDEMPOTENCY_CONFIG;
-let defaultStore: IdempotencyStore = memoryIdempotencyStore();
+let baseStore: IdempotencyStore = memoryIdempotencyStore();
+/** The installed store: a stack over the process default, released in any order. */
+const storeSlot = adapterSlot<IdempotencyStore>(() => baseStore);
 
 /** Declared at boot, before `registerActions()`. Nothing infers a replica count. */
 export function configureIdempotency(next: IdempotencyConfig): void {
@@ -208,18 +212,24 @@ export function idempotencyCeilingMs(): number {
   return deadline > 0 ? Math.ceil(2 * deadline) : CEILING_WITHOUT_DEADLINE_MS;
 }
 
-export function setIdempotencyStore(store: IdempotencyStore): void {
-  defaultStore = store;
+/**
+ * The boot's installer (its release removes THIS install only, in any order — `adapterSlot`), on `@ultimat3/action/adapter` and never the `.` barrel: the boot installs
+ * `postgresIdempotencyStore` over its pool, and an app swaps it with `idempotencyStore:` in
+ * `apps/<app>/runtime.ts`.
+ */
+export function installIdempotencyStore(store: IdempotencyStore): () => void {
+  return storeSlot.install(store);
 }
 
 export function getIdempotencyStore(): IdempotencyStore {
-  return defaultStore;
+  return storeSlot.current();
 }
 
 /** Test-only. A process configures its idempotency once at boot and never reconfigures it. */
 export function resetIdempotency(): void {
   config = DEFAULT_IDEMPOTENCY_CONFIG;
-  defaultStore = memoryIdempotencyStore();
+  storeSlot.reset();
+  baseStore = memoryIdempotencyStore();
 }
 
 /**
@@ -400,12 +410,12 @@ function runWithinCeiling<T>(key: string, ceilingMs: number, run: () => Promise<
 }
 
 /**
- * A stored fingerprint that is not this request's exact string. A legacy unkeyed one (a row
- * written before keying) is still checked exactly. One keyed under a secret this process does not
- * hold — the signing secret rotated inside the window — cannot be checked either way, and is
- * answered by its STATUS alone: replay, never re-run. Refusing it would 409 every honest retry
- * across a rotation; running it would be the double charge. What is lost for that window only is
- * the "same key, different body" diagnosis, and a warning says so.
+ * A stored fingerprint that is not this request's exact string. One keyed under a secret this
+ * process does not hold — the signing secret rotated inside the window — or in no form this build
+ * reads (a bare pre-v24 hash) cannot be checked either way, and is answered by its STATUS alone:
+ * replay, never re-run. Refusing it would 409 every honest retry across a rotation; running it
+ * would be the double charge. What is lost for that window only is the "same key, different body"
+ * diagnosis, and a warning says so.
  */
 function assertSamePayload(key: string, stored: string, input: unknown): void {
   const verdict = compareFingerprint(stored, input, IDEMPOTENCY_FINGERPRINT_PURPOSE);

package/src/index.ts

@@ -57,10 +57,10 @@ export { apiDeclaration } from './api-declaration';
  * The audit seam. `AuditSink` is the whole extension point: the framework supplies the record
  * and never the row. `audit-gate.ts` stays unexported — the sink has one caller, and that
  * absence is what keeps it one. The record and the sink are `@ultimat3/core`'s, re-exported as
- * TYPES only because this barrel's sinks name them; the slot (`setAuditSink`) is core's alone.
+ * TYPES only because this barrel's sinks name them; the slot (`installAuditSink`) is core's alone.
  */
 export type { AuditRecord, AuditSink } from './audit';
-export { AUDIT_INPUT_MAX_DEPTH, auditableInput, UNREPRESENTABLE } from './audit-input';
+export { auditableInput } from './audit-input';
 export type { MemoryAuditSink, MemoryAuditSinkOptions } from './audit-memory';
 export { DEFAULT_MAX_AUDIT_RECORDS, memoryAuditSink } from './audit-memory';
 /**
@@ -76,7 +76,7 @@ export type {
   AuditSubjectTarget,
   AuditSubjectTargetOptions,
 } from './audit-subject-target';
-export { AUDIT_SUBJECT_COLUMNS, auditSubjectTarget } from './audit-subject-target';
+export { auditSubjectTarget } from './audit-subject-target';
 export type {
   ActionLike,
   ActionMap,
@@ -89,29 +89,20 @@ export type {
 } from './client';
 export { rpc } from './client';
 export type { ContractTest, ContractTestOptions } from './contract-test';
-export { anonymousCtx, contractTestsFor, policyTestStubFor } from './contract-test';
+export { anonymousCtx, contractTestsFor } from './contract-test';
 export type { Api, ApiDef, ApiModule, ApiModules } from './define-api';
 export { defineApi } from './define-api';
 export type { IdempotencyConflictReason, IdempotencyKeyProblem, RemoteFailure } from './errors';
 export {
   ActionDeniedError,
-  ActionDeprecationInvalidError,
-  ActionDuplicateError,
-  ActionForeignError,
-  ActionPathDuplicateError,
-  ActionPolicyMissingError,
-  ActionUnregisteredError,
   AuditSinkFailedError,
-  AuditSinkMissingError,
   ContractDriftError,
   IdempotencyConflictError,
   IdempotencyKeyInvalidError,
-  IdempotencyNotSharedError,
   IdempotencyOutputUnserializableError,
   IdempotencyReplayedFailureError,
   IdempotencyReservationLostError,
   IdempotencyRunCeilingError,
-  IdempotencyStatusUnknownError,
   IdempotentReplayRedactedError,
   InputInvalidError,
   MutatorNotIdempotentError,
@@ -119,14 +110,9 @@ export {
   RemoteActionError,
   RpcFailedError,
 } from './errors';
-export {
-  ActionDeprecationSuccessorInvalidError,
-  ActionHttpPathInvalidError,
-  ActionPathStyleInvalidError,
-  OpenApiConfigInvalidError,
-} from './errors-http';
-export type { MeterExceededInput, MeterField } from './errors-meter';
-export { MeterExceededError, MeterInvalidError } from './errors-meter';
+export { ActionDeprecationSuccessorInvalidError } from './errors-http';
+export type { MeterExceededInput } from './errors-meter';
+export { MeterExceededError } from './errors-meter';
 export { ActionStreamInvalidError } from './errors-stream';
 export type {
   ExerciseActorOptions,
@@ -137,12 +123,7 @@ export type {
 export { exerciseAction } from './exercise';
 export type { ContractExercise, ExerciseDeclarations } from './exercise-declarations';
 export type { OpenApiOperation } from './http';
-export {
-  operationTagOf,
-  toOpenApiOperation,
-  toPostBinding,
-  toRoute,
-} from './http';
+export { toOpenApiOperation, toPostBinding, toRoute } from './http';
 /** `http: { path }` on an action pins its URL; the app's `pathStyle` derives every other one. */
 export type { ActionHttp, ActionHttpMethod } from './http-path';
 export {
@@ -171,14 +152,9 @@ export type {
 export {
   assertIdempotencyScope,
   configureIdempotency,
-  DEFAULT_IDEMPOTENCY_CONFIG,
   getIdempotencyStore,
-  IDEMPOTENCY_STATUSES,
   idempotencyCeilingMs,
-  idempotencyConfig,
   isIdempotencyStatus,
-  resetIdempotency,
-  setIdempotencyStore,
   withIdempotency,
 } from './idempotency';
 export { idempotencyKeyFor, MAX_IDEMPOTENCY_KEY_LENGTH } from './idempotency-key';
@@ -186,11 +162,7 @@ export type {
   MemoryIdempotencyStore,
   MemoryIdempotencyStoreOptions,
 } from './idempotency-memory';
-export {
-  DEFAULT_IDEMPOTENCY_WINDOW_MS,
-  DEFAULT_MAX_IDEMPOTENCY_KEYS,
-  memoryIdempotencyStore,
-} from './idempotency-memory';
+export { DEFAULT_MAX_IDEMPOTENCY_KEYS, memoryIdempotencyStore } from './idempotency-memory';
 export type {
   PostgresIdempotencyStore,
   PostgresIdempotencyStoreOptions,
@@ -200,7 +172,6 @@ export { postgresIdempotencyStore, SQL_IDEMPOTENCY_TABLE } from './idempotency-p
 /** The one execution path. `defOf` stays unexported — that is the enforcement. */
 export { actionName, invoke } from './invoke';
 export type { ActionJobHandle } from './job-handle';
-export { toJobHandle } from './job-handle';
 export type { JsonSchemaObject } from './json-schema';
 export { jsonSchemaOf } from './json-schema';
 /**
@@ -217,13 +188,13 @@ export type {
   MeterWarnTarget,
   ResolvedLimit,
 } from './meter';
-export { METER_PERIODS, MeterWarning } from './meter';
+export { MeterWarning } from './meter';
 export type { MemoryMeterStoreOptions } from './meter-memory';
-export { DEFAULT_MAX_METER_KEYS, memoryMeterStore } from './meter-memory';
+export { memoryMeterStore } from './meter-memory';
 export type { PostgresMeterStoreOptions } from './meter-postgres';
 export { postgresMeterStore, SQL_METER_TABLE } from './meter-postgres';
 export type { MeterDraw, MeterDrawResult, MeterKey, MeterStore } from './meter-store';
-export { getMeterStore, resetMeterStore, setMeterStore } from './meter-store';
+export { getMeterStore } from './meter-store';
 export type {
   LocalTable,
   LocalTableName,
@@ -235,15 +206,10 @@ export type {
 } from './mutator';
 export { custom, isMutator, mutator } from './mutator';
 export type { ActionPath } from './naming';
-export { derivePath, inputSchemaName, outputSchemaName } from './naming';
+export { derivePath, inputSchemaName } from './naming';
 export type { BuildOpenApiOptions, OpenApiDocument, OpenApiInfo } from './openapi';
 export { buildOpenApi, serializeOpenApi } from './openapi';
-export {
-  BEARER_SCHEME,
-  COOKIE_SCHEME,
-  completeOpenApi,
-  mountOpenApi,
-} from './openapi-complete';
+export { completeOpenApi, mountOpenApi } from './openapi-complete';
 /**
  * `@ultimat3/http`'s `hooks.explainMiss` for the action surface: a POST to an action's path under
  * a `pathStyle` this app does not serve answers `X_CONTRACT_DRIFT` naming the style it does.
@@ -257,17 +223,18 @@ export type { ActionPolicy, PolicySubject, Surface } from './policy-gate';
  * `@ultimat3/core`'s — imported from there, so `query` reads the same walk through one import path.
  */
 export { guardAction, guardActionBeforeInput } from './policy-gate';
+// `registerAction`/`registerActions` are deliberately absent: `defineApi` is an app's one
+// registration path, and `x`'s loader reaches them through `@ultimat3/action/loader`.
 export {
   actionHttpPath,
   configureActionPathStyle,
   describeActions,
   getAction,
   listActions,
-  registerAction,
-  registerActions,
   resetActions,
 } from './registry';
 export { requestDeadlineMs } from './request-deadline';
+export { stableStringify } from './stable';
 /**
  * What a named tool passes on its way to `invoke`, on either tool surface. `@ultimat3/mcp`'s
  * `mcpConfirmations` registers one and `@ultimat3/ai`'s adapter reads it: one tier down from both.
@@ -288,12 +255,7 @@ export {
  * handle and its manifest row. The machine itself is `@ultimat3/entity`'s — this package owns the
  * projection, not the legality rule.
  */
-export type {
-  TransitionDef,
-  TransitionInput,
-  TransitionTarget,
-  TransitionValues,
-} from './transition';
+export type { TransitionDef, TransitionInput, TransitionTarget } from './transition';
 export { transition } from './transition';
 /**
  * `invoke`'s input parse and its `X_INPUT_INVALID` refusal, alone. Exported so a caller that must
@@ -307,4 +269,4 @@ export { parseActionInput } from './validate';
  * `x g resource` emits, to keep this package out of its chunk — holds the parsed body itself and
  * would otherwise write a second, unvalidated reader.
  */
-export { issuesFromWire, MAX_WIRE_ISSUES } from './wire-issues';
+export { issuesFromWire } from './wire-issues';