@classytic/arc 2.30.0 → 2.32.0

package/dist/{mcpPlugin-nRzm5g2s.mjs → mcpPlugin-CpfVpKHE.mjs}

@@ -1,18 +1,19 @@
-import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as BaseController } from "./BaseController-B5DwufbB.mjs";
-import { i as evaluatePermissionDecision } from "./applyPermissionResult-Cf6zUCvb.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
-import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
-import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-BJnpkY9i.mjs";
-import { n as validateAggregations } from "./validate-Bk44F2yT.mjs";
-import { n as executeAggregation } from "./buildHandler-BYS3Vkfz.mjs";
-import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
-import { t as createIdempotencyResult } from "./interface-n5hpKg1d.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-__T3EJDA.mjs";
+import { p as isArcError, t as ArcError } from "./errors-Bh1KK5ps.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BXjQYbeC.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-DXYX7dIR.mjs";
+import { t as BaseController } from "./BaseController-Dk34dxhI.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { t as executePipeline } from "./pipe-ELHCP3zj.mjs";
+import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-CPA-jx0M.mjs";
+import { n as validateAggregations } from "./validate-PMCPR9El.mjs";
+import { n as executeAggregation } from "./buildHandler-Dn7rzUJo.mjs";
+import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
+import { t as createIdempotencyResult } from "./interface-BP4IJCBO.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CnyKK_1j.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -366,12 +367,13 @@ function buildScope(auth) {
 */
 async function evaluatePermission(check, session, resource, action, input) {
 	if (!check) return null;
+	const user = session ? {
+		id: session.userId,
+		_id: session.userId,
+		...session
+	} : null;
 	return evaluatePermissionDecision(check, {
-		user: session ? {
-			id: session.userId,
-			_id: session.userId,
-			...session
-		} : null,
+		user,
 		scope: buildScope(session),
 		resource,
 		action,
@@ -464,13 +466,14 @@ function toCallToolSuccess(value) {
 */
 function toCallToolError(input) {
 	let contract;
-	if (input instanceof Error) if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
-	else contract = {
-		code: "arc.internal_error",
-		message: input.message || "Internal Server Error",
-		status: 500
-	};
-	else contract = {
+	if (input instanceof Error) {
+		if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
+		else contract = {
+			code: "arc.internal_error",
+			message: input.message || "Internal Server Error",
+			status: 500
+		};
+	} else contract = {
 		code: input.code,
 		message: input.message,
 		...input.status !== void 0 ? { status: input.status } : {},
@@ -587,7 +590,7 @@ function invocationFingerprint(resourceName, actionName, input, session) {
 	return `mcp:${resourceName}:${actionName}:${createHash("sha256").update(JSON.stringify(sortKeys(input))).digest("hex").substring(0, 16)}:u=${session?.userId ?? session?.clientId ?? "anon"}`;
 }
 /** TTLs matching the HTTP idempotency plugin's defaults. */
-const MCP_IDEMPOTENCY_TTL_MS = 1440 * 60 * 1e3;
+const MCP_IDEMPOTENCY_TTL_MS = 864e5;
 const MCP_IDEMPOTENCY_LOCK_MS = 1e4;
 /**
 * Invoke a controller method through the MCP synthetic-context path.
@@ -1433,7 +1436,6 @@ function jsonSchemaPropertyToZod(prop) {
 		case "array": return applyDescription(arrayToZod(prop), prop);
 		case "object": return applyDescription(objectToZod(prop), prop);
 		case "null": continue;
-		default: break;
 	}
 	return applyDescription(z.unknown(), prop);
 }
@@ -1634,7 +1636,7 @@ function mapJsonSchemaTypeToArcType(jsonType) {
 *
 * 1. `mcpHandler` (full bypass) — caller-supplied function owns the whole
 *    tool result; pipeline is not invoked.
-* 2. Function handler with `raw: false/undefined` — arc's pipeline wrapper
+* 2. Function in `handler` (the arc pipeline) — arc's pipeline wrapper
 *    runs normally, and the envelope is serialized into the tool result.
 * 3. String handler — looks up a method on the controller by name.
 */
@@ -1872,10 +1874,10 @@ function resourceToTools(resource, config = {}) {
 	for (const route of resource.routes ?? []) {
 		if (route.mcp === false) continue;
 		const mcpHandler = route.mcpHandler;
-		if (!!route.raw && !mcpHandler) continue;
+		if (!(route.rawHandler === void 0) && !mcpHandler) continue;
 		if (!mcpHandler && typeof route.handler === "string" && !controller) continue;
 		const routeWithRef = route;
-		let resolvedRouteHandler = route.handler;
+		let resolvedRouteHandler = route.handler ?? route.rawHandler;
 		if (typeof routeWithRef.controllerMethod === "function" && !resolvedRouteHandler) {
 			if (!controller) continue;
 			const referenced = routeWithRef.controllerMethod(controller);
@@ -2060,7 +2062,7 @@ function getOps(r, override) {
 }
 //#endregion
 //#region src/integrations/mcp/sessionCache.ts
-const DEFAULT_TTL_MS = 1800 * 1e3;
+const DEFAULT_TTL_MS = 18e5;
 const DEFAULT_MAX_SESSIONS = 1e3;
 var McpSessionCache = class {
 	sessions = /* @__PURE__ */ new Map();
@@ -2190,7 +2192,6 @@ const mcpPluginImpl = async (fastify, options) => {
 	}
 	const enabledResources = filterResourcesForMcp(options.resources, {
 		expose: options.expose,
-		include: options.include,
 		exclude: options.exclude
 	});
 	const fastifyAny = fastify;
@@ -2465,11 +2466,10 @@ function registerStatefulRoutes(fastify, prefix, options, cache, createServer, T
 * same precedence rules without duplicating them.
 */
 function filterResourcesForMcp(resources, inputs) {
-	const { expose, include, exclude } = inputs;
-	if (expose && include) throw new Error("mcpPlugin: pass either `expose` (preferred) or `include` (legacy alias), not both.");
-	if (expose && exclude) throw new Error("mcpPlugin: `expose` is default-deny — `exclude` is redundant. Drop `exclude` or switch to `include`/`exclude` for default-allow semantics.");
+	const { expose, exclude } = inputs;
+	if (expose && exclude) throw new Error("mcpPlugin: `expose` is default-deny (an allowlist) — `exclude` is redundant alongside it. Use `expose` to name what to surface, OR `exclude` to drop specific resources from the default-allow set. Not both.");
 	const eligible = resources.filter((r) => r.mcp !== false);
-	const allow = expose ?? include;
+	const allow = expose;
 	if (allow) {
 		const allowSet = new Set(allow);
 		return eligible.filter((r) => allowSet.has(r.name));

package/dist/{memory-CmnzXE5Z.mjs → memory-DsuWnj4T.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**
@@ -25,11 +26,11 @@ var MemoryCacheStore = class {
 	constructor(options = {}) {
 		this.defaultTtlSeconds = options.defaultTtlSeconds ?? 60;
 		this.maxEntries = clamp(options.maxEntries ?? 1e3, 1, 1e5);
-		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 256 * 1024, 1024, 10 * 1024 * 1024);
-		this.maxMemoryBytes = options.maxMemoryBytes ?? 50 * 1024 * 1024;
+		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 262144, 1024, 10485760);
+		this.maxMemoryBytes = options.maxMemoryBytes ?? 52428800;
 		this.evictionWatermark = clamp(options.evictionWatermark ?? .9, .5, 1);
 		this.logger = options.logger ?? console;
-		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 600 * 1e3);
+		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 6e5);
 		this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
 		if (this.cleanupTimer.unref) this.cleanupTimer.unref();
 	}

package/dist/{metrics-fdxI5mn_.mjs → metrics-DdQL8syd.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,4 +1,5 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-Q5gzEIWY.mjs";
+
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CpzxqePp.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,5 +1,6 @@
-import { t as CRUD_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-J99LGTJI.mjs";
+import { t as multipartBody } from "../multipartBody-BnkBLN7v.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.d.mts

@@ -1,3 +1,4 @@
+
 import { LockAdapter } from "@classytic/repo-core/lock";
 //#region src/migrations/index.d.ts
 interface Migration {

package/dist/migrations/index.mjs

@@ -1,4 +1,5 @@
-import { t as startRenewingLease } from "../renewingLease-3cuQH7h8.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-BpP9wwj7.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -87,7 +88,7 @@ var MongoMigrationStore = class {
 	}
 };
 const MIGRATION_LOCK_NAME = "arc:migrations";
-const DEFAULT_LOCK_LEASE_MS = 600 * 1e3;
+const DEFAULT_LOCK_LEASE_MS = 6e5;
 /**
 * Source checksum for drift detection — SHA-256 over the migration's
 * `up`/`down` source. Stable for a given build; a transpile-target change

package/dist/module-Br81am6m.mjs

@@ -0,0 +1,78 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+//#region src/factory/module/index.ts
+/**
+* Identity helper for authoring a typed module — mirrors `defineResource`.
+* Gives inference + a single obvious construction site; does no work.
+*
+* `TExports` is inferred from the `bootstrap` return value, so a module
+* author gets a typed public export for free:
+*
+* ```ts
+* export const accountingModule = (deps: Deps) =>
+*   defineModule({
+*     name: "accounting",
+*     bootstrap: async () => createAccountingEngine(deps), // TExports inferred
+*   });
+* ```
+*/
+function defineModule(module) {
+	return module;
+}
+function getModuleExports(fastify, name) {
+	const recorded = readModuleExports(fastify, name);
+	if (recorded === ABSENT) {
+		const available = fastify.arc?.modules ? Object.keys(fastify.arc.modules) : [];
+		throw new Error(`[arc] no public export recorded for module "${name}".\nA module's export is its bootstrap() return value; it is readable only AFTER that module's bootstrap ran (dependsOn / list order = init order).\nModules with recorded exports: ${available.length ? available.join(", ") : "(none)"}.`);
+	}
+	return recorded;
+}
+/**
+* Sentinel for "no entry recorded", distinct from a recorded `undefined`.
+*
+* registerResources never records an `undefined` export, so today the two
+* cannot both happen — but encoding absence as `undefined` would make the
+* optional/required accessors disagree the day that changes, and a required
+* accessor that stops throwing is exactly the silent-null class of bug these
+* helpers exist to remove.
+*/
+const ABSENT = Symbol("arc.module.absent");
+/** The one honest read of the module-export map, shared by every accessor. */
+function readModuleExports(fastify, name) {
+	const modules = fastify.arc?.modules;
+	if (!modules || !Object.hasOwn(modules, name)) return ABSENT;
+	return modules[name];
+}
+function getOptionalModuleExports(fastify, name) {
+	const recorded = readModuleExports(fastify, name);
+	return recorded === ABSENT ? void 0 : recorded;
+}
+/**
+* Is a module's public export recorded yet? The predicate form of
+* `getOptionalModuleExports`, for readiness gates (`ready: () => ...`) that
+* should not have to reason about falsy-but-present exports.
+*/
+function hasModuleExports(fastify, name) {
+	return readModuleExports(fastify, name) !== ABSENT;
+}
+function lazyModuleExports(fastify, name) {
+	let resolved = ABSENT;
+	return () => {
+		if (resolved === ABSENT) resolved = readModuleExports(fastify, name);
+		return resolved === ABSENT ? void 0 : resolved;
+	};
+}
+function lazyRequiredModuleExports(fastify, name) {
+	const states = fastify.arc?.moduleStates;
+	if (states !== void 0 && !Object.hasOwn(states, name)) {
+		const composed = Object.keys(states);
+		throw new Error(`[arc] lazyRequiredModuleExports("${name}"): module "${name}" is not in the composed module graph. A lazily-required module is still a HARD dependency — compose it (and declare it in the consumer's \`dependsOn\`), or use lazyModuleExports() if the integration is genuinely optional.
+Composed modules: ${composed.length ? composed.join(", ") : "(none)"}.`);
+	}
+	let resolved = ABSENT;
+	return () => {
+		if (resolved === ABSENT) resolved = getModuleExports(fastify, name);
+		return resolved;
+	};
+}
+//#endregion
+export { lazyModuleExports as a, hasModuleExports as i, getModuleExports as n, lazyRequiredModuleExports as o, getOptionalModuleExports as r, defineModule as t };

package/dist/{multipartBody-D0eBvkeq.mjs → multipartBody-BnkBLN7v.mjs}

@@ -1,8 +1,9 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
-const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_FILE_SIZE = 10485760;
 const DEFAULT_MAX_FILES = 5;
-const DEFAULT_MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+const DEFAULT_MAX_TOTAL_BYTES = 26214400;
 const DEFAULT_FILES_KEY = "_files";
 /**
 * Build a matcher for MIME allow-lists that supports exact (e.g. `image/png`),

package/dist/{openapi-B8Vkbxbn.mjs → openapi-DIRzvxC0.mjs}

@@ -1,8 +1,9 @@
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-DJvodiHj.mjs";
-import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-BxuywVRB.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-Crjvczi_.mjs";
+import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-DkJZWo0m.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -0,0 +1,85 @@
+
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { t as ArcModule } from "../types-CT5vu6M0.mjs";
+import { OutboxStore } from "@classytic/primitives/outbox";
+//#region src/outbox-admin/module.d.ts
+/**
+ * A store that can answer an operator's questions.
+ *
+ * Only the four reads this surface actually performs are required — `fail` and
+ * `purge` belong to the relay and retention, not here.
+ */
+type OutboxAdminStore = OutboxStore & Required<Pick<OutboxStore, "getDeadLettered" | "requeue" | "countByStatus" | "oldestPendingAgeMs">>;
+interface OutboxAdminPermissions {
+  /**
+   * Reading health and the dead-letter list.
+   *
+   * MUST be platform-only — see `allowUnverifiedOperatorPermission`.
+   */
+  view: PermissionCheck;
+  /**
+   * Replaying a dead-lettered event. Defaults to `view` when omitted — but
+   * replay RE-DELIVERS an event that already failed five times, so a
+   * deployment that separates read access from operational action should gate
+   * it distinctly. Also platform-only.
+   */
+  replay?: PermissionCheck;
+}
+interface OutboxAdminModuleDeps {
+  store: OutboxAdminStore;
+  permissions: OutboxAdminPermissions;
+  /** Route prefix. Default `/admin/outbox`. */
+  prefix?: string;
+  /** Module name. Default `outbox-admin`. */
+  moduleName?: string;
+  /**
+   * Name the outbox module was composed under, used to resolve the relay and
+   * declared as a `dependsOn` edge. Default `outbox`.
+   */
+  outboxModuleName?: string;
+  /** Resource names this module supersedes. */
+  owns?: readonly string[];
+  /** Cap on `?limit`. Default 500 — a dead-letter list is for triage, not export. */
+  maxDeadLetterLimit?: number;
+  /**
+   * Accept gates arc cannot prove are platform-only.
+   *
+   * By default both gates must carry `_platformOnly` (i.e. come from
+   * `requirePlatformRole`), and boot FAILS otherwise. The reason is the same
+   * one that hardened `integrations/jobs` in 2.31: these routes are global by
+   * construction. `getDeadLettered(limit)` takes no filter and an outbox row
+   * carries no tenant identity, so there is nothing to scope by. A gate that
+   * grants per organization therefore READS as scoped while serving everyone —
+   * `requireOrgRole('manager')` would let org A's manager read org B's failed
+   * events. Neither returns a policy, so no per-request check can tell a real
+   * operator gate from an org one.
+   *
+   * Set this only for a custom check you have verified consults platform
+   * identity alone.
+   */
+  allowUnverifiedOperatorPermission?: boolean;
+  /**
+   * Include each dead-lettered event's domain PAYLOAD in the listing.
+   * Default `false`.
+   *
+   * The payload is the original event body — in an ERP that is order totals,
+   * customer records and payment references. Triage needs the id, the event
+   * name, the attempt count and why it failed; it does not need the contents.
+   * Opt in only where the surface is genuinely platform-operator-only and you
+   * accept that the response carries business data.
+   */
+  exposePayload?: boolean;
+  /**
+   * Include the failure STACK TRACE alongside the error message.
+   * Default `false` — a stack names internal paths and framework versions.
+   */
+  exposeStack?: boolean;
+  /**
+   * Pending-event age (ms) past which the outbox reports unhealthy even with an
+   * empty dead-letter queue. Default 5 minutes.
+   */
+  relayLagUnhealthyMs?: number;
+}
+declare function createOutboxAdminModule(deps: OutboxAdminModuleDeps): ArcModule<void>;
+//#endregion
+export { type OutboxAdminModuleDeps, type OutboxAdminPermissions, type OutboxAdminStore, createOutboxAdminModule };

package/dist/outbox-admin/index.mjs

@@ -0,0 +1,115 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Bh1KK5ps.mjs";
+import { t as defineResource } from "../defineResource-XFPPUu2c.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-Br81am6m.mjs";
+//#region src/outbox-admin/module.ts
+/**
+* Strip the domain payload and the stack unless explicitly opted in.
+*
+* Triage is answered by WHICH event failed, HOW MANY times, WHEN and WHY. The
+* payload answers none of those and carries the business record; the stack
+* names internal paths. Both are off by default, on the same reasoning that
+* made `exposeResult` / `exposeFailureReason` opt-in for jobs.
+*/
+function redactDeadLettered(e, opts) {
+	return {
+		event: {
+			type: e.event.type,
+			meta: e.event.meta,
+			...opts.exposePayload ? { payload: e.event.payload } : {}
+		},
+		error: {
+			message: e.error.message,
+			...e.error.code !== void 0 ? { code: e.error.code } : {},
+			...opts.exposeStack && e.error.stack !== void 0 ? { stack: e.error.stack } : {}
+		},
+		attempts: e.attempts,
+		firstFailedAt: e.firstFailedAt,
+		lastFailedAt: e.lastFailedAt,
+		...e.handlerName !== void 0 ? { handlerName: e.handlerName } : {}
+	};
+}
+function createOutboxAdminModule(deps) {
+	const moduleName = deps.moduleName ?? "outbox-admin";
+	const outboxModuleName = deps.outboxModuleName ?? "outbox";
+	const maxLimit = deps.maxDeadLetterLimit ?? 500;
+	const view = deps.permissions.view;
+	const replay = deps.permissions.replay ?? deps.permissions.view;
+	const lagUnhealthyMs = deps.relayLagUnhealthyMs ?? 3e5;
+	if (!deps.allowUnverifiedOperatorPermission) {
+		for (const [label, gate] of [["view", view], ["replay", replay]]) if (!gate._platformOnly) throw new Error(`[arc/outbox-admin] permissions.${label} must be platform-only. These routes are global (an outbox row carries no tenant identity and getDeadLettered takes no filter), so an org-role gate would let a member of one organization read another's failed events and their payloads. Use requirePlatformRole('platform-ops') — or requireRoles([...], { includeOrgRoles: false }) with allowUnverifiedOperatorPermission: true if you have verified the check yourself.`);
+	}
+	const resource = defineResource({
+		name: moduleName,
+		displayName: "Outbox Admin",
+		tag: "Operations",
+		prefix: deps.prefix ?? "/admin/outbox",
+		customRoutesOnly: true,
+		routes: [
+			{
+				method: "GET",
+				path: "/health",
+				summary: "Outbox health — pending, dead-letter and relay lag",
+				permissions: view,
+				rawHandler: async (_req, reply) => {
+					const [pending, deadLetter, relayLagMs] = await Promise.all([
+						deps.store.countByStatus("pending"),
+						deps.store.countByStatus("dead_letter"),
+						deps.store.oldestPendingAgeMs()
+					]);
+					const healthy = deadLetter === 0 && (relayLagMs === null || relayLagMs < lagUnhealthyMs);
+					return reply.send({
+						pending,
+						deadLetter,
+						relayLagMs,
+						healthy
+					});
+				}
+			},
+			{
+				method: "GET",
+				path: "/dead-letter",
+				summary: "List dead-lettered events with their errors",
+				permissions: view,
+				rawHandler: async (req, reply) => {
+					const raw = req.query?.limit;
+					const parsed = Number(raw ?? 100);
+					const limit = Math.min(Math.max(Number.isFinite(parsed) ? parsed : 100, 1), maxLimit);
+					const events = await deps.store.getDeadLettered(limit);
+					return reply.send({
+						count: events.length,
+						limit,
+						events: events.map((e) => redactDeadLettered(e, deps))
+					});
+				}
+			},
+			{
+				method: "POST",
+				path: "/dead-letter/:id/replay",
+				summary: "Requeue a dead-lettered event and drain the relay",
+				permissions: replay,
+				rawHandler: async (req, reply) => {
+					const eventId = req.params?.id;
+					if (!eventId) throw new ValidationError("event id is required");
+					if (!await deps.store.requeue(eventId)) throw new NotFoundError(`Dead-lettered event "${eventId}" — not found, or not currently dead-lettered`);
+					const { relay } = getModuleExports(req.server, outboxModuleName);
+					const relayDelivered = await relay.relay();
+					return reply.send({
+						eventId,
+						requeued: true,
+						relayDelivered,
+						note: "relayDelivered counts the entire drained batch, not this event alone"
+					});
+				}
+			}
+		]
+	});
+	return defineModule({
+		name: moduleName,
+		dependsOn: [outboxModuleName],
+		...deps.owns ? { owns: [...deps.owns] } : {},
+		resources: () => [resource]
+	});
+}
+//#endregion
+export { createOutboxAdminModule };

package/dist/permissions/index.d.mts

@@ -1,4 +1,5 @@
-import { a as UserBase, c as normalizeRoles, i as PermissionContext, n as DataPolicy, r as PermissionCheck, s as getUserRoles, t as AuthorizationDecision } from "../types-ChvvVNP8.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-D3lhgzhD.mjs";
-import { $ as evaluatePermissionDecision, A as explainAccess, B as anyOf, C as requireGrant, D as collectPublicSurface, E as PermissionRequirement, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as when, K as requireRoles, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, O as describePermission, P as PermissionEventBus, Q as applyPermissionResult, R as allow, S as modeSatisfies, T as AccessExplanation, U as not, V as deny, W as requireAuth, X as PermissionCheckReturn, Y as scopeOf, Z as applyAuthorizationDecision, _ as createRoleHierarchy, a as permissionMatrix, at as requireMandate, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, et as normalizeToDecision, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, it as requireDPoP, j as ConnectEventsOptions, k as describePermissionMap, l as readOnly, m as requireServiceScope, n as authenticated, nt as RequireMandateOptions, o as presets_d_exports, p as requireScopeContext, q as roles, r as fullPublic, rt as requireAgentScope, s as publicRead, t as adminOnly, tt as RequireAgentScopeOptions, u as requireOrgInScope, v as GRANT_MODES, w as conjoinPolicyFilters, x as RequireGrantOptions, y as GrantMode, z as allowPublic } from "../index-Ch16aAah.mjs";
-export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEventBus, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };
+
+import { a as UserBase, c as normalizeRoles, i as PermissionContext, n as DataPolicy, r as PermissionCheck, s as getUserRoles, t as AuthorizationDecision } from "../types-B7XeLEgK.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-zq6VrjaB.mjs";
+export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,5 +1,6 @@
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { a as normalizeToDecision, i as evaluatePermissionDecision, n as applyPermissionResult, o as conjoinPolicyFilters, t as applyAuthorizationDecision } from "../applyPermissionResult-Cf6zUCvb.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CQ_7KQWw.mjs";
-import { A as allow, B as when, C as requireScopeContext, D as requireDPoP, E as requireAgentScope, F as not, I as requireAuth, L as requireOwnership, M as anyOf, N as deny, O as requireMandate, P as denyAll, R as requireRoles, S as requireOrgRole, T as requireTeamMembership, V as scopeOf, _ as explainAccess, a as permissionMatrix, b as requireOrgInScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as describePermissionMap, h as describePermission, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, m as collectPublicSurface, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions, z as roles } from "../permissions-Bfu_8y1U.mjs";
-export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-__T3EJDA.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-BNsOXzOd.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-DEi65pGj.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-Dl_m0NCe.mjs";
+export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };