@classytic/arc 2.31.0 → 2.32.0

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-Cj42AntO.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-PSZwi8JV.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-Bh1KK5ps.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DPZdQmDz.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**

package/dist/integrations/webhooks.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/integrations/webhooks.ts

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";
@@ -334,19 +334,21 @@ var MemoryPushRefStore = class {
 	}
 	async claim(args) {
 		const existing = this.entries.get(args.pushRef);
-		if (existing) if (!existing.active && existing.expiresAt <= args.now) this.entries.delete(args.pushRef);
-		else {
-			if (existing.principal !== args.principal) return { outcome: "rejected" };
-			const supersededActive = existing.active === true;
-			existing.active = true;
-			existing.expiresAt = args.now + args.ttlMs;
-			existing.generation = (existing.generation ?? 0) + 1;
-			this.entries.set(args.pushRef, existing);
-			return {
-				outcome: "resumed",
-				entry: existing,
-				supersededActive
-			};
+		if (existing) {
+			if (!existing.active && existing.expiresAt <= args.now) this.entries.delete(args.pushRef);
+			else {
+				if (existing.principal !== args.principal) return { outcome: "rejected" };
+				const supersededActive = existing.active === true;
+				existing.active = true;
+				existing.expiresAt = args.now + args.ttlMs;
+				existing.generation = (existing.generation ?? 0) + 1;
+				this.entries.set(args.pushRef, existing);
+				return {
+					outcome: "resumed",
+					entry: existing,
+					supersededActive
+				};
+			}
 		}
 		if (this.entries.size >= args.maxEntries && !this.evictOldestInactive()) return { outcome: "rejected" };
 		const fresh = args.mintFresh();
@@ -1053,9 +1055,7 @@ async function handleConnection(ctx, socket, request) {
 				}));
 				break;
 			}
-			default:
-				await options.onMessage?.(client, msg);
-				break;
+			default: await options.onMessage?.(client, msg);
 		}
 	});
 	socket.on("close", async () => {
@@ -1137,10 +1137,12 @@ function registerStatsRoute(fastify, rooms, path, expose) {
 		fastify.get(`${path}/stats`, async () => rooms.getStats());
 		return;
 	}
-	if (expose === "authenticated") if (fastify.hasDecorator("authenticate")) {
-		const authenticate = fastify.authenticate;
-		fastify.get(`${path}/stats`, { preHandler: authenticate }, async () => rooms.getStats());
-	} else fastify.log.warn("arc-websocket: exposeStats is \"authenticated\" but fastify.authenticate is not registered — stats endpoint skipped");
+	if (expose === "authenticated") {
+		if (fastify.hasDecorator("authenticate")) {
+			const authenticate = fastify.authenticate;
+			fastify.get(`${path}/stats`, { preHandler: authenticate }, async () => rooms.getStats());
+		} else fastify.log.warn("arc-websocket: exposeStats is \"authenticated\" but fastify.authenticate is not registered — stats endpoint skipped");
+	}
 }
 //#endregion
 //#region src/integrations/websocket/outbound-truncate.ts
@@ -1164,7 +1166,7 @@ function registerStatsRoute(fastify, rooms, path, expose) {
 *     instance, eliminating module state.
 */
 /** 5 MiB default — same as n8n's `relayViaPubSub` ceiling. */
-const DEFAULT_MAX_OUTBOUND_BYTES = 5 * 1024 * 1024;
+const DEFAULT_MAX_OUTBOUND_BYTES = 5242880;
 /**
 * Returns either the original payload (when within `max`) or a
 * placeholder JSON string (when oversize). The placeholder carries the
@@ -1207,7 +1209,7 @@ function createTruncator(max = DEFAULT_MAX_OUTBOUND_BYTES) {
 * other instances fan out to their local sockets.
 */
 /** Drop fan-out to a client whose outbound buffer exceeds this threshold. */
-const WS_BACKPRESSURE_LIMIT = 256 * 1024;
+const WS_BACKPRESSURE_LIMIT = 262144;
 var RoomManager = class {
 	rooms = /* @__PURE__ */ new Map();
 	clients = /* @__PURE__ */ new Map();
@@ -1426,18 +1428,19 @@ var RoomManager = class {
 		if (client.socket.readyState !== 1) return false;
 		const queue = client.queue;
 		if (queue) {
-			if (cls === "critical") if (client.envelope) try {
-				const parsed = JSON.parse(message);
-				queue.send(client.envelope.wrap(parsed));
-				if (this.registry) safeAsync(this.registry.persist(client.pushRef, client.generation), this.logger, "registry.persist", {
-					pushRef: client.pushRef,
-					generation: client.generation
-				});
-			} catch {
-				queue.send(message);
-			}
-			else queue.send(message);
-			else queue.sendRealtime(message, coalesceKey);
+			if (cls === "critical") {
+				if (client.envelope) try {
+					const parsed = JSON.parse(message);
+					queue.send(client.envelope.wrap(parsed));
+					if (this.registry) safeAsync(this.registry.persist(client.pushRef, client.generation), this.logger, "registry.persist", {
+						pushRef: client.pushRef,
+						generation: client.generation
+					});
+				} catch {
+					queue.send(message);
+				}
+				else queue.send(message);
+			} else queue.sendRealtime(message, coalesceKey);
 			return true;
 		}
 		if ((client.socket.bufferedAmount ?? 0) > WS_BACKPRESSURE_LIMIT) return false;

package/dist/{interface-DYzM0q-u.mjs → interface-BP4IJCBO.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-BYbLDi5D.mjs → jsonBody-DDSR2HFl.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-Cj42AntO.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-Bh1KK5ps.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-C0_pa1tY.mjs → keys-B-HBTGXl.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-yawi9tAE.mjs → loadResources-DisEAmkm.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
@@ -61,7 +61,8 @@ var loadResources_exports = /* @__PURE__ */ __exportAll({ loadResources: () => l
 */
 async function loadResources(dir, options = {}) {
 	const { suffix = ".resource", recursive = true, exclude, include, filter } = options;
-	const absDir = resolve(dir.startsWith("file://") ? dirname(fileURLToPath(dir)) : dir);
+	const resolvedDir = dir.startsWith("file://") ? dirname(fileURLToPath(dir)) : dir;
+	const absDir = resolve(resolvedDir);
 	const discovered = await collectFiles(absDir, new RegExp(`${escapeRegex(suffix)}\\.(ts|js|mts|mjs)$`), recursive);
 	discovered.sort();
 	const files = filter ? discovered.filter((f) => filter(f)) : discovered;

package/dist/{loadResourcesFromEntry-BAjYZonx.mjs → loadResourcesFromEntry-D1MJp13f.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-qq0mn2s9.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-BVr7PgA0.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/logger/index.ts
 let globalOptions = {};
 /**

package/dist/{mcpPlugin-B_es0hiF.mjs → mcpPlugin-CpfVpKHE.mjs}

@@ -1,19 +1,19 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-ChvUQGG1.mjs";
-import { p as isArcError, t as ArcError } from "./errors-Cj42AntO.mjs";
-import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-Cys0ko9Z.mjs";
-import { t as BaseController } from "./BaseController-De7GqHck.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
-import { t as executePipeline } from "./pipe-DRDNsI2T.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-UPQFatit.mjs";
-import { n as validateAggregations } from "./validate-_KbifpHF.mjs";
-import { n as executeAggregation } from "./buildHandler-CDrCJzmB.mjs";
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
-import { t as createIdempotencyResult } from "./interface-DYzM0q-u.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Bm2enbnh.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-__T3EJDA.mjs";
+import { p as isArcError, t as ArcError } from "./errors-Bh1KK5ps.mjs";
+import { n as requireSingleHeaderValue } from "./headers-BXjQYbeC.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-DXYX7dIR.mjs";
+import { t as BaseController } from "./BaseController-Dk34dxhI.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { t as executePipeline } from "./pipe-ELHCP3zj.mjs";
+import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-CPA-jx0M.mjs";
+import { n as validateAggregations } from "./validate-PMCPR9El.mjs";
+import { n as executeAggregation } from "./buildHandler-Dn7rzUJo.mjs";
+import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
+import { t as createIdempotencyResult } from "./interface-BP4IJCBO.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CnyKK_1j.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -367,12 +367,13 @@ function buildScope(auth) {
 */
 async function evaluatePermission(check, session, resource, action, input) {
 	if (!check) return null;
+	const user = session ? {
+		id: session.userId,
+		_id: session.userId,
+		...session
+	} : null;
 	return evaluatePermissionDecision(check, {
-		user: session ? {
-			id: session.userId,
-			_id: session.userId,
-			...session
-		} : null,
+		user,
 		scope: buildScope(session),
 		resource,
 		action,
@@ -465,13 +466,14 @@ function toCallToolSuccess(value) {
 */
 function toCallToolError(input) {
 	let contract;
-	if (input instanceof Error) if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
-	else contract = {
-		code: "arc.internal_error",
-		message: input.message || "Internal Server Error",
-		status: 500
-	};
-	else contract = {
+	if (input instanceof Error) {
+		if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
+		else contract = {
+			code: "arc.internal_error",
+			message: input.message || "Internal Server Error",
+			status: 500
+		};
+	} else contract = {
 		code: input.code,
 		message: input.message,
 		...input.status !== void 0 ? { status: input.status } : {},
@@ -588,7 +590,7 @@ function invocationFingerprint(resourceName, actionName, input, session) {
 	return `mcp:${resourceName}:${actionName}:${createHash("sha256").update(JSON.stringify(sortKeys(input))).digest("hex").substring(0, 16)}:u=${session?.userId ?? session?.clientId ?? "anon"}`;
 }
 /** TTLs matching the HTTP idempotency plugin's defaults. */
-const MCP_IDEMPOTENCY_TTL_MS = 1440 * 60 * 1e3;
+const MCP_IDEMPOTENCY_TTL_MS = 864e5;
 const MCP_IDEMPOTENCY_LOCK_MS = 1e4;
 /**
 * Invoke a controller method through the MCP synthetic-context path.
@@ -1434,7 +1436,6 @@ function jsonSchemaPropertyToZod(prop) {
 		case "array": return applyDescription(arrayToZod(prop), prop);
 		case "object": return applyDescription(objectToZod(prop), prop);
 		case "null": continue;
-		default: break;
 	}
 	return applyDescription(z.unknown(), prop);
 }
@@ -2061,7 +2062,7 @@ function getOps(r, override) {
 }
 //#endregion
 //#region src/integrations/mcp/sessionCache.ts
-const DEFAULT_TTL_MS = 1800 * 1e3;
+const DEFAULT_TTL_MS = 18e5;
 const DEFAULT_MAX_SESSIONS = 1e3;
 var McpSessionCache = class {
 	sessions = /* @__PURE__ */ new Map();

package/dist/{memory-DR6wpa9F.mjs → memory-DsuWnj4T.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**
@@ -26,11 +26,11 @@ var MemoryCacheStore = class {
 	constructor(options = {}) {
 		this.defaultTtlSeconds = options.defaultTtlSeconds ?? 60;
 		this.maxEntries = clamp(options.maxEntries ?? 1e3, 1, 1e5);
-		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 256 * 1024, 1024, 10 * 1024 * 1024);
-		this.maxMemoryBytes = options.maxMemoryBytes ?? 50 * 1024 * 1024;
+		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 262144, 1024, 10485760);
+		this.maxMemoryBytes = options.maxMemoryBytes ?? 52428800;
 		this.evictionWatermark = clamp(options.evictionWatermark ?? .9, .5, 1);
 		this.logger = options.logger ?? console;
-		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 600 * 1e3);
+		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 6e5);
 		this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
 		if (this.cleanupTimer.unref) this.cleanupTimer.unref();
 	}

package/dist/{metrics-CUdw_wLB.mjs → metrics-DdQL8syd.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
-import { t as multipartBody } from "../multipartBody-wOgj_fnj.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-J99LGTJI.mjs";
+import { t as multipartBody } from "../multipartBody-BnkBLN7v.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-Dll8mGgc.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-BpP9wwj7.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -88,7 +88,7 @@ var MongoMigrationStore = class {
 	}
 };
 const MIGRATION_LOCK_NAME = "arc:migrations";
-const DEFAULT_LOCK_LEASE_MS = 600 * 1e3;
+const DEFAULT_LOCK_LEASE_MS = 6e5;
 /**
 * Source checksum for drift detection — SHA-256 over the migration's
 * `up`/`down` source. Stable for a given build; a transpile-target change

package/dist/{module-0pFJA6YW.mjs → module-Br81am6m.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-wOgj_fnj.mjs → multipartBody-BnkBLN7v.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
-const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_FILE_SIZE = 10485760;
 const DEFAULT_MAX_FILES = 5;
-const DEFAULT_MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+const DEFAULT_MAX_TOTAL_BYTES = 26214400;
 const DEFAULT_FILES_KEY = "_files";
 /**
 * Build a matcher for MIME allow-lists that supports exact (e.g. `image/png`),

package/dist/{openapi-B2L4js1v.mjs → openapi-DIRzvxC0.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-D--wdJM-.mjs";
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-CDXEdasl.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-Crjvczi_.mjs";
+import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-Dti7ebyv.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-DkJZWo0m.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -0,0 +1,85 @@
+
+import { r as PermissionCheck } from "../types-B7XeLEgK.mjs";
+import { t as ArcModule } from "../types-CT5vu6M0.mjs";
+import { OutboxStore } from "@classytic/primitives/outbox";
+//#region src/outbox-admin/module.d.ts
+/**
+ * A store that can answer an operator's questions.
+ *
+ * Only the four reads this surface actually performs are required — `fail` and
+ * `purge` belong to the relay and retention, not here.
+ */
+type OutboxAdminStore = OutboxStore & Required<Pick<OutboxStore, "getDeadLettered" | "requeue" | "countByStatus" | "oldestPendingAgeMs">>;
+interface OutboxAdminPermissions {
+  /**
+   * Reading health and the dead-letter list.
+   *
+   * MUST be platform-only — see `allowUnverifiedOperatorPermission`.
+   */
+  view: PermissionCheck;
+  /**
+   * Replaying a dead-lettered event. Defaults to `view` when omitted — but
+   * replay RE-DELIVERS an event that already failed five times, so a
+   * deployment that separates read access from operational action should gate
+   * it distinctly. Also platform-only.
+   */
+  replay?: PermissionCheck;
+}
+interface OutboxAdminModuleDeps {
+  store: OutboxAdminStore;
+  permissions: OutboxAdminPermissions;
+  /** Route prefix. Default `/admin/outbox`. */
+  prefix?: string;
+  /** Module name. Default `outbox-admin`. */
+  moduleName?: string;
+  /**
+   * Name the outbox module was composed under, used to resolve the relay and
+   * declared as a `dependsOn` edge. Default `outbox`.
+   */
+  outboxModuleName?: string;
+  /** Resource names this module supersedes. */
+  owns?: readonly string[];
+  /** Cap on `?limit`. Default 500 — a dead-letter list is for triage, not export. */
+  maxDeadLetterLimit?: number;
+  /**
+   * Accept gates arc cannot prove are platform-only.
+   *
+   * By default both gates must carry `_platformOnly` (i.e. come from
+   * `requirePlatformRole`), and boot FAILS otherwise. The reason is the same
+   * one that hardened `integrations/jobs` in 2.31: these routes are global by
+   * construction. `getDeadLettered(limit)` takes no filter and an outbox row
+   * carries no tenant identity, so there is nothing to scope by. A gate that
+   * grants per organization therefore READS as scoped while serving everyone —
+   * `requireOrgRole('manager')` would let org A's manager read org B's failed
+   * events. Neither returns a policy, so no per-request check can tell a real
+   * operator gate from an org one.
+   *
+   * Set this only for a custom check you have verified consults platform
+   * identity alone.
+   */
+  allowUnverifiedOperatorPermission?: boolean;
+  /**
+   * Include each dead-lettered event's domain PAYLOAD in the listing.
+   * Default `false`.
+   *
+   * The payload is the original event body — in an ERP that is order totals,
+   * customer records and payment references. Triage needs the id, the event
+   * name, the attempt count and why it failed; it does not need the contents.
+   * Opt in only where the surface is genuinely platform-operator-only and you
+   * accept that the response carries business data.
+   */
+  exposePayload?: boolean;
+  /**
+   * Include the failure STACK TRACE alongside the error message.
+   * Default `false` — a stack names internal paths and framework versions.
+   */
+  exposeStack?: boolean;
+  /**
+   * Pending-event age (ms) past which the outbox reports unhealthy even with an
+   * empty dead-letter queue. Default 5 minutes.
+   */
+  relayLagUnhealthyMs?: number;
+}
+declare function createOutboxAdminModule(deps: OutboxAdminModuleDeps): ArcModule<void>;
+//#endregion
+export { type OutboxAdminModuleDeps, type OutboxAdminPermissions, type OutboxAdminStore, createOutboxAdminModule };

package/dist/outbox-admin/index.mjs

@@ -0,0 +1,115 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Bh1KK5ps.mjs";
+import { t as defineResource } from "../defineResource-XFPPUu2c.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-Br81am6m.mjs";
+//#region src/outbox-admin/module.ts
+/**
+* Strip the domain payload and the stack unless explicitly opted in.
+*
+* Triage is answered by WHICH event failed, HOW MANY times, WHEN and WHY. The
+* payload answers none of those and carries the business record; the stack
+* names internal paths. Both are off by default, on the same reasoning that
+* made `exposeResult` / `exposeFailureReason` opt-in for jobs.
+*/
+function redactDeadLettered(e, opts) {
+	return {
+		event: {
+			type: e.event.type,
+			meta: e.event.meta,
+			...opts.exposePayload ? { payload: e.event.payload } : {}
+		},
+		error: {
+			message: e.error.message,
+			...e.error.code !== void 0 ? { code: e.error.code } : {},
+			...opts.exposeStack && e.error.stack !== void 0 ? { stack: e.error.stack } : {}
+		},
+		attempts: e.attempts,
+		firstFailedAt: e.firstFailedAt,
+		lastFailedAt: e.lastFailedAt,
+		...e.handlerName !== void 0 ? { handlerName: e.handlerName } : {}
+	};
+}
+function createOutboxAdminModule(deps) {
+	const moduleName = deps.moduleName ?? "outbox-admin";
+	const outboxModuleName = deps.outboxModuleName ?? "outbox";
+	const maxLimit = deps.maxDeadLetterLimit ?? 500;
+	const view = deps.permissions.view;
+	const replay = deps.permissions.replay ?? deps.permissions.view;
+	const lagUnhealthyMs = deps.relayLagUnhealthyMs ?? 3e5;
+	if (!deps.allowUnverifiedOperatorPermission) {
+		for (const [label, gate] of [["view", view], ["replay", replay]]) if (!gate._platformOnly) throw new Error(`[arc/outbox-admin] permissions.${label} must be platform-only. These routes are global (an outbox row carries no tenant identity and getDeadLettered takes no filter), so an org-role gate would let a member of one organization read another's failed events and their payloads. Use requirePlatformRole('platform-ops') — or requireRoles([...], { includeOrgRoles: false }) with allowUnverifiedOperatorPermission: true if you have verified the check yourself.`);
+	}
+	const resource = defineResource({
+		name: moduleName,
+		displayName: "Outbox Admin",
+		tag: "Operations",
+		prefix: deps.prefix ?? "/admin/outbox",
+		customRoutesOnly: true,
+		routes: [
+			{
+				method: "GET",
+				path: "/health",
+				summary: "Outbox health — pending, dead-letter and relay lag",
+				permissions: view,
+				rawHandler: async (_req, reply) => {
+					const [pending, deadLetter, relayLagMs] = await Promise.all([
+						deps.store.countByStatus("pending"),
+						deps.store.countByStatus("dead_letter"),
+						deps.store.oldestPendingAgeMs()
+					]);
+					const healthy = deadLetter === 0 && (relayLagMs === null || relayLagMs < lagUnhealthyMs);
+					return reply.send({
+						pending,
+						deadLetter,
+						relayLagMs,
+						healthy
+					});
+				}
+			},
+			{
+				method: "GET",
+				path: "/dead-letter",
+				summary: "List dead-lettered events with their errors",
+				permissions: view,
+				rawHandler: async (req, reply) => {
+					const raw = req.query?.limit;
+					const parsed = Number(raw ?? 100);
+					const limit = Math.min(Math.max(Number.isFinite(parsed) ? parsed : 100, 1), maxLimit);
+					const events = await deps.store.getDeadLettered(limit);
+					return reply.send({
+						count: events.length,
+						limit,
+						events: events.map((e) => redactDeadLettered(e, deps))
+					});
+				}
+			},
+			{
+				method: "POST",
+				path: "/dead-letter/:id/replay",
+				summary: "Requeue a dead-lettered event and drain the relay",
+				permissions: replay,
+				rawHandler: async (req, reply) => {
+					const eventId = req.params?.id;
+					if (!eventId) throw new ValidationError("event id is required");
+					if (!await deps.store.requeue(eventId)) throw new NotFoundError(`Dead-lettered event "${eventId}" — not found, or not currently dead-lettered`);
+					const { relay } = getModuleExports(req.server, outboxModuleName);
+					const relayDelivered = await relay.relay();
+					return reply.send({
+						eventId,
+						requeued: true,
+						relayDelivered,
+						note: "relayDelivered counts the entire drained batch, not this event alone"
+					});
+				}
+			}
+		]
+	});
+	return defineModule({
+		name: moduleName,
+		dependsOn: [outboxModuleName],
+		...deps.owns ? { owns: [...deps.owns] } : {},
+		resources: () => [resource]
+	});
+}
+//#endregion
+export { createOutboxAdminModule };

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
 import { a as UserBase, c as normalizeRoles, i as PermissionContext, n as DataPolicy, r as PermissionCheck, s as getUserRoles, t as AuthorizationDecision } from "../types-B7XeLEgK.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as evaluatePermissionDecision, A as explainAccess, B as anyOf, C as requireGrant, D as collectPublicSurface, E as PermissionRequirement, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as roles, K as requirePlatformRole, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, O as describePermission, P as PermissionEventBus, Q as applyAuthorizationDecision, R as allow, S as modeSatisfies, T as AccessExplanation, U as not, V as deny, W as requireAuth, X as scopeOf, Y as when, Z as PermissionCheckReturn, _ as createRoleHierarchy, a as permissionMatrix, at as requireMandate, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, et as normalizeToDecision, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, it as requireDPoP, j as ConnectEventsOptions, k as describePermissionMap, l as readOnly, m as requireServiceScope, n as authenticated, nt as RequireMandateOptions, o as presets_d_exports, p as requireScopeContext, q as requireRoles, r as fullPublic, rt as requireAgentScope, s as publicRead, t as adminOnly, tt as RequireAgentScopeOptions, u as requireOrgInScope, v as GRANT_MODES, w as conjoinPolicyFilters, x as RequireGrantOptions, y as GrantMode, z as allowPublic } from "../index-CEJNZFtX.mjs";
-export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEventBus, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-zq6VrjaB.mjs";
+export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };