@classytic/arc 2.25.0 → 2.30.0

package/dist/{core-EUNu0u07.mjs → defineResource-CxWqDCAy.mjs}

@@ -3,17 +3,17 @@ import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController--M8EMzt0.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B5DwufbB.mjs";
 import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
-import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-v0Wb6Plt.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CQ_7KQWw.mjs";
+import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-JkxIEBJq.mjs";
 import { c as getDefaultCrudSchemas } from "./utils-taUVD4p3.mjs";
 import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-DJvodiHj.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-BN5G05rd.mjs";
-import { A as requireAuth } from "./permissions-BrtiBKGs.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-DwFDVKP0.mjs";
+import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps } from "./pipeline-BJnpkY9i.mjs";
+import { I as requireAuth } from "./permissions-Bfu_8y1U.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-CJOEXLuk.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
 //#region src/core/middlewares/fieldWrite.ts
@@ -55,52 +55,6 @@ function methodCarriesBody(method) {
 	return m === "POST" || m === "PUT" || m === "PATCH";
 }
 //#endregion
-//#region src/core/aggregation/defineAggregation.ts
-/**
-* Declare a single resource aggregation. Exported configs flow into
-* `defineResource({ aggregations: { ... } })` either as named keys or
-* via auto-discovery patterns (loadAggregations — future).
-*
-* @example Inline
-* ```ts
-* defineResource({
-*   name: 'order',
-*   aggregations: {
-*     revenueByStatus: defineAggregation({
-*       groupBy: 'status',
-*       measures: { count: 'count', revenue: 'sum:totalPrice' },
-*       permissions: requireRoles(['admin']),
-*     }),
-*   },
-* });
-* ```
-*
-* @example Multi-file
-* ```ts
-* // orders/aggregations/revenue-by-status.ts
-* import { defineAggregation } from '@classytic/arc';
-*
-* export const revenueByStatus = defineAggregation({
-*   groupBy: 'status',
-*   measures: { count: 'count', revenue: 'sum:totalPrice' },
-*   permissions: requireRoles(['admin']),
-*   timeout: 5000,
-*   cache: { staleTime: 60 },
-* });
-*
-* // orders/order.resource.ts
-* import * as aggregations from './aggregations/index.js';
-*
-* defineResource({
-*   name: 'order',
-*   aggregations,                                  // 30+ entries flow in
-* });
-* ```
-*/
-function defineAggregation(config) {
-	return config;
-}
-//#endregion
 //#region src/core/createCrudRouter.ts
 /**
 * Mount custom routes (from presets or user-defined `routes`) on Fastify.
@@ -340,80 +294,6 @@ function createPermissionMiddleware(permission, resourceName, action) {
 	return buildCrudPermissionMw(permission, resourceName, action);
 }
 //#endregion
-//#region src/core/defineAction.ts
-/**
-* Build an `ActionDefinition` with a typed handler. The literal schema
-* type captured here flows into `data`, so `defineAction({ schema:
-* z.object({...}), handler })` produces fully-typed code with no
-* `as MyShape` cast.
-*
-* Behaviorally identical to a bare `ActionDefinition` object — same
-* validation path (AJV), same permission resolution, same MCP wiring.
-* The runtime shape is unchanged; only the type-level inference is new.
-*/
-function defineAction(config) {
-	return {
-		handler: config.handler,
-		permissions: config.permissions,
-		schema: config.schema,
-		description: config.description,
-		id: config.id,
-		mcp: config.mcp
-	};
-}
-//#endregion
-//#region src/core/defineResource/seams.ts
-/** Plain object test — literals only; class instances must replace, not merge. */
-function isPlainObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
-function mergePlain(base, next) {
-	const out = { ...base };
-	for (const [key, value] of Object.entries(next)) {
-		if (value === void 0) continue;
-		const existing = out[key];
-		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
-	}
-	return out;
-}
-/**
-* Canonical slot-aware merge of a base resource config with host seams.
-* Later seams win over earlier ones; `undefined` values never clobber.
-*
-* Merge semantics (value-driven — no per-slot registry to drift):
-*
-*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
-*     `routeGuards`, `disabledRoutes`: additive collections, base first.
-*   - **Plain objects merge recursively** — `permissions`, `actions`,
-*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
-*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
-*     them replace (they're value lists — enums, sort specs), not concat.
-*   - **Everything else last-wins** — class instances (`adapter`,
-*     `controller`, `queryParser`), functions, scalars.
-*
-* The single `as` at the return is the one documented erasure for the
-* {@link AdapterLike}-widened seam slots — inside the helper so no module
-* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
-*/
-function mergeResourceConfig(base, ...seams) {
-	const out = { ...base };
-	for (const seam of seams) {
-		if (!seam) continue;
-		for (const [key, value] of Object.entries(seam)) {
-			if (value === void 0) continue;
-			const existing = out[key];
-			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
-			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
-			else if (Array.isArray(value)) out[key] = [...value];
-			else out[key] = value;
-		}
-	}
-	return out;
-}
-//#endregion
 //#region src/core/defineResource/controller.ts
 /**
 * Phase 4 — pick (or auto-create) the resource's controller.
@@ -582,26 +462,6 @@ function buildBaseController(resolvedConfig, adapter, repository) {
 //#endregion
 //#region src/core/defineResource/hooks.ts
 /**
-* Phase 6 — wire preset hooks + inline `config.hooks` onto the
-* resource's `_pendingHooks`.
-*
-* Two sources feed the same array:
-*   1. Preset hooks collected during `applyPresets()` (raw `_hooks`
-*      on the internal config). Already in the canonical
-*      `{ operation, phase, handler, priority }` shape — copied
-*      verbatim (priority defaults to 10).
-*   2. Inline `config.hooks.beforeCreate` / `afterCreate` / etc.
-*      Authored by the user on the original `ResourceConfig`.
-*      Wrapped in a `ResourceHookContext` projection (v2.10.8) so
-*      authors can read `scope` / `context` without reaching into
-*      internal request fields.
-*
-* The 6 inline hook keys (before/after × create/update/delete) used
-* to be 6 nearly-identical blocks; collapsed into a table + loop so
-* a future hook (e.g. `beforeRead`) is one row, not seven scattered
-* edits.
-*/
-/**
 * Combined entry-point for Phase 6. Pushes preset-collected hooks
 * first, then inline `config.hooks` (so hosts can rely on
 * registration order if priorities tie).
@@ -664,19 +524,17 @@ const INLINE_HOOK_SPECS = [
 	}
 ];
 /**
-* Project a raw HookSystem context into a `ResourceHookContext` for
-* inline `config.hooks.*` handlers. The projection lifts `scope`
-* out of `context._scope` so authors don't reach into internal
-* fields.
+* Project a raw HookSystem context into a `ResourceHookContext` for inline
+* `config.hooks.*` handlers. `scope` rides in already computed — `HookContext`
+* carries the same projection — so the two surfaces cannot drift.
 */
 function buildHookContext(ctx) {
 	const context = ctx.context;
-	const rawScope = context?._scope;
 	return {
 		data: ctx.data ?? ctx.result ?? {},
 		user: ctx.user,
 		context,
-		scope: buildRequestScopeProjection(rawScope),
+		scope: ctx.scope,
 		meta: ctx.meta
 	};
 }
@@ -922,7 +780,7 @@ function stripFromRequired(schema, fieldName) {
 }
 /**
 * Strip framework-injected fields from the `required[]` list of every
-* body-shaped slot in an adapter's generated schemas (v2.11.0).
+* body-shaped slot in an adapter's generated schemas.
 *
 * A "framework-injected field" is any field marked `systemManaged: true`
 * in `schemaOptions.fieldRules`. Arc populates those fields from the
@@ -1077,22 +935,32 @@ const WRITE_OPERATIONS = /* @__PURE__ */ new Set([
 * wiring, ...) count as gates and don't false-positive.
 *
 * Severity ladder:
-*   - `warn` when any enabled WRITE op (create/update/delete) is ungated —
-*     this is real exposure the host must acknowledge.
+*   - `error` when any enabled WRITE op is ungated AND `strict` is on — the
+*     resource fails boot (`defineResource()` throws). This is the fail-closed
+*     production invariant: an unauthenticated write must never ship silently.
+*   - `warn` (default) when any enabled WRITE op (create/update/delete) is
+*     ungated — real exposure the host must acknowledge, but non-fatal so
+*     existing hosts are not broken.
 *   - `info` when only reads are ungated — public catalogs
 *     (`referenceData: true`) are a legitimate shape, but the host should
 *     still state intent with `permissions.fullPublic()` / `allowPublic()`.
+*
+* `strict` is opt-in (resource `strictPermissions: true` or the
+* `ARC_STRICT_PERMISSIONS` env), so the default behavior is unchanged.
 */
-function collectUngatedCrudDiagnostics(config) {
+function collectUngatedCrudDiagnostics(config, strict = false) {
 	if (config.disableDefaultRoutes) return [];
 	const disabled = new Set(config.disabledRoutes ?? []);
 	const permissions = config.permissions ?? {};
 	const ungated = CRUD_OPERATIONS.filter((op) => !disabled.has(op) && typeof permissions[op] !== "function");
 	if (ungated.length === 0) return [];
+	const severity = ungated.some((op) => WRITE_OPERATIONS.has(op)) ? strict ? "error" : "warn" : "info";
 	return [{
-		severity: ungated.some((op) => WRITE_OPERATIONS.has(op)) ? "warn" : "info",
+		severity,
 		code: "crud-public-by-omission",
-		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\nAn omitted permission mounts the route WITHOUT auth. State intent explicitly:\n  permissions: permissions.fullPublic()     // intentionally public\n  permissions: permissions.authenticated()  // require auth on every op\n  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
+		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\n` + (severity === "error" ? "strictPermissions is on and an ungated WRITE is fatal. State intent explicitly:\n" : "An omitted permission mounts the route WITHOUT auth. State intent explicitly:\n") + `  permissions: permissions.fullPublic()     // intentionally public
+  permissions: permissions.authenticated()  // require auth on every op
+  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
 	}];
 }
 //#endregion
@@ -1337,7 +1205,7 @@ function buildResourcePlugin(resource) {
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
 		if (isFirstMount && resource._diagnostics?.length) for (const diagnostic of resource._diagnostics) {
-			const level = diagnostic.severity === "info" ? "info" : "warn";
+			const level = diagnostic.severity === "info" ? "info" : diagnostic.severity === "error" ? "error" : "warn";
 			fastify.log?.[level]?.(diagnostic.message);
 		}
 		const arc = fastify.arc;
@@ -1398,7 +1266,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-B6GvAuAX.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-BxuywVRB.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1413,7 +1281,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-wzwFa_dW.mjs"), import("./validate-Bk44F2yT.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-BiY-lGdY.mjs"), import("./validate-Bk44F2yT.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -2289,7 +2157,12 @@ function defineResource(config) {
 	const configWithId = resolveIdField(normalisedConfig, repository);
 	const resolvedConfig = applyPresetsAndAutoInject(configWithId);
 	const hasCrudRoutes = computeHasCrudRoutes(resolvedConfig);
-	if (!normalisedConfig.skipValidation) diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig));
+	if (!normalisedConfig.skipValidation) {
+		const strict = resolvedConfig.strictPermissions ?? process.env.ARC_STRICT_PERMISSIONS === "true";
+		diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig, strict));
+	}
+	const fatal = diagnostics.filter((d) => d.severity === "error");
+	if (fatal.length > 0) throw new Error(fatal.map((d) => d.message).join("\n\n"));
 	const narrowedConfig = resolvedConfig;
 	const narrowedAdapter = configWithId.adapter;
 	const controller = resolveOrAutoCreateController(narrowedConfig, narrowedAdapter, repository, hasCrudRoutes);
@@ -2308,102 +2181,4 @@ function defineResource(config) {
 	return resource;
 }
 //#endregion
-//#region src/core/defineResourceVariants.ts
-/**
-* Define multiple resources from a shared base config and per-variant overrides.
-*
-* Each variant is independently passed through `defineResource()` — the
-* returned `ResourceDefinition`s are real, fully-registered resources.
-* Register each one's plugin in your app:
-*
-* ```typescript
-* await app.register(articlePublic.toPlugin());
-* await app.register(articleAdmin.toPlugin());
-* ```
-*
-* @param base    Shared config — adapter, queryParser, schemaOptions, hooks, etc.
-*                Must NOT include `name` or `prefix` (those are per-variant).
-* @param variants  Map of variant key → override. Each variant must declare
-*                  its own `name` and `prefix`. Other fields override the base.
-* @returns A record where each key from `variants` maps to a real
-*          `ResourceDefinition` ready for `.toPlugin()` registration.
-*/
-function defineResourceVariants(base, variants) {
-	const out = {};
-	for (const key of Object.keys(variants)) {
-		const override = variants[key];
-		out[key] = defineResource({
-			...base,
-			...override
-		});
-	}
-	return out;
-}
-//#endregion
-//#region src/core/entityHelpers.ts
-/**
-* Per-request entity helpers — read the resource binding (idField + the
-* URL `:id` value) off `req.arc`.
-*
-* Action handlers receive their `id` argument as the raw URL `:id` value.
-* When the resource declares a custom `idField` (`slug`, `reportId`, …)
-* that's NOT the document `_id`, a naive `Model.findById(id)` silently
-* returns null. The historical footgun was a `findById(id)` typo where
-* the handler author hadn't realised that `:id` resolves to the friendly
-* handle.
-*
-* `getEntityQuery(req)` produces the canonical filter shape so handlers
-* compose lookups with no resource-config recall:
-*
-* ```ts
-* actions: {
-*   archive: {
-*     handler: async (id, data, req) => {
-*       const doc = await Model.findOne(getEntityQuery(req));
-*       if (!doc) throw new NotFoundError("Order");
-*       // ...
-*     },
-*   },
-* }
-* ```
-*
-* The router populates `req.arc.idField` and `req.arc.entityId` before
-* invoking the handler — these helpers are zero-cost reads.
-*/
-/**
-* Read the resource's configured `idField` for the current request.
-* Falls back to the framework default (`_id`) when the route hasn't
-* bound an idField — keeps handlers safe to author without checking
-* the resource config.
-*/
-function getEntityIdField(req) {
-	return req.arc?.idField ?? "_id";
-}
-/**
-* Read the URL `:id` path param value as the resource handle.
-* Returns `undefined` when the route has no `:id` segment (collection
-* routes) — handlers that need the entity must be on row routes.
-*/
-function getEntityId(req) {
-	if (req.arc?.entityId !== void 0) return req.arc.entityId;
-	return req.params?.id;
-}
-/**
-* Compose a `findOne` filter that resolves the current request's
-* entity, regardless of whether the resource binds `_id` or a custom
-* field. Idiomatic shape for arc action handlers.
-*
-* ```ts
-* const doc = await Model.findOne(getEntityQuery(req));
-* ```
-*
-* Returns `{}` when the route has no entity context (collection routes
-* or tests bypassing the router) — caller decides what that means.
-*/
-function getEntityQuery(req) {
-	const id = getEntityId(req);
-	if (id === void 0) return {};
-	return { [getEntityIdField(req)]: id };
-}
-//#endregion
-export { defineResource as a, validateResourceConfig as c, defineAction as d, createCrudRouter as f, defineResourceVariants as i, ResourceDefinition as l, defineAggregation as m, getEntityIdField as n, assertValidConfig as o, createPermissionMiddleware as p, getEntityQuery as r, formatValidationErrors as s, getEntityId as t, mergeResourceConfig as u };
+export { ResourceDefinition as a, validateResourceConfig as i, assertValidConfig as n, createCrudRouter as o, formatValidationErrors as r, createPermissionMiddleware as s, defineResource as t };

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-DPRH0Cme.mjs";
+import { p as RegistryEntry } from "../index-Q5gzEIWY.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { n as getUserRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-DrLtog_B.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-B8Vkbxbn.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{eventPlugin-DrQ_FesK.mjs → eventPlugin-D2NNR4py.mjs}

@@ -2,109 +2,8 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError } from "./errors-DkO8Nk6-.mjs";
 import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
+import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-C6YA8xY9.mjs";
 import fp from "fastify-plugin";
-import { createEvent, matchEventPattern } from "@classytic/primitives/events";
-//#region src/events/EventTransport.ts
-/**
-* Internal arc events module — concrete in-memory transport.
-*
-* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
-* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
-* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
-* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
-* Two reasons:
-*
-*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
-*      audit-log plugin, future kits and downstream services all share them.
-*      Owning them in `primitives` (pure types, zero runtime, zero deps)
-*      eliminates the "manually mirror in two places" problem the previous
-*      `primitives/src/events.ts` header explicitly called out.
-*   2. Inverting the dependency direction lets future packages (sqlitekit
-*      audit, billing services) consume the contract without depending on
-*      arc's HTTP-coupled stack.
-*
-* Hosts MUST import the types from primitives directly:
-*
-* ```typescript
-* import type {
-*   EventMeta, DomainEvent, EventHandler, EventTransport,
-*   DeadLetteredEvent, PublishManyResult,
-* } from '@classytic/primitives/events';
-* import { createEvent, createChildEvent } from '@classytic/primitives/events';
-* ```
-*
-* arc's `events/index.ts` barrel does NOT re-export these — by design, so
-* that consumer code is forced into the canonical import path and the org's
-* "no re-exports" rule holds at every public surface.
-*
-* What stays here:
-*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
-*     used as arc's default transport. Its handler-set state is process-local;
-*     wrong layer for primitives.
-*   - `MemoryEventTransportOptions` — its options shape.
-*
-* Inside arc, files that previously imported types from `./EventTransport.js`
-* keep working: this file re-exports them from primitives for arc's own
-* call sites. That re-export is an internal refactor convenience — the
-* public `events/index.ts` barrel stays clean.
-*/
-/**
-* In-memory event transport (default).
-*
-* Events are delivered synchronously within the process. Not suitable for
-* multi-instance deployments — pair with `RedisEventTransport` /
-* `RedisStreamTransport` (subpath imports) for those.
-*/
-var MemoryEventTransport = class {
-	name = "memory";
-	handlers = /* @__PURE__ */ new Map();
-	logger;
-	constructor(options) {
-		this.logger = options?.logger ?? console;
-	}
-	async publish(event) {
-		const allHandlers = /* @__PURE__ */ new Set();
-		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-		}
-	}
-	/**
-	* Reference `publishMany` implementation — delegates to `publish()` in order.
-	*
-	* Production transports (Kafka, Redis pipeline, SQS batch) should override
-	* this with a single batched network call. Memory transport has nothing to
-	* batch, so we just loop — the loop still returns a proper result map so
-	* `EventOutbox.relay` can exercise the batched code path in tests.
-	*/
-	async publishMany(events) {
-		const results = /* @__PURE__ */ new Map();
-		for (const event of events) try {
-			await this.publish(event);
-			results.set(event.meta.id, null);
-		} catch (err) {
-			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
-		}
-		return results;
-	}
-	async subscribe(pattern, handler) {
-		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
-		this.handlers.get(pattern)?.add(handler);
-		return () => {
-			const set = this.handlers.get(pattern);
-			if (set) {
-				set.delete(handler);
-				if (set.size === 0) this.handlers.delete(pattern);
-			}
-		};
-	}
-	async close() {
-		this.handlers.clear();
-	}
-};
-//#endregion
 //#region src/events/retry.ts
 /**
 * Wrap an event handler with retry logic and dead letter support.
@@ -338,4 +237,4 @@ var eventPlugin_default = fp(eventPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { MemoryEventTransport as a, withRetry as i, eventPlugin_exports as n, createEvent as o, createDeadLetterPublisher as r, eventPlugin as t };
+export { withRetry as i, eventPlugin_exports as n, createDeadLetterPublisher as r, eventPlugin as t };

package/dist/events/index.d.mts

@@ -72,6 +72,16 @@ interface MemoryEntry {
 declare class MemoryOutboxStore implements OutboxStore {
   private readonly entries;
   private readonly seenDedupeKeys;
+  /**
+   * Drop every entry (including delivered / failed / dead-lettered rows) and
+   * the dedupe-key memory.
+   *
+   * For tests only — it is the in-memory analogue of truncating the table, and
+   * exists so a suite can isolate cases against ONE store instance (the
+   * `reset` hook of `runOutboxStoreContract`). Not part of `OutboxStore`; a
+   * production store must never expose this.
+   */
+  clear(): void;
   save(event: DomainEvent, options?: OutboxWriteOptions): Promise<void>;
   getPending(limit: number): Promise<DomainEvent[]>;
   claimPending(options?: OutboxClaimOptions): Promise<DomainEvent[]>;
@@ -395,7 +405,23 @@ declare class EventOutbox {
 }
 //#endregion
 //#region src/events/repository-outbox-adapter.d.ts
-declare function repositoryAsOutboxStore(repository: RepositoryLike): OutboxStore;
+interface RepositoryOutboxStoreOptions {
+  /**
+   * Column holding the "not claimable before" timestamp. Default
+   * `'visibleAt'`.
+   *
+   * Exists so a host with an EXISTING outbox table can adopt this adapter
+   * without renaming a column and rebuilding its claim index — the one thing
+   * that otherwise forces a migration on the table that guarantees delivery.
+   * A store using `nextVisibleAt` (with a `{status, nextVisibleAt, createdAt}`
+   * index) passes `{ visibleAtField: 'nextVisibleAt' }` and keeps both.
+   *
+   * The field is used in the claimable filter, on `save`, and on `fail`'s
+   * retry scheduling — all three stay in lockstep by construction.
+   */
+  readonly visibleAtField?: string;
+}
+declare function repositoryAsOutboxStore(repository: RepositoryLike, options?: RepositoryOutboxStoreOptions): OutboxStore;
 //#endregion
 //#region src/events/subscribe-helpers.d.ts
 /**
@@ -556,4 +582,4 @@ interface FastifyEventBus {
   };
 }
 //#endregion
-export { ARC_LIFECYCLE_EVENTS, type ArcLifecycleEvent, CACHE_EVENTS, CRUD_EVENT_SUFFIXES, type CacheEvent, type CrudEventSuffix, type CustomValidator, type EventDefinitionInput, type EventDefinitionOutput, EventOutbox, type EventOutboxOptions, type EventPluginOptions, type EventRegistry, type EventRegistryOptions, type EventSchema, type ExponentialBackoffOptions, MemoryEventTransport, type MemoryEventTransportOptions, MemoryOutboxStore, type OutboxRelayErrorHandler, type OutboxRelayErrorKind, type PayloadOf, type RedisEventTransportOptions, type RedisLike, type RedisStreamLike, type RedisStreamTransportOptions, type RelayResult, type RetryOptions, type ValidationResult, type WrapWithBoundaryOptions, type WrapWithSchemaOptions, createDeadLetterPublisher, createEventRegistry, crudEventType, defineEvent, eventPlugin, exponentialBackoff, repositoryAsOutboxStore, subscribeWithBoundary, subscribeWithSchema, withRetry, wrapWithBoundary, wrapWithSchema };
+export { ARC_LIFECYCLE_EVENTS, type ArcLifecycleEvent, CACHE_EVENTS, CRUD_EVENT_SUFFIXES, type CacheEvent, type CrudEventSuffix, type CustomValidator, type EventDefinitionInput, type EventDefinitionOutput, EventOutbox, type EventOutboxOptions, type EventPluginOptions, type EventRegistry, type EventRegistryOptions, type EventSchema, type ExponentialBackoffOptions, MemoryEventTransport, type MemoryEventTransportOptions, MemoryOutboxStore, type OutboxRelayErrorHandler, type OutboxRelayErrorKind, type PayloadOf, type RedisEventTransportOptions, type RedisLike, type RedisStreamLike, type RedisStreamTransportOptions, type RelayResult, type RepositoryOutboxStoreOptions, type RetryOptions, type ValidationResult, type WrapWithBoundaryOptions, type WrapWithSchemaOptions, createDeadLetterPublisher, createEventRegistry, crudEventType, defineEvent, eventPlugin, exponentialBackoff, repositoryAsOutboxStore, subscribeWithBoundary, subscribeWithSchema, withRetry, wrapWithBoundary, wrapWithSchema };