@classytic/arc 2.34.0 → 2.35.0

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";

package/dist/{interface-DznJrm9R.mjs → interface-my7sxjw5.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-CfGH-GxO.mjs → jsonBody-CVKA7C5m.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-CLid6atr.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-WeKvY1dE.mjs → keys-GlU7XpmG.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-Bj-aSsXi.mjs → loadResources-DdQb0qgV.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-DwaxNcE2.mjs → loadResourcesFromEntry-s6aGs6-0.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-DoALUlOO.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-yuD1Ra53.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.d.mts

@@ -54,10 +54,29 @@ interface ArcLogger {
   error: (...args: unknown[]) => void;
 }
 /**
- * Configure the Arc logger globally.
+ * Run `fn` with `options` as the active logger config.
  *
- * Called automatically by `createApp({ debug })`, but can also be
- * called manually for standalone usage outside of `createApp`.
+ * `options` is held BY REFERENCE deliberately: `createApp` enters the scope
+ * before Fastify exists, then fills in the pino writer once `fastify.log` is
+ * constructed. Copying here would freeze the pre-Fastify view and send every
+ * post-construction boot warning to the console instead of the app's logger.
+ */
+declare function runWithArcLogger<T>(options: ArcLoggerOptions, fn: () => T): T;
+/**
+ * Enter `options` for the remainder of the current async context.
+ *
+ * For Fastify's `onRequest` hook, where `run(store, done)` wraps the rest of
+ * the request lifecycle. Outside a hook, prefer {@link runWithArcLogger}.
+ */
+declare function enterArcLoggerScope(options: ArcLoggerOptions, done: () => void): void;
+/**
+ * Configure the PROCESS-GLOBAL Arc logger — the fallback used outside any app.
+ *
+ * `createApp` no longer routes its writer through here; each app carries its
+ * own scoped options (see {@link runWithArcLogger}) so two apps in one process
+ * cannot overwrite each other's. This remains the way to configure arcLog for
+ * standalone use — `defineResource()` at module import, CLI commands, and any
+ * code running before or outside a `createApp` boot.
  */
 declare function configureArcLogger(options: ArcLoggerOptions): void;
 /**
@@ -104,4 +123,4 @@ interface PinoLike {
  */
 declare function createPinoWriter(logger: PinoLike): ArcLogWriter;
 //#endregion
-export { ArcLogWriter, ArcLogger, ArcLoggerOptions, PinoLike, arcLog, configureArcLogger, createPinoWriter };
+export { ArcLogWriter, ArcLogger, ArcLoggerOptions, PinoLike, arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger };

package/dist/logger/index.mjs

@@ -1,11 +1,54 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger/index.ts
+/**
+* Per-app logger options, resolved from the async context.
+*
+* The process-global below is a FALLBACK, not the source of truth. It used to
+* be both, and `configureArcLogger` overwrote it on every boot — so the
+* last-created app owned the writer for every app in the process. One app's
+* framework warnings then surfaced through another app's transports, level,
+* and redaction config. Fine for one-app-per-process; wrong for multi-app test
+* files and for serverless containers that reuse a warm process across apps.
+*
+* Follows the same shape as `requestContext`: the scope is entered once and
+* wraps everything downstream, so the 23 `arcLog()` call sites keep their
+* zero-argument signature and resolve correctly without threading a logger.
+*/
+const scope = new AsyncLocalStorage();
 let globalOptions = {};
+/** Active options: the app's if we're inside one, else the process fallback. */
+function resolveOptions() {
+	return scope.getStore() ?? globalOptions;
+}
+/**
+* Run `fn` with `options` as the active logger config.
+*
+* `options` is held BY REFERENCE deliberately: `createApp` enters the scope
+* before Fastify exists, then fills in the pino writer once `fastify.log` is
+* constructed. Copying here would freeze the pre-Fastify view and send every
+* post-construction boot warning to the console instead of the app's logger.
+*/
+function runWithArcLogger(options, fn) {
+	return scope.run(options, fn);
+}
+/**
+* Enter `options` for the remainder of the current async context.
+*
+* For Fastify's `onRequest` hook, where `run(store, done)` wraps the rest of
+* the request lifecycle. Outside a hook, prefer {@link runWithArcLogger}.
+*/
+function enterArcLoggerScope(options, done) {
+	scope.run(options, done);
+}
 /**
-* Configure the Arc logger globally.
+* Configure the PROCESS-GLOBAL Arc logger — the fallback used outside any app.
 *
-* Called automatically by `createApp({ debug })`, but can also be
-* called manually for standalone usage outside of `createApp`.
+* `createApp` no longer routes its writer through here; each app carries its
+* own scoped options (see {@link runWithArcLogger}) so two apps in one process
+* cannot overwrite each other's. This remains the way to configure arcLog for
+* standalone use — `defineResource()` at module import, CLI commands, and any
+* code running before or outside a `createApp` boot.
 */
 function configureArcLogger(options) {
 	globalOptions = { ...options };
@@ -84,10 +127,10 @@ function createPinoWriter(logger) {
 	};
 }
 function getWriter() {
-	return globalOptions.writer ?? console;
+	return resolveOptions().writer ?? console;
 }
 function isDebugEnabled(module) {
-	const configDebug = globalOptions.debug;
+	const configDebug = resolveOptions().debug;
 	if (configDebug !== void 0 && configDebug !== false) return matchesModule(configDebug, module);
 	const envDebug = typeof process !== "undefined" ? process.env?.ARC_DEBUG : void 0;
 	if (envDebug) return matchesModule(envDebug, module);
@@ -107,4 +150,4 @@ function isSuppressed() {
 	return env === "1" || env === "true";
 }
 //#endregion
-export { arcLog, configureArcLogger, createPinoWriter };
+export { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger };

package/dist/{mcpPlugin-DX3PHD7K.mjs → mcpPlugin-DkzZ7Nfx.mjs}

@@ -1,19 +1,18 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { p as isArcError, t as ArcError } from "./errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as BaseController } from "./BaseController-CbkuhNI2.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
-import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
-import { n as executeAggregation } from "./buildHandler-BrdYrG_1.mjs";
-import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
-import { t as createIdempotencyResult } from "./interface-DznJrm9R.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-DYXBBgtg.mjs";
+import { p as isArcError, t as ArcError } from "./errors-CLid6atr.mjs";
+import { n as requireSingleHeaderValue } from "./headers-DODWf7aC.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-GY4kATJb.mjs";
+import { t as BaseController } from "./BaseController-C-pofd0v.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-UtpiJO5R.mjs";
+import { t as executePipeline } from "./pipe-DNOuCfAs.mjs";
+import { t as buildRequestScopeProjection } from "./projection-aevMua7Q.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-LFuOra7W.mjs";
+import { n as validateAggregations } from "./validate-dosAIvQU.mjs";
+import { n as executeAggregation } from "./buildHandler-Do9aMIvL.mjs";
+import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
+import { t as createIdempotencyResult } from "./interface-my7sxjw5.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-s3-ouZmP.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/{memory-qYSB7rMQ.mjs → memory-BwedEXau.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-D7uchLjN.mjs → metrics-5LNPvL3P.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BcR2bFZQ.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-C5K78SXo.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BxCoxmiN.mjs";
-import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-BhzLXCfN.mjs";
+import { t as multipartBody } from "../multipartBody-DjilSDAT.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-BnWtbA2U.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-5ESPMxp0.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -160,12 +160,14 @@ var MigrationRunner = class {
 	async withLock(fn) {
 		const lock = this.lock;
 		if (!lock) return fn(() => false);
-		if (!await lock.tryAcquire(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs)) throw new Error(`MigrationRunner: another runner holds the migration lock — refusing to run concurrently. If a previous runner crashed, the lease expires on its own (leaseMs: ${this.lockLeaseMs}).`);
+		const fenced = await lock.tryAcquireFenced?.(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs);
+		if (!(fenced !== void 0 ? fenced !== null : await lock.tryAcquire(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs))) throw new Error(`MigrationRunner: another runner holds the migration lock — refusing to run concurrently. If a previous runner crashed, the lease expires on its own (leaseMs: ${this.lockLeaseMs}).`);
 		const lease = startRenewingLease({
 			lock,
 			name: MIGRATION_LOCK_NAME,
 			holderId: this.holderId,
 			leaseMs: this.lockLeaseMs,
+			...fenced ? { token: fenced.token } : {},
 			onLost: () => this.log.error("MigrationRunner: lease renewal lost — another holder took the migration lock; no further migrations will start and this run will fail."),
 			onError: (error) => this.log.error(`MigrationRunner: lease renewal errored (lease may lapse mid-run): ${error.message}`)
 		});
@@ -230,7 +232,7 @@ var MigrationRunner = class {
 	* Rollback last migration
 	*/
 	async down(migrations) {
-		await this.withLock(async () => {
+		await this.withLock(async (leaseLost) => {
 			const applied = await this.store.getApplied();
 			const last = applied[applied.length - 1];
 			if (!last) {
@@ -239,6 +241,7 @@ var MigrationRunner = class {
 			}
 			const migration = migrations.find((m) => m.resource === last.resource && m.version === last.version);
 			if (!migration) throw new Error(`Migration ${last.resource}:${last.version} not found in migration files`);
+			if (leaseLost()) throw new Error("MigrationRunner: refusing to roll back — lock ownership lost between acquiring the lease and starting the rollback.");
 			this.log.info(`Rolling back ${migration.resource} v${migration.version}...`);
 			await this.runMigration(migration, "down", true);
 			this.log.info("Rollback completed");

package/dist/{module-CwKsgZXp.mjs → module-Bh5OC7ww.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-4w-S3-PU.mjs → multipartBody-DjilSDAT.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-CkV5mQ53.mjs → openapi-ItLH12_L.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-XH1RZRyu.mjs";
-import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-D6T0jWhS.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-D2_bHGil.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-LFuOra7W.mjs";
+import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-EYWgd0ly.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { t as ArcModule } from "../types-BcTumAz_.mjs";
+import { l as PermissionCheck } from "../base-GZU3LlzP.mjs";
+import { t as ArcModule } from "../types-DDD5RKTu.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-CLid6atr.mjs";
+import { t as defineResource } from "../defineResource-BOrGeocE.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-Bh5OC7ww.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-D1QfHqO4.mjs → outbox-module-SGIZz6oS.mjs}

@@ -1,6 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as resolveEventTransport } from "./EventTransport-tq4CEB-q.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-B88p99Z2.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-BTZzEcRo.mjs";
+import { i as resolveEventTransport } from "./EventTransport-BrPeGUil.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-kIJCY0wI.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
@@ -822,7 +823,8 @@ function createOutboxModule(options) {
 							...info.event?.type !== void 0 ? { eventType: info.event.type } : {}
 						}, `outbox relay "${name}" failed`);
 					}),
-					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {}
+					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {},
+					...options.sessionProvider === false ? {} : { sessionProvider: options.sessionProvider ?? (() => transactionContext.get()) }
 				})
 			};
 			return exports;

package/dist/{outbox-module-C1Bs_FXF.d.mts → outbox-module-b1TyDGGi.d.mts}

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-BEVP50ka.mjs";
-import { t as ArcModule } from "./types-BcTumAz_.mjs";
+import { t as ArcModule } from "./types-DDD5RKTu.mjs";
 import { FastifyInstance } from "fastify";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 import { OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";
@@ -336,6 +336,29 @@ interface OutboxModuleOptions {
    * shape is exponential backoff up to N attempts, then dead-letter.
    */
   failurePolicy?: OutboxFailurePolicy;
+  /**
+   * Unit-of-Work session provider. Defaults to `() => transactionContext.get()`.
+   *
+   * This is what makes the durable path the DEFAULT path rather than a
+   * discipline. `EventOutbox.store()` already auto-injects a session from this
+   * provider (explicit `options.session` still wins), and a `transactional:
+   * true` write now publishes its session on `transactionContext` — so with
+   * the default in place, `outbox.store(event)` inside a transactional write
+   * commits the event row atomically with the domain write. No threading the
+   * handle from the controller through every service layer to the call site.
+   *
+   * The default matters more than the capability: `auditPlugin` has defaulted
+   * its `sessionProvider` the same way since it shipped, while this module
+   * required every host to remember. A host that forgets does not get an
+   * error — it gets an event row written outside the transaction, which
+   * survives a rollback and reports something that never happened. That is
+   * precisely the guarantee an outbox exists to provide.
+   *
+   * Pass `false` (or `() => undefined`) to opt out — for a store whose
+   * writes must NOT join the caller's transaction (a separate connection,
+   * an external queue).
+   */
+  sessionProvider?: (() => unknown) | false;
   /**
    * Run one relay pass at boot. Default `true` — a process that restarts with a backlog should
    * drain it immediately rather than waiting a full interval, because that backlog is precisely

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-Csjc2oF-.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-GZU3LlzP.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-B-DvUzsr.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-K7auNNW0.mjs";
 export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-CMMLWmuZ.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CojeUkS4.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-DYXBBgtg.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-AKcB4V03.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-UtpiJO5R.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-CpSBlFXZ.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-CP47jdi7.mjs → permissions-CpSBlFXZ.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as MemoryCacheStore } from "./memory-qYSB7rMQ.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-DYXBBgtg.mjs";
+import { n as getUserRoles } from "./userHelpers-AKcB4V03.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-GY4kATJb.mjs";
+import { t as MemoryCacheStore } from "./memory-BwedEXau.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**

package/dist/{pipe-BzzoEhHj.mjs → pipe-DNOuCfAs.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-Cd_yy7aW.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-CLid6atr.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.

package/dist/pipeline/index.d.mts

@@ -1,5 +1,5 @@
 
-import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-BcR2bFZQ.mjs";
+import { Ct as PipelineStep, Fn as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-C5K78SXo.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-BzzoEhHj.mjs";
+/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-DNOuCfAs.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/plugins/index.d.mts

@@ -1,10 +1,10 @@
 
-import { t as AnyRecord } from "../base-Csjc2oF-.mjs";
-import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-BcR2bFZQ.mjs";
+import { t as AnyRecord } from "../base-GZU3LlzP.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-C5K78SXo.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DI5AN2b5.mjs";
-import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$7, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-BcTumAz_.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-DVsTAy6X.mjs";
-import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DEs-_hFi.mjs";
+import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$8, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-DDD5RKTu.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-CMMTL3cj.mjs";
+import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$6, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$9, n as _default$10, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DEs-_hFi.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -89,6 +89,91 @@ declare module "fastify" {
 }
 declare const _default$2: FastifyPluginAsync<GracefulShutdownOptions>;
 //#endregion
+//#region src/plugins/pressure.d.ts
+/**
+ * One measurable source of load, normalised by whoever owns it.
+ *
+ * A throwing `read()` reports 0, never 1 — a broken thermometer is not a fire.
+ * Logged once per signal, not per sample.
+ */
+interface PressureSignal {
+  /** Stable identity — appears in snapshots and logs. */
+  readonly name: string;
+  /** Saturation in [0, 1]. Values outside the range are clamped. */
+  read(): number | Promise<number>;
+}
+/** `ok` → serve · `degraded` → serve, shed what is optional · `saturated` → refuse. */
+type PressureState = "ok" | "degraded" | "saturated";
+interface PressureThresholds {
+  /** Enter `degraded` at or above this. Default 0.8. */
+  degraded?: number;
+  /** Enter `saturated` at or above this. Default 0.95. */
+  saturated?: number;
+}
+interface PressureSnapshot {
+  readonly state: PressureState;
+  /** Highest signal — the one that decided the state. */
+  readonly worst: {
+    name: string;
+    value: number;
+  } | undefined;
+  readonly signals: Readonly<Record<string, number>>;
+}
+interface PressureOptions {
+  /** Extra signals beyond the built-in ELU reader. */
+  signals?: PressureSignal[];
+  thresholds?: PressureThresholds;
+  /** Sampling cadence in ms. Default 1000. */
+  intervalMs?: number;
+  /** Include the built-in event-loop-utilisation signal. Default true. */
+  eventLoopUtilization?: boolean;
+  /** Fired when the state CHANGES — not on every sample. */
+  onStateChange?: (next: PressureState, snapshot: PressureSnapshot) => void;
+  /**
+   * Refuse with 503 while `saturated`. Default OFF — arc cannot know which
+   * routes are sheddable, and refusing a checkout because a dashboard drained
+   * the pool is worse than serving it slowly.
+   *
+   * `exclude` matches `request.url` by prefix. Health routes are ALWAYS exempt:
+   * a 503 on `/_health/ready` reads as "process dead", not "process full".
+   */
+  shed?: boolean | {
+    statusCode?: number;
+    retryAfterSeconds?: number;
+    exclude?: string[];
+  };
+}
+interface PressureApi {
+  state(): PressureState;
+  snapshot(): PressureSnapshot;
+  /** Register a signal after boot — for modules that resolve their source late. */
+  register(signal: PressureSignal): void;
+  /** True at `saturated`. The check a handler makes before admitting work. */
+  shouldShed(): boolean;
+  /**
+   * A readiness check for `healthPlugin({ checks })`. NOT auto-registered:
+   * flipping readiness pulls the instance from its load balancer — right in a
+   * fleet, a self-inflicted outage for a single instance. Unhealthy only at
+   * `saturated`; `degraded` still serves.
+   */
+  readinessCheck(options?: {
+    name?: string;
+    critical?: boolean;
+  }): HealthCheck;
+}
+declare module "fastify" {
+  interface FastifyInstance {
+    pressure: PressureApi;
+  }
+}
+declare const pressurePlugin: FastifyPluginAsync<PressureOptions>;
+/**
+ * `fp()`-wrapped so `fastify.pressure` is visible to the whole app rather than
+ * trapped in this plugin's encapsulation context — the named export above is
+ * the raw plugin, matching every other arc plugin entry.
+ */
+declare const _default$5: FastifyPluginAsync<PressureOptions>;
+//#endregion
 //#region src/plugins/replyHelpers.d.ts
 declare module "fastify" {
   interface FastifyReply {
@@ -166,6 +251,6 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
   headers: Record<string, string | string[] | undefined>;
 }) => string;
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
-declare const _default$6: FastifyPluginAsync<RequestIdOptions>;
+declare const _default$7: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$6 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$7 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$8 as ssePlugin, ssePlugin as ssePluginFn, _default$9 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type PressureApi, type PressureOptions, type PressureSignal, type PressureSnapshot, type PressureState, type PressureThresholds, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as pressurePlugin, pressurePlugin as pressurePluginFn, _default$6 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$7 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$8 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$9 as ssePlugin, ssePlugin as ssePluginFn, _default$10 as versioningPlugin, versioningPlugin as versioningPluginFn };