@classytic/arc 2.31.0 → 2.33.0

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,3 +1,3 @@
 
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-qN6A-RFv.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-mwLWlfHG.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis-stream-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis-stream.ts
 /**
@@ -184,13 +184,15 @@ var RedisStreamTransport = class {
 		this.handlers.clear();
 		this.failureContext.clear();
 		if (this.pollPromise) {
-			if (await Promise.race([this.pollPromise.then(() => "drained"), this.sleep(this.closeTimeoutMs).then(() => "timeout")]) === "timeout") if (!this.externalLifecycle) {
-				if (typeof this.redis.disconnect === "function") this.redis.disconnect();
-				else await this.redis.quit().catch((err) => {
-					this.logger.error("[RedisStreamTransport] quit() during close raced:", err);
-				});
-				await this.pollPromise.catch(() => void 0);
-			} else this.pollPromise.catch(() => void 0);
+			if (await Promise.race([this.pollPromise.then(() => "drained"), this.sleep(this.closeTimeoutMs).then(() => "timeout")]) === "timeout") {
+				if (!this.externalLifecycle) {
+					if (typeof this.redis.disconnect === "function") this.redis.disconnect();
+					else await this.redis.quit().catch((err) => {
+						this.logger.error("[RedisStreamTransport] quit() during close raced:", err);
+					});
+					await this.pollPromise.catch(() => void 0);
+				} else this.pollPromise.catch(() => void 0);
+			}
 			this.pollPromise = null;
 		}
 		if (!this.externalLifecycle) await this.redis.quit().catch(() => void 0);
@@ -251,8 +253,10 @@ var RedisStreamTransport = class {
 			const overRetryIds = [];
 			for (const entry of pending) {
 				const [id, , idleTime, deliveryCount] = entry;
-				if (idleTime > this.claimTimeoutMs) if (deliveryCount >= this.maxRetries) overRetryIds.push(id);
-				else staleIds.push(id);
+				if (idleTime > this.claimTimeoutMs) {
+					if (deliveryCount >= this.maxRetries) overRetryIds.push(id);
+					else staleIds.push(id);
+				}
 			}
 			if (overRetryIds.length > 0) await this.moveToDlq(overRetryIds);
 			if (staleIds.length > 0) {

package/dist/events/transports/redis.d.mts

@@ -1,5 +1,5 @@
 
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-2uVV34WU.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-BEVP50ka.mjs";
 //#region src/events/transports/redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/events/transports/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis.ts
 /**

package/dist/factory/index.d.mts

@@ -1,10 +1,25 @@
 
-import { a as ModuleContribution, c as ResourceModule, h as HealthCheck, i as EventHandlerDefinition, l as loadResources, n as ArcModuleInput, o as LoadResourcesOptions, r as ArcModuleRegistry, s as ResourceLike, t as ArcModule } from "../types-CBgvkp8O.mjs";
-import { a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleWorkflows, h as collectModuleScheduledJobs, i as hasModuleExports, l as hasModule, m as collectModuleHealthChecks, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution } from "../index-CFThn1K9.mjs";
-import "../fastify-augmentation-zh0_AYHa.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-CyoJMSiO.mjs";
+import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-BcTumAz_.mjs";
+import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-C5NnMEKF.mjs";
+import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-DVsTAy6X.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-g07ldtzh.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
+/**
+ * Default redact paths layered into Fastify's pino logger when the host
+ * doesn't supply a `logger.redact` of their own. Covers the common token /
+ * cookie / password leak surfaces — `Authorization` and `Cookie` headers
+ * (and their case-variants because Node lower-cases incoming headers but
+ * outgoing logs may carry either), API-key headers, and any nested
+ * `password` / `token` / `secret` / `apiKey` fields anywhere in the log
+ * tree.
+ *
+ * Hosts that need NO redaction (test fixtures, security audits) opt out
+ * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
+ * their own `redact` and arc steps aside — this default never overrides
+ * an explicit setting. (2.15.1)
+ */
+declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
 /**
  * Create a production-ready Fastify application with Arc framework.
  *
@@ -137,4 +152,4 @@ declare const testingPreset: Partial<CreateAppOptions>;
 declare const edgePreset: Partial<CreateAppOptions>;
 declare function getPreset(name: "production" | "development" | "testing" | "edge" | "worker"): Partial<CreateAppOptions>;
 //#endregion
-export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcWorker, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CreateWorkerOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type EventHandlerDefinition, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type ModuleContribution, type ModuleState, type MultipartOptions, type RawBodyOptions, type ResourceLike, type ResourceModule, type UnderPressureOptions, type WorkerHealthOptions, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, developmentPreset, edgePreset, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcWorker, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CreateWorkerOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, DEFAULT_LOGGER_REDACT_PATHS, type EventHandlerDefinition, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type ModuleContribution, type ModuleDisposer, type ModuleExtension, type ModuleSetupContext, type ModuleState, type MultipartOptions, type RawBodyOptions, type ResolvedModuleDescriptor, type ResolvedModuleLifecycle, type ResolvedResourceDescriptor, type ResourceLike, type ResourceModule, type UnderPressureOptions, type WorkerHealthOptions, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };

package/dist/factory/index.mjs

@@ -1,9 +1,131 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-DjZYjM7H.mjs";
-import { _ as resolveContribution, a as edgePreset, c as testingPreset, d as hasModule, f as orderModules, g as collectModuleWorkflows, h as collectModuleScheduledJobs, i as developmentPreset, l as workerPreset, m as collectModuleHealthChecks, n as createApp, o as getPreset, p as subscribeModuleEventHandlers, s as productionPreset, t as ArcFactory, u as getModuleState, v as resolveModule } from "../createApp-Df89BEni.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-0pFJA6YW.mjs";
-import { t as loadResources } from "../loadResources-yawi9tAE.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-Dz6BjzM6.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-CasG2A28.mjs";
+import { _ as collectModuleScheduledJobs, a as developmentPreset, b as resolveModule, c as productionPreset, d as getModuleState, f as hasModule, g as collectModuleHealthChecks, h as describeResolvedModule, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as orderModules, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset, v as collectModuleWorkflows, y as resolveContribution } from "../createApp-CLGegqiG.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
+import { t as loadResources } from "../loadResources-Bj-aSsXi.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BkyqeTDz.mjs";
+//#region src/factory/module/extend.ts
+/** Concatenate two contributions, resolving factories only when arc asks. */
+function mergeContribution(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	return async (fastify) => {
+		const a = typeof own === "function" ? await own(fastify) : own;
+		const b = typeof extra === "function" ? await extra(fastify) : extra;
+		return [...a, ...b];
+	};
+}
+/**
+* Plain-array concat, for the arms that are NOT `ModuleContribution`.
+*
+* `healthChecks` and `errorMappers` are declared as arrays only — arc reads
+* them directly and never calls them. Routing them through the factory merge
+* above would hand arc a function where it expects a list, which does not fail
+* loudly: the arm reads as non-empty and contributes nothing.
+*/
+function mergeArray(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	return [...own, ...extra];
+}
+/** Order-preserving union — a duplicate edge or claim is not an error. */
+function mergeNames(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	return [.../* @__PURE__ */ new Set([...own, ...extra])];
+}
+function mergeOwns(own, extra) {
+	if (own === "provided" || extra === "provided") return "provided";
+	return mergeNames(own, extra);
+}
+/**
+* Run both lifecycle hooks, module's first, composing whatever disposers they
+* return. Teardown runs in REVERSE, matching arc's own module teardown order.
+*/
+function mergeHook(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	return async (fastify, context) => {
+		const d1 = await own(fastify, context);
+		const d2 = await extra(fastify, context);
+		if (!d1 && !d2) return void 0;
+		const disposer = async () => {
+			if (d2) await d2();
+			if (d1) await d1();
+		};
+		return disposer;
+	};
+}
+/**
+* Close the MODULE first, then the host — the opposite of the disposer order
+* above, and deliberately so.
+*
+* A disposer pair is symmetric setup/teardown, so it unwinds LIFO. `onClose` is
+* not: the resource whose lifetime encloses everything is usually the ENGINE,
+* and in a bring-your-own-engine composition the HOST owns it and hands it to
+* the module. Running the host's `onClose` first would destroy the engine while
+* the module is still draining work against it.
+*
+* be-prod's planning module states exactly this order in prose and implements
+* it by hand — "the module's own onClose first (drains its built-in inFlight),
+* then our host-side fallback inFlight, then destroy the BYO engine". Encoding
+* it here is what stops the next host from getting it backwards.
+*/
+function mergeOnClose(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	return async (fastify) => {
+		await own(fastify);
+		await extra(fastify);
+	};
+}
+/**
+* Merge a host's additions onto a module. Nothing the module declared is lost.
+*
+* ```ts
+* return extendModule(createOrderModule({ … }), {
+*   eventHandlers: () => hostHandlers(),      // appended after the module's
+*   dependsOn: ["outbox"],                    // unioned
+*   bootstrap: (inner) => async (f, c) => {   // wraps, never replaces
+*     const exports = await inner?.(f, c);
+*     return decorate(exports);
+*   },
+* });
+* ```
+*/
+function extendModule(mod, extension) {
+	const out = { ...mod };
+	/**
+	* Assign only when the merge produced something.
+	*
+	* An absent arm must stay ABSENT rather than become `[]` or `undefined` —
+	* arc distinguishes "contributes nothing" from "contributes an empty list"
+	* when deciding whether a module participates in an arm at all.
+	*
+	* Each merge is therefore evaluated ONCE, into this call. Writing the
+	* condition and the value as two separate calls would leave twelve pairs of
+	* duplicated expressions, where editing one half and not the other changes
+	* nothing visible and produces a module whose arm silently disagrees with the
+	* check that decided to set it.
+	*/
+	const set = (key, value) => {
+		if (value !== void 0) out[key] = value;
+	};
+	set("dependsOn", mergeNames(mod.dependsOn, extension.dependsOn));
+	set("owns", mergeOwns(mod.owns, extension.owns));
+	set("resources", mergeContribution(mod.resources, extension.resources));
+	set("eventHandlers", mergeContribution(mod.eventHandlers, extension.eventHandlers));
+	set("scheduledJobs", mergeContribution(mod.scheduledJobs, extension.scheduledJobs));
+	set("workflows", mergeContribution(mod.workflows, extension.workflows));
+	set("healthChecks", mergeArray(mod.healthChecks, extension.healthChecks));
+	set("errorMappers", mergeArray(mod.errorMappers, extension.errorMappers));
+	set("plugins", mergeHook(mod.plugins, extension.plugins));
+	set("afterResources", mergeHook(mod.afterResources, extension.afterResources));
+	set("onClose", mergeOnClose(mod.onClose, extension.onClose));
+	if (extension.bootstrap) out.bootstrap = extension.bootstrap(mod.bootstrap);
+	return out;
+}
+//#endregion
 //#region src/factory/createWorker.ts
 async function createWorker(options, workerOptions = {}) {
 	const { auth: _auth, helmet: _helmet, cors: _cors, rateLimit: _rateLimit, multipart: _multipart, rawBody: _rawBody, sensible: _sensible, underPressure: _underPressure, replyHelpers: _replyHelpers, ...runtimeOptions } = options;
@@ -20,10 +142,11 @@ async function createWorker(options, workerOptions = {}) {
 	});
 	if (workerOptions.health) {
 		const { port, host = "0.0.0.0", checks = [] } = workerOptions.health;
+		const moduleChecks = app.arc?.healthChecks ?? [];
 		const mergedChecks = mergeHealthChecks([
 			{
 				owner: "the module graph",
-				checks: app.arc?.healthChecks ?? []
+				checks: moduleChecks
 			},
 			{
 				owner: "shared arcPlugins.health",
@@ -121,4 +244,4 @@ function payloadTooLarge(limit) {
 	});
 }
 //#endregion
-export { ArcFactory, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, developmentPreset, edgePreset, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+export { ArcFactory, DEFAULT_LOGGER_REDACT_PATHS, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };

package/dist/fastify-augmentation-DVsTAy6X.d.mts

@@ -0,0 +1,179 @@
+
+import { on as HookSystem, z as ResourceRegistry } from "./index-BcR2bFZQ.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-BcTumAz_.mjs";
+import { s as ModuleState } from "./index-C5NnMEKF.mjs";
+import { FastifyPluginAsync } from "fastify";
+//#region src/factory/module/descriptor.d.ts
+/**
+ * Resolved module introspection — what a module ACTUALLY composed to.
+ *
+ * `ArcModule` is the authoring shape: `resources` may be an array or a factory,
+ * `owns` may be a list or `"provided"`, and neither tells you what the module
+ * ended up mounting. Consumers that needed the resolved answer were reduced to
+ * inspecting that shape — a downstream conformance suite had to treat every
+ * resource FACTORY as a violation, because it could not distinguish "late-bound
+ * and legitimate" from "unresolvable", and so rejected valid modules.
+ *
+ * A descriptor is the resolved, read-only answer, published after arc has done
+ * the work exactly once. It lets tooling assert on the real graph without
+ * touching arc internals:
+ *
+ *   - conformance suites verify what a module provides and supersedes;
+ *   - `doctor` surfaces duplicate resources and unmet dependencies;
+ *   - tests assert the composed graph instead of re-deriving it;
+ *   - operators inspect a large installation;
+ *   - documentation generators read one stable contract.
+ *
+ * Deliberately DATA — no functions, no live handles. It survives
+ * `structuredClone`, so it can cross a worker boundary or be written to a file
+ * as-is, and holding one cannot keep a closed app alive.
+ */
+/** One resource as arc resolved it. */
+interface ResolvedResourceDescriptor {
+  /** Resource name; absent for an anonymous resource (participates in no dedup). */
+  readonly name?: string;
+  /** Route prefix, when the resource declared one. */
+  readonly prefix?: string;
+  /** Whether the resource opted out of the app-wide `resourcePrefix`. */
+  readonly skipGlobalPrefix: boolean;
+}
+/** Lifecycle surface a module ended up with — counts, not handles. */
+interface ResolvedModuleLifecycle {
+  /** Does the module tear anything down? */
+  readonly hasClose: boolean;
+  /** Event-handler subscriptions arc owns for this module. */
+  readonly subscriptions: number;
+  /** Recurring schedules contributed. */
+  readonly scheduledJobs: number;
+  /** Readiness checks contributed. */
+  readonly healthChecks: number;
+  /** Whether the module contributed a public export at `arc.modules[name]`. */
+  readonly exports: boolean;
+}
+/** The resolved, read-only description of one composed module. */
+interface ResolvedModuleDescriptor {
+  readonly name: string;
+  /** Declared composition edges, in the order the module listed them. */
+  readonly dependsOn: readonly string[];
+  /** Resources this module actually mounted, in registration order. */
+  readonly resources: readonly ResolvedResourceDescriptor[];
+  /**
+   * The EFFECTIVE supersession list — already derived when the module declared
+   * `owns: "provided"`, so callers never re-implement that resolution.
+   */
+  readonly owns: readonly string[];
+  readonly lifecycle: ResolvedModuleLifecycle;
+}
+/** Minimal resource shape the descriptor reads. Structural — matches `ResourceLike`. */
+interface DescribableResource {
+  readonly name?: string | undefined;
+  readonly prefix?: string | undefined;
+  readonly skipGlobalPrefix?: boolean | undefined;
+}
+/**
+ * Build a descriptor. Called by `registerResources` once per module, after
+ * resources are resolved and `owns` is effective.
+ *
+ * Frozen at every level: a descriptor is a snapshot of a completed decision,
+ * and a consumer mutating it would silently disagree with the running app.
+ */
+declare function describeResolvedModule(input: {
+  readonly name: string;
+  readonly dependsOn?: readonly string[] | undefined;
+  readonly resources: readonly DescribableResource[];
+  readonly owns: readonly string[];
+  readonly lifecycle: ResolvedModuleLifecycle;
+}): ResolvedModuleDescriptor;
+//#endregion
+//#region src/core/arcCorePlugin.d.ts
+interface ArcCorePluginOptions {
+  /** Enable event emission for CRUD operations (requires eventPlugin) */
+  emitEvents?: boolean;
+  /** Hook system instance (for testing/custom setup) */
+  hookSystem?: HookSystem;
+  /** Resource registry instance (for testing/custom setup) */
+  registry?: ResourceRegistry;
+}
+interface PluginMeta {
+  name: string;
+  version?: string;
+  options?: Record<string, unknown>;
+  registeredAt: string;
+}
+interface ArcCore {
+  /** Instance-scoped hook system */
+  hooks: HookSystem;
+  /** Instance-scoped resource registry */
+  registry: ResourceRegistry;
+  /** Whether event emission is enabled */
+  emitEvents: boolean;
+  /** External OpenAPI paths contributed by auth adapters or third-party integrations */
+  externalOpenApiPaths: ExternalOpenApiPaths[];
+  /** Registered plugins for introspection */
+  plugins: Map<string, PluginMeta>;
+  /**
+   * Module public exports — `bootstrap()` return values keyed by module name
+   * (see `src/factory/module.ts`). Read via `getModuleExports(fastify, name)`:
+   * augment `ArcModuleRegistry` once and the name infers the export type;
+   * otherwise pass it inline. `Partial<ArcModuleRegistry>` gives augmented
+   * apps typed direct access (`fastify.arc.modules.order`), while the
+   * `Record<string, unknown>` intersection keeps un-augmented reads open.
+   * Populated lazily by `registerResources` — absent until a module exports.
+   */
+  modules?: Partial<ArcModuleRegistry> & Record<string, unknown>;
+  /**
+   * Lifecycle state per composed module (null-proto map, populated by
+   * `registerResources` the moment the graph is validated — so it answers
+   * "is this module composed?" even for resource-only modules that never
+   * record an export). Read via `hasModule(fastify, name)` /
+   * `getModuleState(fastify, name)`; the map itself is internal.
+   */
+  moduleStates?: Record<string, ModuleState>;
+  /**
+   * Module-contributed readiness checks, collected in dependency order and
+   * frozen by `createApp`. The API role merges these into its `healthPlugin`;
+   * `createWorker` reads this to give its probe listener the identical union
+   * (the worker preset disables the main health plugin, so this is how module
+   * checks reach the probe without a double registration). Empty until
+   * `createApp` populates it.
+   */
+  healthChecks?: readonly HealthCheck[];
+  /**
+   * The resolved, dependency-ordered module definitions (frozen by createApp).
+   * Integrations that collect a module arm at their OWN init time — e.g. the
+   * streamline integration calling `collectModuleWorkflows(fastify, defs)` after
+   * it has created + decorated its container — read the list from here. Empty
+   * until createApp populates it.
+   */
+  moduleDefinitions?: readonly ArcModule[];
+  /**
+   * RESOLVED module descriptors — what each module actually composed to
+   * (resources mounted, effective `owns`, lifecycle counts), published once
+   * boot has settled them.
+   *
+   * Read this rather than `moduleDefinitions` for anything that needs the real
+   * graph: a definition's `resources` may still be an unresolved factory and
+   * its `owns` may be `"provided"`, so the authoring shape cannot answer "what
+   * did this module actually mount?". Frozen, plain data — safe to clone, log,
+   * or hand to tooling.
+   */
+  moduleDescriptors?: readonly ResolvedModuleDescriptor[];
+  /**
+   * Module-contributed recurring schedules, resolved once in dependency order
+   * and frozen after bootstraps. The same definitions are executed by Arc's
+   * schedules plugin and exposed here for introspection. Empty until collection.
+   */
+  scheduledJobs?: readonly Readonly<ScheduleDefinition>[];
+}
+declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
+declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
+//#endregion
+//#region src/types/fastify-augmentation.d.ts
+declare module "fastify" {
+  interface FastifyInstance {
+    arc?: ArcCore;
+  }
+}
+//#endregion
+export { arcCorePlugin as a, ResolvedResourceDescriptor as c, _default as i, describeResolvedModule as l, ArcCorePluginOptions as n, ResolvedModuleDescriptor as o, PluginMeta as r, ResolvedModuleLifecycle as s, ArcCore as t };

package/dist/{fields-CB5Cuzk9.mjs → fields-CojeUkS4.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions
@@ -111,10 +111,7 @@ function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
 		case "visibleTo":
 			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
 			break;
-		case "redactFor":
-			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
-			break;
-		case "writableBy": break;
+		case "redactFor": if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
 	}
 	return result;
 }
@@ -140,12 +137,10 @@ function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
 				delete result[field];
 			}
 			break;
-		case "writableBy":
-			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
+		case "writableBy": if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
+			deniedFields.push(field);
+			delete result[field];
+		}
 	}
 	return {
 		body: result,

package/dist/{generate-EcA6ui4i.mjs → generate-DiB0nHPR.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts

package/dist/{headers-3zvE0rM3.mjs → headers-CveNO9gR.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-Cj42AntO.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-Cd_yy7aW.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-DjZYjM7H.mjs → health-CasG2A28.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts

package/dist/hooks/index.d.mts

@@ -1,3 +1,3 @@
 
-import { Cn as createHookSystem, Sn as beforeUpdate, _n as afterCreate, bn as beforeCreate, dn as HookHandler, fn as HookOperation, gn as HookSystemOptions, hn as HookSystem, ln as DefineHookOptions, mn as HookRegistration, pn as HookPhase, un as HookContext, vn as afterDelete, wn as defineHook, xn as beforeDelete, yn as afterUpdate } from "../index-CpzxqePp.mjs";
+import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-BcR2bFZQ.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-BcmPyq5I.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-DqXkMXkB.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -47,6 +47,22 @@ interface IdempotencyPluginOptions {
    * Omit for the common case where the store is per-deployment.
    */
   namespace?: string;
+  /**
+   * Boot-time store self-check (default: true). Writes one probe entry,
+   * verifies it reads back under ITS OWN key and NOT under a different key,
+   * then deletes it. Registration THROWS if the store fails — because the
+   * failure mode this catches is silent and catastrophic: a repository
+   * whose schema strips the key filter (observed live: a pathless Mongoose
+   * schema under `strictQuery: true`) collapses every idempotency key onto
+   * one shared row, and every request then replays the most recent cached
+   * response across keys AND across users. A store that cannot round-trip
+   * a key must never be allowed to serve traffic.
+   *
+   * Disable only for a store that genuinely cannot accept a probe write at
+   * boot — and if you disable it, the adapter's per-read identity checks
+   * remain as the runtime backstop.
+   */
+  selfCheck?: boolean;
 }
 declare module "fastify" {
   interface FastifyRequest {
@@ -92,6 +108,34 @@ declare const idempotencyPlugin: FastifyPluginAsync<IdempotencyPluginOptions>;
 declare const _default: FastifyPluginAsync<IdempotencyPluginOptions>;
 //#endregion
 //#region src/idempotency/repository-idempotency-adapter.d.ts
+/**
+ * The backing repository returned a document whose key does not match the
+ * key that was asked for — which means the repository is NOT applying the
+ * key filter. Concretely observed (2026-08-14, be-prod): a Mongoose schema
+ * with no declared paths (`new Schema({}, { _id: false })`) under a global
+ * `mongoose.set('strictQuery', true)` strips EVERY filter key as an
+ * "unknown path", so `getOne({ _id: key })` becomes `getOne({})` — one
+ * shared document then absorbs every idempotency key, and every request
+ * replays the most recent cached response ACROSS KEYS AND ACROSS USERS
+ * (a cancel response for order A was served as "success" for order B,
+ * which was never actually canceled).
+ *
+ * That failure mode is silent by construction — every read "succeeds" with
+ * a plausible document — so the adapter verifies the identity of every
+ * document it gets back and THROWS this instead of trusting it. Returning
+ * `undefined` (treat as miss) would be worse, not safer: the very next
+ * `tryLock`/`set` on the same broken repository would corrupt the shared
+ * document again.
+ *
+ * Fix on the host side: declare the key path on the schema (e.g.
+ * `_id: String`) and/or set `strictQuery: false` in the SCHEMA options so
+ * filters on it are never stripped — see `idempotencyPlugin`'s
+ * `repository` option docs.
+ */
+declare class IdempotencyStoreMisconfiguredError extends Error {
+  readonly code = "IDEMPOTENCY_STORE_MISCONFIGURED";
+  constructor(operation: string, expectedKey: string, actualKey: unknown);
+}
 declare function repositoryAsIdempotencyStore(repository: RepositoryLike, defaultTtlMs: number): IdempotencyStore;
 //#endregion
 //#region src/idempotency/stores/memory.d.ts
@@ -129,4 +173,4 @@ declare class MemoryIdempotencyStore implements IdempotencyStore {
   private evictOldest;
 }
 //#endregion
-export { type IdempotencyLock, type IdempotencyPluginOptions, type IdempotencyResult, type IdempotencyStore, MemoryIdempotencyStore, type MemoryIdempotencyStoreOptions, type RedisClient, type RedisIdempotencyStoreOptions, createIdempotencyResult, _default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };
+export { type IdempotencyLock, type IdempotencyPluginOptions, type IdempotencyResult, type IdempotencyStore, IdempotencyStoreMisconfiguredError, MemoryIdempotencyStore, type MemoryIdempotencyStoreOptions, type RedisClient, type RedisIdempotencyStoreOptions, createIdempotencyResult, _default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };