@classytic/arc 2.32.0 → 2.33.0

package/dist/events/transports/redis-stream-entry.d.mts

@@ -1,3 +1,3 @@
 
-import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-qN6A-RFv.mjs";
+import { n as RedisStreamTransport, r as RedisStreamTransportOptions, t as RedisStreamLike } from "../../redis-stream-mwLWlfHG.mjs";
 export { type RedisStreamLike, RedisStreamTransport, type RedisStreamTransportOptions };

package/dist/events/transports/redis-stream-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis-stream.ts
 /**

package/dist/events/transports/redis.d.mts

@@ -1,5 +1,5 @@
 
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-2uVV34WU.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "../../EventTransport-BEVP50ka.mjs";
 //#region src/events/transports/redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/events/transports/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis.ts
 /**

package/dist/factory/index.d.mts

@@ -1,10 +1,25 @@
 
-import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-CT5vu6M0.mjs";
-import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-ZWhLTp_s.mjs";
-import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-BppG5bMT.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-T1hmlTEZ.mjs";
+import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-BcTumAz_.mjs";
+import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-C5NnMEKF.mjs";
+import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-DVsTAy6X.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-g07ldtzh.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
+/**
+ * Default redact paths layered into Fastify's pino logger when the host
+ * doesn't supply a `logger.redact` of their own. Covers the common token /
+ * cookie / password leak surfaces — `Authorization` and `Cookie` headers
+ * (and their case-variants because Node lower-cases incoming headers but
+ * outgoing logs may carry either), API-key headers, and any nested
+ * `password` / `token` / `secret` / `apiKey` fields anywhere in the log
+ * tree.
+ *
+ * Hosts that need NO redaction (test fixtures, security audits) opt out
+ * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
+ * their own `redact` and arc steps aside — this default never overrides
+ * an explicit setting. (2.15.1)
+ */
+declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
 /**
  * Create a production-ready Fastify application with Arc framework.
  *
@@ -137,4 +152,4 @@ declare const testingPreset: Partial<CreateAppOptions>;
 declare const edgePreset: Partial<CreateAppOptions>;
 declare function getPreset(name: "production" | "development" | "testing" | "edge" | "worker"): Partial<CreateAppOptions>;
 //#endregion
-export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcWorker, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CreateWorkerOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, type EventHandlerDefinition, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type ModuleContribution, type ModuleDisposer, type ModuleExtension, type ModuleSetupContext, type ModuleState, type MultipartOptions, type RawBodyOptions, type ResolvedModuleDescriptor, type ResolvedModuleLifecycle, type ResolvedResourceDescriptor, type ResourceLike, type ResourceModule, type UnderPressureOptions, type WorkerHealthOptions, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcWorker, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CreateWorkerOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, DEFAULT_LOGGER_REDACT_PATHS, type EventHandlerDefinition, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type ModuleContribution, type ModuleDisposer, type ModuleExtension, type ModuleSetupContext, type ModuleState, type MultipartOptions, type RawBodyOptions, type ResolvedModuleDescriptor, type ResolvedModuleLifecycle, type ResolvedResourceDescriptor, type ResourceLike, type ResourceModule, type UnderPressureOptions, type WorkerHealthOptions, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };

package/dist/factory/index.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-5XnTa2uo.mjs";
-import { _ as collectModuleWorkflows, a as edgePreset, c as testingPreset, d as hasModule, f as orderModules, g as collectModuleScheduledJobs, h as collectModuleHealthChecks, i as developmentPreset, l as workerPreset, m as describeResolvedModule, n as createApp, o as getPreset, p as subscribeModuleEventHandlers, s as productionPreset, t as ArcFactory, u as getModuleState, v as resolveContribution, y as resolveModule } from "../createApp-Bv0m-Q6_.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-Br81am6m.mjs";
-import { t as loadResources } from "../loadResources-DisEAmkm.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CDs87fTw.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-CasG2A28.mjs";
+import { _ as collectModuleScheduledJobs, a as developmentPreset, b as resolveModule, c as productionPreset, d as getModuleState, f as hasModule, g as collectModuleHealthChecks, h as describeResolvedModule, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as orderModules, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset, v as collectModuleWorkflows, y as resolveContribution } from "../createApp-CLGegqiG.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
+import { t as loadResources } from "../loadResources-Bj-aSsXi.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-BkyqeTDz.mjs";
 //#region src/factory/module/extend.ts
 /** Concatenate two contributions, resolving factories only when arc asks. */
 function mergeContribution(own, extra) {
@@ -244,4 +244,4 @@ function payloadTooLarge(limit) {
 	});
 }
 //#endregion
-export { ArcFactory, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+export { ArcFactory, DEFAULT_LOGGER_REDACT_PATHS, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };

package/dist/{fastify-augmentation-BppG5bMT.d.mts → fastify-augmentation-DVsTAy6X.d.mts}

@@ -1,8 +1,8 @@
 
-import { hn as HookSystem, z as ResourceRegistry } from "./index-CpzxqePp.mjs";
+import { on as HookSystem, z as ResourceRegistry } from "./index-BcR2bFZQ.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
-import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-CT5vu6M0.mjs";
-import { s as ModuleState } from "./index-ZWhLTp_s.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-BcTumAz_.mjs";
+import { s as ModuleState } from "./index-C5NnMEKF.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/factory/module/descriptor.d.ts
 /**

package/dist/{fields-DEi65pGj.mjs → fields-CojeUkS4.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions

package/dist/{generate-CRSG0jTv.mjs → generate-DiB0nHPR.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-C2ZkKbsn.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts

package/dist/{headers-BXjQYbeC.mjs → headers-CveNO9gR.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-Bh1KK5ps.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-Cd_yy7aW.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-5XnTa2uo.mjs → health-CasG2A28.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts

package/dist/hooks/index.d.mts

@@ -1,3 +1,3 @@
 
-import { Cn as createHookSystem, Sn as beforeUpdate, _n as afterCreate, bn as beforeCreate, dn as HookHandler, fn as HookOperation, gn as HookSystemOptions, hn as HookSystem, ln as DefineHookOptions, mn as HookRegistration, pn as HookPhase, un as HookContext, vn as afterDelete, wn as defineHook, xn as beforeDelete, yn as afterUpdate } from "../index-CpzxqePp.mjs";
+import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-BcR2bFZQ.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-vimw5D7Z.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-DqXkMXkB.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.d.mts

@@ -47,6 +47,22 @@ interface IdempotencyPluginOptions {
    * Omit for the common case where the store is per-deployment.
    */
   namespace?: string;
+  /**
+   * Boot-time store self-check (default: true). Writes one probe entry,
+   * verifies it reads back under ITS OWN key and NOT under a different key,
+   * then deletes it. Registration THROWS if the store fails — because the
+   * failure mode this catches is silent and catastrophic: a repository
+   * whose schema strips the key filter (observed live: a pathless Mongoose
+   * schema under `strictQuery: true`) collapses every idempotency key onto
+   * one shared row, and every request then replays the most recent cached
+   * response across keys AND across users. A store that cannot round-trip
+   * a key must never be allowed to serve traffic.
+   *
+   * Disable only for a store that genuinely cannot accept a probe write at
+   * boot — and if you disable it, the adapter's per-read identity checks
+   * remain as the runtime backstop.
+   */
+  selfCheck?: boolean;
 }
 declare module "fastify" {
   interface FastifyRequest {
@@ -92,6 +108,34 @@ declare const idempotencyPlugin: FastifyPluginAsync<IdempotencyPluginOptions>;
 declare const _default: FastifyPluginAsync<IdempotencyPluginOptions>;
 //#endregion
 //#region src/idempotency/repository-idempotency-adapter.d.ts
+/**
+ * The backing repository returned a document whose key does not match the
+ * key that was asked for — which means the repository is NOT applying the
+ * key filter. Concretely observed (2026-08-14, be-prod): a Mongoose schema
+ * with no declared paths (`new Schema({}, { _id: false })`) under a global
+ * `mongoose.set('strictQuery', true)` strips EVERY filter key as an
+ * "unknown path", so `getOne({ _id: key })` becomes `getOne({})` — one
+ * shared document then absorbs every idempotency key, and every request
+ * replays the most recent cached response ACROSS KEYS AND ACROSS USERS
+ * (a cancel response for order A was served as "success" for order B,
+ * which was never actually canceled).
+ *
+ * That failure mode is silent by construction — every read "succeeds" with
+ * a plausible document — so the adapter verifies the identity of every
+ * document it gets back and THROWS this instead of trusting it. Returning
+ * `undefined` (treat as miss) would be worse, not safer: the very next
+ * `tryLock`/`set` on the same broken repository would corrupt the shared
+ * document again.
+ *
+ * Fix on the host side: declare the key path on the schema (e.g.
+ * `_id: String`) and/or set `strictQuery: false` in the SCHEMA options so
+ * filters on it are never stripped — see `idempotencyPlugin`'s
+ * `repository` option docs.
+ */
+declare class IdempotencyStoreMisconfiguredError extends Error {
+  readonly code = "IDEMPOTENCY_STORE_MISCONFIGURED";
+  constructor(operation: string, expectedKey: string, actualKey: unknown);
+}
 declare function repositoryAsIdempotencyStore(repository: RepositoryLike, defaultTtlMs: number): IdempotencyStore;
 //#endregion
 //#region src/idempotency/stores/memory.d.ts
@@ -129,4 +173,4 @@ declare class MemoryIdempotencyStore implements IdempotencyStore {
   private evictOldest;
 }
 //#endregion
-export { type IdempotencyLock, type IdempotencyPluginOptions, type IdempotencyResult, type IdempotencyStore, MemoryIdempotencyStore, type MemoryIdempotencyStoreOptions, type RedisClient, type RedisIdempotencyStoreOptions, createIdempotencyResult, _default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };
+export { type IdempotencyLock, type IdempotencyPluginOptions, type IdempotencyResult, type IdempotencyStore, IdempotencyStoreMisconfiguredError, MemoryIdempotencyStore, type MemoryIdempotencyStoreOptions, type RedisClient, type RedisIdempotencyStoreOptions, createIdempotencyResult, _default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };

package/dist/idempotency/index.mjs

@@ -1,12 +1,43 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-BXjQYbeC.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DmEMHlPQ.mjs";
-import { t as createIdempotencyResult } from "../interface-BP4IJCBO.mjs";
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-B88p99Z2.mjs";
+import { t as createIdempotencyResult } from "../interface-DznJrm9R.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
 import { update } from "@classytic/repo-core/update";
 //#region src/idempotency/repository-idempotency-adapter.ts
+/**
+* The backing repository returned a document whose key does not match the
+* key that was asked for — which means the repository is NOT applying the
+* key filter. Concretely observed (2026-08-14, be-prod): a Mongoose schema
+* with no declared paths (`new Schema({}, { _id: false })`) under a global
+* `mongoose.set('strictQuery', true)` strips EVERY filter key as an
+* "unknown path", so `getOne({ _id: key })` becomes `getOne({})` — one
+* shared document then absorbs every idempotency key, and every request
+* replays the most recent cached response ACROSS KEYS AND ACROSS USERS
+* (a cancel response for order A was served as "success" for order B,
+* which was never actually canceled).
+*
+* That failure mode is silent by construction — every read "succeeds" with
+* a plausible document — so the adapter verifies the identity of every
+* document it gets back and THROWS this instead of trusting it. Returning
+* `undefined` (treat as miss) would be worse, not safer: the very next
+* `tryLock`/`set` on the same broken repository would corrupt the shared
+* document again.
+*
+* Fix on the host side: declare the key path on the schema (e.g.
+* `_id: String`) and/or set `strictQuery: false` in the SCHEMA options so
+* filters on it are never stripped — see `idempotencyPlugin`'s
+* `repository` option docs.
+*/
+var IdempotencyStoreMisconfiguredError = class extends Error {
+	code = "IDEMPOTENCY_STORE_MISCONFIGURED";
+	constructor(operation, expectedKey, actualKey) {
+		super(`idempotency repository store: ${operation} for key '${expectedKey}' returned a document keyed '${String(actualKey)}' — the repository is not applying the key filter (commonly: a pathless Mongoose schema under strictQuery:true strips the filter to {}). Declare the key path on the schema (e.g. _id: String) and set strictQuery: false in the schema options. Refusing to serve cross-key results.`);
+		this.name = "IdempotencyStoreMisconfiguredError";
+	}
+};
 function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 	const missing = [];
 	if (typeof repository.getOne !== "function") missing.push("getOne");
@@ -17,11 +48,23 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 	const idField = repository.idField ?? "_id";
 	const isDuplicateKeyError = createIsDuplicateKeyError(repository);
 	const safeGetOne = createSafeGetOne(repository);
+	/**
+	* Every document read back MUST carry the key it was fetched by. A
+	* mismatch means the repository dropped the filter (see
+	* {@link IdempotencyStoreMisconfiguredError}) — fail loud, never serve
+	* or mutate a cross-key document.
+	*/
+	function assertKeyIdentity(operation, doc, expectedKey) {
+		const actual = doc[idField];
+		if (String(actual) !== expectedKey) throw new IdempotencyStoreMisconfiguredError(operation, expectedKey, actual);
+	}
 	return {
 		name: "repository",
 		async get(key) {
 			const doc = await safeGetOne(eq(idField, key));
-			if (!doc?.result) return void 0;
+			if (!doc) return void 0;
+			assertKeyIdentity("get", doc, key);
+			if (!doc.result) return void 0;
 			if (new Date(doc.expiresAt) < /* @__PURE__ */ new Date()) return void 0;
 			return {
 				key,
@@ -33,7 +76,7 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 			};
 		},
 		async set(key, result) {
-			await r.findOneAndUpdate(eq(idField, key), update({
+			const doc = await r.findOneAndUpdate(eq(idField, key), update({
 				set: {
 					result: {
 						statusCode: result.statusCode,
@@ -43,11 +86,13 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 					createdAt: result.createdAt,
 					expiresAt: result.expiresAt
 				},
+				setOnInsert: { [idField]: key },
 				unset: ["lock"]
 			}), {
 				upsert: true,
 				returnDocument: "after"
 			});
+			if (doc) assertKeyIdentity("set", doc, key);
 		},
 		async tryLock(key, requestId, ttlMs) {
 			const now = /* @__PURE__ */ new Date();
@@ -60,6 +105,7 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 						expiresAt: lockExpiresAt
 					} },
 					setOnInsert: {
+						[idField]: key,
 						createdAt: now,
 						expiresAt: docExpiresAt
 					}
@@ -67,6 +113,7 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 					upsert: true,
 					returnDocument: "after"
 				});
+				if (doc) assertKeyIdentity("tryLock", doc, key);
 				return doc !== null && doc !== void 0;
 			} catch (err) {
 				if (isDuplicateKeyError(err)) return false;
@@ -90,6 +137,7 @@ function repositoryAsIdempotencyStore(repository, defaultTtlMs) {
 		async findByPrefix(prefix) {
 			const doc = await safeGetOne(and(startsWith(idField, prefix, "sensitive"), exists("result", true), gt("expiresAt", /* @__PURE__ */ new Date())));
 			if (!doc?.result) return void 0;
+			if (!String(doc[idField] ?? "").startsWith(prefix)) throw new IdempotencyStoreMisconfiguredError("findByPrefix", prefix, doc[idField]);
 			return {
 				key: String(doc[idField] ?? prefix),
 				statusCode: doc.result.statusCode,
@@ -287,8 +335,42 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		"POST",
 		"PUT",
 		"PATCH"
-	], include, exclude, repository, store: explicitStore, retryAfterSeconds = 1, namespace } = opts;
+	], include, exclude, repository, store: explicitStore, retryAfterSeconds = 1, namespace, selfCheck = true } = opts;
 	const store = repository ? repositoryAsIdempotencyStore(repository, ttlMs) : explicitStore ?? new MemoryIdempotencyStore({ ttlMs });
+	/**
+	* Who owns the store's lifecycle — arc closes ONLY what arc built.
+	*
+	* A host-supplied `store` may outlive this app: two arc apps in one process
+	* (a documented topology) can share one, and `MemoryIdempotencyStore.close()`
+	* CLEARS its maps. Closing on the first app's shutdown therefore wiped the
+	* second app's live idempotency records — replayable requests silently
+	* became re-executable. A store handed in from outside is the host's to
+	* close. The same rule now applies to the events transport and the
+	* query-cache store, which had the identical defect.
+	*
+	* The `repository` path builds its own adapter here, so arc owns that
+	* wrapper — but the adapter has no `close`, and the underlying repository
+	* (host-owned) is never touched.
+	*/
+	const ownsStore = !explicitStore;
+	if (enabled && selfCheck) {
+		const probeSuffix = createHash("sha256").update(`${process.pid}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 12);
+		const probeKeyA = `__arc_idempotency_selfcheck__:${probeSuffix}:a`;
+		const probeKeyB = `__arc_idempotency_selfcheck__:${probeSuffix}:b`;
+		/** Correctness verdicts rethrow; everything else degrades to a warning. */
+		class SelfCheckViolation extends Error {}
+		try {
+			await store.set(probeKeyA, createIdempotencyResult(299, { probe: true }, {}, 6e4));
+			const own = await store.get(probeKeyA);
+			if (!own || own.statusCode !== 299) fastify.log?.warn?.({ probe: "own-key" }, "idempotencyPlugin self-check: probe entry did not read back under its own key. This is usually the store being unreachable at boot (connection not ready), not a misconfiguration — continuing, with the adapter's per-read key-identity checks as the runtime backstop. If keyed requests later fail with IDEMPOTENCY_STORE_MISCONFIGURED, the store's key filter is being stripped (see IdempotencyStoreMisconfiguredError).");
+			else if (await store.get(probeKeyB)) throw new SelfCheckViolation("idempotencyPlugin self-check: a probe read under key B returned key A's entry — the store is ignoring the key filter, which in production replays cached responses across keys and users (observed cause: a pathless Mongoose schema under strictQuery:true strips every filter to {}). Declare the key path on the schema (e.g. _id: String) and set strictQuery: false in the schema options.");
+		} catch (err) {
+			if (err instanceof SelfCheckViolation || err?.code === "IDEMPOTENCY_STORE_MISCONFIGURED") throw err;
+			fastify.log?.warn?.({ err }, "idempotencyPlugin self-check could not complete (store unreachable at boot?) — continuing. The adapter's per-read key-identity checks remain the runtime backstop.");
+		} finally {
+			await store.deleteByPrefix(`__arc_idempotency_selfcheck__:${probeSuffix}:`).catch(() => {});
+		}
+	}
 	if (!enabled) {
 		fastify.decorate("idempotency", {
 			invalidate: async () => {},
@@ -431,7 +513,7 @@ const idempotencyPlugin = async (fastify, opts = {}) => {
 		await store.unlock(fullKey, request.id);
 	});
 	fastify.addHook("onClose", async () => {
-		await store.close?.();
+		if (ownsStore) await store.close?.();
 	});
 	fastify.log?.debug?.({
 		headerName,
@@ -444,4 +526,4 @@ var idempotencyPlugin_default = fp(idempotencyPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { MemoryIdempotencyStore, createIdempotencyResult, idempotencyPlugin_default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };
+export { IdempotencyStoreMisconfiguredError, MemoryIdempotencyStore, createIdempotencyResult, idempotencyPlugin_default as idempotencyPlugin, idempotencyPlugin as idempotencyPluginFn, repositoryAsIdempotencyStore };

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-zq6VrjaB.d.mts → index-B-DvUzsr.d.mts}

@@ -1,7 +1,7 @@
 
-import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
 import { i as RequestScope, n as Mandate } from "./types-ChuShpCP.mjs";
-import { i as PermissionContext, r as PermissionCheck, t as AuthorizationDecision } from "./types-B7XeLEgK.mjs";
+import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-Csjc2oF-.mjs";
+import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
 /**
@@ -1021,6 +1021,16 @@ interface PermissionMatrixRegistry {
       name: string;
       permissions?: unknown;
     }>;
+    /**
+     * Custom routes. Only those declaring `capability` are published — see the
+     * loop in `introspectRegistry` for why a route needs an explicit name.
+     */
+    customRoutes?: ReadonlyArray<{
+      method: string;
+      path: string;
+      capability?: string;
+      permissions?: unknown;
+    }>;
   }>;
 }
 interface PermissionMatrixOptions {