@classytic/arc 2.31.0 → 2.33.0

package/dist/{mcpPlugin-B_es0hiF.mjs → mcpPlugin-aJg5TqHi.mjs}

@@ -1,19 +1,19 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-ChvUQGG1.mjs";
-import { p as isArcError, t as ArcError } from "./errors-Cj42AntO.mjs";
-import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-Cys0ko9Z.mjs";
-import { t as BaseController } from "./BaseController-De7GqHck.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
-import { t as executePipeline } from "./pipe-DRDNsI2T.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-UPQFatit.mjs";
-import { n as validateAggregations } from "./validate-_KbifpHF.mjs";
-import { n as executeAggregation } from "./buildHandler-CDrCJzmB.mjs";
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
-import { t as createIdempotencyResult } from "./interface-DYzM0q-u.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Bm2enbnh.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-B3mP_QTy.mjs";
+import { p as isArcError, t as ArcError } from "./errors-Cd_yy7aW.mjs";
+import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CoqIRrkY.mjs";
+import { t as BaseController } from "./BaseController-CaQC5EXX.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
+import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
+import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
+import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
+import { n as executeAggregation } from "./buildHandler-DLE9xX-V.mjs";
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
+import { t as createIdempotencyResult } from "./interface-DznJrm9R.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -332,18 +332,32 @@ function expandOperatorKeys(input) {
 */
 function buildScope(auth) {
 	if (!auth) return { kind: "public" };
+	/**
+	* `context` (and `teamId`, member-only) are carried through, not dropped.
+	*
+	* A resolver could already return them — `McpAuthResult` has an index
+	* signature — and this function silently discarded both, so a resource
+	* gated by `requireScopeContext('branchId')` worked over HTTP and DENIED
+	* every MCP call, because the dimension it authorises against was never
+	* populated. Fail-closed, but it made the tool permanently unusable rather
+	* than wrong, which is why nothing caught it.
+	*/
+	const context = normalizeScopeContext(auth.context);
 	if (auth.clientId && auth.organizationId) return {
 		kind: "service",
 		clientId: auth.clientId,
 		organizationId: auth.organizationId,
-		scopes: auth.scopes
+		scopes: auth.scopes,
+		...context ? { context } : {}
 	};
 	if (auth.organizationId) return {
 		kind: "member",
 		userId: auth.userId,
 		userRoles: auth.roles ?? [],
 		organizationId: auth.organizationId,
-		orgRoles: auth.orgRoles ?? []
+		orgRoles: auth.orgRoles ?? [],
+		...typeof auth.teamId === "string" ? { teamId: auth.teamId } : {},
+		...context ? { context } : {}
 	};
 	return {
 		kind: "authenticated",
@@ -351,6 +365,23 @@ function buildScope(auth) {
 		userRoles: auth.roles ?? []
 	};
 }
+/**
+* Accept a resolver's `context` only as a string→string map.
+*
+* The resolver is host code reached through an index signature, so the value
+* is `unknown`. Coercing arbitrary values (numbers, objects, null) into
+* authorisation dimensions would make `requireScopeContext('branchId')`
+* compare against something that was never a branch id; non-string entries are
+* dropped rather than stringified. Returns `undefined` for an empty result so
+* a scope reports "carries no context" rather than "carries an empty one" —
+* different facts to a caller.
+*/
+function normalizeScopeContext(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	for (const [k, v] of Object.entries(value)) if (typeof v === "string") out[k] = v;
+	return Object.keys(out).length > 0 ? Object.freeze(out) : void 0;
+}
 //#endregion
 //#region src/integrations/mcp/tool-helpers.ts
 /**
@@ -367,12 +398,13 @@ function buildScope(auth) {
 */
 async function evaluatePermission(check, session, resource, action, input) {
 	if (!check) return null;
+	const user = session ? {
+		id: session.userId,
+		_id: session.userId,
+		...session
+	} : null;
 	return evaluatePermissionDecision(check, {
-		user: session ? {
-			id: session.userId,
-			_id: session.userId,
-			...session
-		} : null,
+		user,
 		scope: buildScope(session),
 		resource,
 		action,
@@ -465,13 +497,14 @@ function toCallToolSuccess(value) {
 */
 function toCallToolError(input) {
 	let contract;
-	if (input instanceof Error) if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
-	else contract = {
-		code: "arc.internal_error",
-		message: input.message || "Internal Server Error",
-		status: 500
-	};
-	else contract = {
+	if (input instanceof Error) {
+		if (isArcError(input) || isHttpError(input)) contract = toErrorContract(input);
+		else contract = {
+			code: "arc.internal_error",
+			message: input.message || "Internal Server Error",
+			status: 500
+		};
+	} else contract = {
 		code: input.code,
 		message: input.message,
 		...input.status !== void 0 ? { status: input.status } : {},
@@ -588,7 +621,7 @@ function invocationFingerprint(resourceName, actionName, input, session) {
 	return `mcp:${resourceName}:${actionName}:${createHash("sha256").update(JSON.stringify(sortKeys(input))).digest("hex").substring(0, 16)}:u=${session?.userId ?? session?.clientId ?? "anon"}`;
 }
 /** TTLs matching the HTTP idempotency plugin's defaults. */
-const MCP_IDEMPOTENCY_TTL_MS = 1440 * 60 * 1e3;
+const MCP_IDEMPOTENCY_TTL_MS = 864e5;
 const MCP_IDEMPOTENCY_LOCK_MS = 1e4;
 /**
 * Invoke a controller method through the MCP synthetic-context path.
@@ -847,9 +880,12 @@ function resolveCrudDescription(override, meta) {
 * MCP agent the same field-projection it already has on list.
 */
 const PROJECTION_FIELD = z.string().optional().describe("Comma-separated field list to project (e.g. 'name,price'). Prefix with '-' to exclude (e.g. '-description').");
+/** Default page cap, used only when the resource declares none. */
+const DEFAULT_MCP_MAX_LIMIT = 100;
+/** `limit` is per-resource — see `maxLimit` on the options. */
+const limitField = (maxLimit) => z.number().int().min(1).max(maxLimit).optional().describe(`Items per page (max ${maxLimit})`);
 const PAGINATION_SHAPE = {
 	page: z.number().int().min(1).optional().describe("Page number (1-based). Ignored when `cursor` is set."),
-	limit: z.number().int().min(1).max(100).optional().describe("Items per page (max 100)"),
 	cursor: z.string().optional().describe("Opaque keyset cursor from a previous page's `next`. Pass it to fetch the following page; when set, `page` is ignored (cursor/keyset pagination — stable under concurrent inserts)."),
 	sort: z.string().optional().describe("Sort field, prefix with - for descending"),
 	search: z.string().optional().describe("Full-text search query"),
@@ -937,9 +973,12 @@ function opDescription(op, fieldName) {
 }
 /** Build list/query shape with filterable fields, operators, and pagination */
 function buildListShape(fieldRules, options) {
-	const { filterableFields = [], hiddenFields = [], extraHideFields = [], allowedOperators } = options;
+	const { filterableFields = [], hiddenFields = [], extraHideFields = [], allowedOperators, maxLimit = DEFAULT_MCP_MAX_LIMIT } = options;
 	const allHidden = /* @__PURE__ */ new Set([...hiddenFields, ...extraHideFields]);
-	const shape = { ...PAGINATION_SHAPE };
+	const shape = {
+		...PAGINATION_SHAPE,
+		limit: limitField(maxLimit)
+	};
 	shape._count = z.boolean().optional().describe("Return only { count } of records matching the filters — no documents fetched. Cheapest way to answer 'how many'.");
 	shape._exists = z.boolean().optional().describe("Return only whether ANY record matches the filters (boolean existence check).");
 	shape._distinct = z.string().optional().describe("Return the distinct values of this field across records matching the filters.");
@@ -1434,7 +1473,6 @@ function jsonSchemaPropertyToZod(prop) {
 		case "array": return applyDescription(arrayToZod(prop), prop);
 		case "object": return applyDescription(objectToZod(prop), prop);
 		case "null": continue;
-		default: break;
 	}
 	return applyDescription(z.unknown(), prop);
 }
@@ -1825,6 +1863,7 @@ function resourceToTools(resource, config = {}) {
 	const filterableFields = resource.schemaOptions?.filterableFields ?? resource.queryParser?.allowedFilterFields;
 	const sortableFields = resource.queryParser?.allowedSortFields;
 	const allowedOperators = resource.queryParser?.allowedOperators;
+	const maxLimit = resource.queryParser?.maxLimit;
 	const hasSoftDelete = resource._appliedPresets?.includes("softDelete") ?? false;
 	const tools = [];
 	const prefix = config.toolNamePrefix;
@@ -1845,6 +1884,7 @@ function resourceToTools(resource, config = {}) {
 				extraHideFields: config.hideFields,
 				filterableFields,
 				allowedOperators,
+				maxLimit,
 				adapterBodies
 			});
 			if (wiring?.idempotencyStore && op !== "list" && op !== "get") inputSchema._idempotencyKey = z.string().optional().describe("Optional idempotency key — retrying with the same key and input replays the first successful result instead of re-executing.");
@@ -2061,7 +2101,7 @@ function getOps(r, override) {
 }
 //#endregion
 //#region src/integrations/mcp/sessionCache.ts
-const DEFAULT_TTL_MS = 1800 * 1e3;
+const DEFAULT_TTL_MS = 18e5;
 const DEFAULT_MAX_SESSIONS = 1e3;
 var McpSessionCache = class {
 	sessions = /* @__PURE__ */ new Map();

package/dist/{memory-DR6wpa9F.mjs → memory-qYSB7rMQ.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**
@@ -26,11 +26,11 @@ var MemoryCacheStore = class {
 	constructor(options = {}) {
 		this.defaultTtlSeconds = options.defaultTtlSeconds ?? 60;
 		this.maxEntries = clamp(options.maxEntries ?? 1e3, 1, 1e5);
-		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 256 * 1024, 1024, 10 * 1024 * 1024);
-		this.maxMemoryBytes = options.maxMemoryBytes ?? 50 * 1024 * 1024;
+		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 262144, 1024, 10485760);
+		this.maxMemoryBytes = options.maxMemoryBytes ?? 52428800;
 		this.evictionWatermark = clamp(options.evictionWatermark ?? .9, .5, 1);
 		this.logger = options.logger ?? console;
-		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 600 * 1e3);
+		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 6e5);
 		this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
 		if (this.cleanupTimer.unref) this.cleanupTimer.unref();
 	}

package/dist/{metrics-CUdw_wLB.mjs → metrics-D7uchLjN.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CpzxqePp.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BcR2bFZQ.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
-import { t as multipartBody } from "../multipartBody-wOgj_fnj.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BxCoxmiN.mjs";
+import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-Dll8mGgc.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-BnWtbA2U.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -88,7 +88,7 @@ var MongoMigrationStore = class {
 	}
 };
 const MIGRATION_LOCK_NAME = "arc:migrations";
-const DEFAULT_LOCK_LEASE_MS = 600 * 1e3;
+const DEFAULT_LOCK_LEASE_MS = 6e5;
 /**
 * Source checksum for drift detection — SHA-256 over the migration's
 * `up`/`down` source. Stable for a given build; a transpile-target change

package/dist/{module-0pFJA6YW.mjs → module-CwKsgZXp.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-wOgj_fnj.mjs → multipartBody-4w-S3-PU.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
-const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_FILE_SIZE = 10485760;
 const DEFAULT_MAX_FILES = 5;
-const DEFAULT_MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+const DEFAULT_MAX_TOTAL_BYTES = 26214400;
 const DEFAULT_FILES_KEY = "_files";
 /**
 * Build a matcher for MIME allow-lists that supports exact (e.g. `image/png`),

package/dist/{openapi-B2L4js1v.mjs → openapi-BN5cQaO2.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-D--wdJM-.mjs";
-import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-CDXEdasl.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-XH1RZRyu.mjs";
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-DVpoA0do.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -0,0 +1,85 @@
+
+import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
+import { t as ArcModule } from "../types-BcTumAz_.mjs";
+import { OutboxStore } from "@classytic/primitives/outbox";
+//#region src/outbox-admin/module.d.ts
+/**
+ * A store that can answer an operator's questions.
+ *
+ * Only the four reads this surface actually performs are required — `fail` and
+ * `purge` belong to the relay and retention, not here.
+ */
+type OutboxAdminStore = OutboxStore & Required<Pick<OutboxStore, "getDeadLettered" | "requeue" | "countByStatus" | "oldestPendingAgeMs">>;
+interface OutboxAdminPermissions {
+  /**
+   * Reading health and the dead-letter list.
+   *
+   * MUST be platform-only — see `allowUnverifiedOperatorPermission`.
+   */
+  view: PermissionCheck;
+  /**
+   * Replaying a dead-lettered event. Defaults to `view` when omitted — but
+   * replay RE-DELIVERS an event that already failed five times, so a
+   * deployment that separates read access from operational action should gate
+   * it distinctly. Also platform-only.
+   */
+  replay?: PermissionCheck;
+}
+interface OutboxAdminModuleDeps {
+  store: OutboxAdminStore;
+  permissions: OutboxAdminPermissions;
+  /** Route prefix. Default `/admin/outbox`. */
+  prefix?: string;
+  /** Module name. Default `outbox-admin`. */
+  moduleName?: string;
+  /**
+   * Name the outbox module was composed under, used to resolve the relay and
+   * declared as a `dependsOn` edge. Default `outbox`.
+   */
+  outboxModuleName?: string;
+  /** Resource names this module supersedes. */
+  owns?: readonly string[];
+  /** Cap on `?limit`. Default 500 — a dead-letter list is for triage, not export. */
+  maxDeadLetterLimit?: number;
+  /**
+   * Accept gates arc cannot prove are platform-only.
+   *
+   * By default both gates must carry `_platformOnly` (i.e. come from
+   * `requirePlatformRole`), and boot FAILS otherwise. The reason is the same
+   * one that hardened `integrations/jobs` in 2.31: these routes are global by
+   * construction. `getDeadLettered(limit)` takes no filter and an outbox row
+   * carries no tenant identity, so there is nothing to scope by. A gate that
+   * grants per organization therefore READS as scoped while serving everyone —
+   * `requireOrgRole('manager')` would let org A's manager read org B's failed
+   * events. Neither returns a policy, so no per-request check can tell a real
+   * operator gate from an org one.
+   *
+   * Set this only for a custom check you have verified consults platform
+   * identity alone.
+   */
+  allowUnverifiedOperatorPermission?: boolean;
+  /**
+   * Include each dead-lettered event's domain PAYLOAD in the listing.
+   * Default `false`.
+   *
+   * The payload is the original event body — in an ERP that is order totals,
+   * customer records and payment references. Triage needs the id, the event
+   * name, the attempt count and why it failed; it does not need the contents.
+   * Opt in only where the surface is genuinely platform-operator-only and you
+   * accept that the response carries business data.
+   */
+  exposePayload?: boolean;
+  /**
+   * Include the failure STACK TRACE alongside the error message.
+   * Default `false` — a stack names internal paths and framework versions.
+   */
+  exposeStack?: boolean;
+  /**
+   * Pending-event age (ms) past which the outbox reports unhealthy even with an
+   * empty dead-letter queue. Default 5 minutes.
+   */
+  relayLagUnhealthyMs?: number;
+}
+declare function createOutboxAdminModule(deps: OutboxAdminModuleDeps): ArcModule<void>;
+//#endregion
+export { type OutboxAdminModuleDeps, type OutboxAdminPermissions, type OutboxAdminStore, createOutboxAdminModule };

package/dist/outbox-admin/index.mjs

@@ -0,0 +1,115 @@
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
+import { t as defineResource } from "../defineResource-DR9vsUYy.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
+//#region src/outbox-admin/module.ts
+/**
+* Strip the domain payload and the stack unless explicitly opted in.
+*
+* Triage is answered by WHICH event failed, HOW MANY times, WHEN and WHY. The
+* payload answers none of those and carries the business record; the stack
+* names internal paths. Both are off by default, on the same reasoning that
+* made `exposeResult` / `exposeFailureReason` opt-in for jobs.
+*/
+function redactDeadLettered(e, opts) {
+	return {
+		event: {
+			type: e.event.type,
+			meta: e.event.meta,
+			...opts.exposePayload ? { payload: e.event.payload } : {}
+		},
+		error: {
+			message: e.error.message,
+			...e.error.code !== void 0 ? { code: e.error.code } : {},
+			...opts.exposeStack && e.error.stack !== void 0 ? { stack: e.error.stack } : {}
+		},
+		attempts: e.attempts,
+		firstFailedAt: e.firstFailedAt,
+		lastFailedAt: e.lastFailedAt,
+		...e.handlerName !== void 0 ? { handlerName: e.handlerName } : {}
+	};
+}
+function createOutboxAdminModule(deps) {
+	const moduleName = deps.moduleName ?? "outbox-admin";
+	const outboxModuleName = deps.outboxModuleName ?? "outbox";
+	const maxLimit = deps.maxDeadLetterLimit ?? 500;
+	const view = deps.permissions.view;
+	const replay = deps.permissions.replay ?? deps.permissions.view;
+	const lagUnhealthyMs = deps.relayLagUnhealthyMs ?? 3e5;
+	if (!deps.allowUnverifiedOperatorPermission) {
+		for (const [label, gate] of [["view", view], ["replay", replay]]) if (!gate._platformOnly) throw new Error(`[arc/outbox-admin] permissions.${label} must be platform-only. These routes are global (an outbox row carries no tenant identity and getDeadLettered takes no filter), so an org-role gate would let a member of one organization read another's failed events and their payloads. Use requirePlatformRole('platform-ops') — or requireRoles([...], { includeOrgRoles: false }) with allowUnverifiedOperatorPermission: true if you have verified the check yourself.`);
+	}
+	const resource = defineResource({
+		name: moduleName,
+		displayName: "Outbox Admin",
+		tag: "Operations",
+		prefix: deps.prefix ?? "/admin/outbox",
+		customRoutesOnly: true,
+		routes: [
+			{
+				method: "GET",
+				path: "/health",
+				summary: "Outbox health — pending, dead-letter and relay lag",
+				permissions: view,
+				rawHandler: async (_req, reply) => {
+					const [pending, deadLetter, relayLagMs] = await Promise.all([
+						deps.store.countByStatus("pending"),
+						deps.store.countByStatus("dead_letter"),
+						deps.store.oldestPendingAgeMs()
+					]);
+					const healthy = deadLetter === 0 && (relayLagMs === null || relayLagMs < lagUnhealthyMs);
+					return reply.send({
+						pending,
+						deadLetter,
+						relayLagMs,
+						healthy
+					});
+				}
+			},
+			{
+				method: "GET",
+				path: "/dead-letter",
+				summary: "List dead-lettered events with their errors",
+				permissions: view,
+				rawHandler: async (req, reply) => {
+					const raw = req.query?.limit;
+					const parsed = Number(raw ?? 100);
+					const limit = Math.min(Math.max(Number.isFinite(parsed) ? parsed : 100, 1), maxLimit);
+					const events = await deps.store.getDeadLettered(limit);
+					return reply.send({
+						count: events.length,
+						limit,
+						events: events.map((e) => redactDeadLettered(e, deps))
+					});
+				}
+			},
+			{
+				method: "POST",
+				path: "/dead-letter/:id/replay",
+				summary: "Requeue a dead-lettered event and drain the relay",
+				permissions: replay,
+				rawHandler: async (req, reply) => {
+					const eventId = req.params?.id;
+					if (!eventId) throw new ValidationError("event id is required");
+					if (!await deps.store.requeue(eventId)) throw new NotFoundError(`Dead-lettered event "${eventId}" — not found, or not currently dead-lettered`);
+					const { relay } = getModuleExports(req.server, outboxModuleName);
+					const relayDelivered = await relay.relay();
+					return reply.send({
+						eventId,
+						requeued: true,
+						relayDelivered,
+						note: "relayDelivered counts the entire drained batch, not this event alone"
+					});
+				}
+			}
+		]
+	});
+	return defineModule({
+		name: moduleName,
+		dependsOn: [outboxModuleName],
+		...deps.owns ? { owns: [...deps.owns] } : {},
+		resources: () => [resource]
+	});
+}
+//#endregion
+export { createOutboxAdminModule };