@classytic/arc 2.34.0 → 2.36.0

package/dist/idempotency/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-CveNO9gR.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-B88p99Z2.mjs";
-import { t as createIdempotencyResult } from "../interface-DznJrm9R.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-DKslnhey.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-Brt8OxWZ.mjs";
+import { t as createIdempotencyResult } from "../interface-B7awDx3b.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
@@ -266,61 +266,27 @@ var MemoryIdempotencyStore = class {
 //#endregion
 //#region src/idempotency/idempotencyPlugin.ts
 /**
-* Idempotency Plugin
+* Idempotency — duplicate-request protection for mutations.
 *
-* Duplicate request protection for mutating operations.
-* Uses idempotency keys to ensure safe retries.
+* AUTH ORDER MATTERS: `idempotency.middleware` must run AFTER authentication
+* in the preHandler chain, so the fingerprint includes the real caller and a
+* key cannot replay another user's response. `createCrudRouter` wires this for
+* mutation routes; custom routes do it themselves:
+* `preHandler: [fastify.authenticate, fastify.idempotency.middleware]`.
 *
-* ## Auth Safety
+* GUARANTEE — best-effort effectively-once, NOT exactly-once. A distributed
+* lock makes concurrent same-key requests 409, the key includes a body+caller
+* fingerprint (a different body under one key is its own operation), and a
+* completed result replays. The business effect is not exactly-once, because
+* the domain write and the idempotency record are different systems:
+* - a crash after the DB write but before the record (preSerialization) lets a
+*   retry re-execute;
+* - a handler outrunning `lockTimeoutMs` can overlap its own retry — size that
+*   above the slowest protected handler.
 *
-* The idempotency check runs as a **route-level middleware**
-* (`idempotency.middleware`) that must be wired AFTER authentication in the
-* preHandler chain. This ensures the fingerprint includes the real caller
-* identity, preventing cross-user replay attacks.
-*
-* Arc's `createCrudRouter` does this automatically for mutation routes.
-* For custom routes, wire it manually:
-*
-* ```typescript
-* fastify.post('/orders', {
-*   preHandler: [fastify.authenticate, fastify.idempotency.middleware],
-* }, handler);
-* ```
-*
-* @example
-* import { idempotencyPlugin } from '@classytic/arc/idempotency';
-*
-* await fastify.register(idempotencyPlugin, {
-*   enabled: true,
-*   headerName: 'idempotency-key',
-*   ttlMs: 86400000, // 24 hours
-* });
-*
-* // Client sends:
-* // POST /api/orders
-* // Idempotency-Key: order-123-abc
-*
-* // If same key sent again within TTL, returns cached response
-*
-* ## Guarantee: best-effort effectively-once, NOT exactly-once
-*
-* The plugin gives strong request replay + overlap protection: a
-* distributed lock guards execution (concurrent same-key requests get
-* 409), the store key includes a body/caller fingerprint (a different
-* body under the same key executes as its own operation instead of
-* replaying someone else's response), and a completed result replays on
-* hit. It does NOT make the business effect exactly-once, because the
-* domain write and the idempotency record live in different systems:
-*
-*  - a crash after the DB mutation but before the result is recorded
-*    (preSerialization) lets a retry re-execute the mutation;
-*  - a handler that outruns `lockTimeoutMs` can overlap its own retry —
-*    size the lock timeout above the slowest protected handler.
-*
-* For mutations where re-execution is unacceptable, write the idempotency
-* record in the SAME transaction as the business write inside the handler
-* (the store contract is public — `@classytic/arc/idempotency` exports it),
-* or make the handler naturally idempotent (upserts, compare-and-set).
+* Where re-execution is unacceptable: write the record in the SAME transaction
+* as the business write (the store contract is exported), or make the handler
+* naturally idempotent (upsert, compare-and-set).
 */
 const HEADER_IDEMPOTENCY_REPLAYED = "x-idempotency-replayed";
 const HEADER_IDEMPOTENCY_KEY = "x-idempotency-key";

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-B-DvUzsr.d.mts → index-BtYoMip1.d.mts}

@@ -1,6 +1,6 @@
 
-import { i as RequestScope, n as Mandate } from "./types-ChuShpCP.mjs";
-import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-Csjc2oF-.mjs";
+import { i as RequestScope, n as Mandate } from "./types-Ddl9OjmE.mjs";
+import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-C-NL2fTi.mjs";
 import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
@@ -567,6 +567,14 @@ type PermissionRequirement = {
   readonly conditional?: boolean;
 } | {
   readonly kind: "authenticated";
+} |
+/**
+ * Nobody passes — an explicit `denyAll()`. Distinct from "no rule found",
+ * which is `public` (public-by-omission): one is a closed door, the other is
+ * an open one, and before this existed both were reported as `authenticated`.
+ */
+{
+  readonly kind: "denied";
 };
 /**
  * Extract a check's static requirement from its `PermissionCheckMeta`. Public
@@ -991,7 +999,17 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
 //#region src/permissions/matrix.d.ts
-type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped";
+/**
+ * `denied` is a CLOSED door — an explicit `denyAll()`. It is not the same as
+ * "no rule found", which surfaces as `public` (public-by-omission). Before it
+ * existed a denyAll gate was reported as `authenticated`, so a permission UI
+ * rendered the action for every signed-in user and the server refused every
+ * attempt.
+ *
+ * A CLIENT MUST treat an unrecognised type as DENIED, never as permitted — the
+ * next type added here will otherwise read as "allowed" on every older client.
+ */
+type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped" | "denied";
 interface PermissionEntry {
   type: PermissionEntryType;
   roles: string[];

package/dist/{index-BcR2bFZQ.d.mts → index-C01wWGJt.d.mts}

@@ -1,6 +1,6 @@
 
-import { P as ArcHeaders, i as RequestScope } from "./types-ChuShpCP.mjs";
-import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-Csjc2oF-.mjs";
+import { P as ArcHeaders, i as RequestScope } from "./types-Ddl9OjmE.mjs";
+import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
 import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
 import "./elevation-BXCfVcNG.mjs";
 import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";
@@ -1343,7 +1343,7 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    * wants downstream after-handlers to receive — typically the result for
    * create/update, the original input (`existing`) for delete.
    */
-  protected runAfterHook(req: IRequestContext, op: "create" | "update" | "delete", data: AnyRecord, meta?: Record<string, unknown>): Promise<void>;
+  protected runAfterHook(req: IRequestContext, op: "create" | "update" | "delete" | "list" | "read", data: AnyRecord, meta?: Record<string, unknown>): Promise<void>;
   /**
    * Per-instance single-flight for cache fills — concurrent requests for
    * the SAME cache key coalesce onto one repository query instead of each
@@ -1470,70 +1470,28 @@ declare function SoftDeleteMixin<TBase extends Constructor<BaseCrudController>>(
  * Fully-composed controller shape: all CRUD methods + every preset method
  * (SoftDelete / Tree / Slug / Bulk) typed over the caller-supplied `TDoc`.
  *
- * **Inheritance summary** (what hover-docs should show when you reach for
- * a method):
+ * Composes `BaseCrudController` (list/get/create/update/delete) → `BulkMixin`
+ * (bulk*) → `SlugMixin` (getBySlug) → `TreeMixin` (getTree/getChildren) →
+ * `SoftDeleteMixin` (getDeleted/restore). CRUD-only hosts extend
+ * `BaseCrudController` for a smaller surface; others compose mixins by hand.
  *
- *   `BaseController<TDoc>`
- *     └─ composes: `BaseCrudController` → `BulkMixin` → `SlugMixin` → `TreeMixin` → `SoftDeleteMixin`
+ * DECLARATION MERGING, not a generic mixin chain: TypeScript cannot thread one
+ * `TDoc` through four chained mixin factories without losing the
+ * `extends Constructor<Base>` constraint. So the runtime pins the chain base to
+ * `AnyRecord` while the TYPE surface threads `TDoc`, and merging bridges them.
  *
- *   - From `BaseCrudController`: `list`, `get`, `create`, `update`, `delete`
- *   - From `BulkMixin`: `bulkCreate`, `bulkUpdate`, `bulkDelete`
- *   - From `SlugMixin`: `getBySlug`
- *   - From `TreeMixin`: `getTree`, `getChildren`
- *   - From `SoftDeleteMixin`: `getDeleted`, `restore`
+ * `TDoc extends AnyRecord` is LOAD-BEARING: inherited methods return
+ * `ListResult<AnyRecord>` and the merged interface returns `ListResult<TDoc>`,
+ * so TS's derived-assignable-to-base check needs the bound. Without it the
+ * class declaration fails with `Type 'TDoc[]' is not assignable to type
+ * 'AnyRecord[]'`. Hosts pick one of:
+ *   (a) drop the generic — lose return narrowing;
+ *   (b) `interface IUser extends AnyRecord` — preferred when you own the type;
+ *   (c) `ArcListResult<typeof this>` etc. when overriding — reads the return
+ *       type off the class, so the bound never applies.
  *
- *   Hosts that only need CRUD extend `BaseCrudController` directly for a
- *   smaller surface. Hosts that want specific mixins compose them by hand
- *   (e.g. `class X extends SoftDeleteMixin(BaseCrudController<Doc>)`).
- *
- * ──────────────────────────────────────────────────────────────────────────
- * ADR — why declaration merging + why `TDoc` carries `extends AnyRecord`
- * ──────────────────────────────────────────────────────────────────────────
- * The natural reflex is:
- *
- *   class BaseController<TDoc> extends SoftDelete(Tree(Slug(Bulk(BaseCrud<TDoc>)))) {}
- *
- * TypeScript rejects this. Mixin factories can't receive a generic type
- * parameter from the derived class (TS4.0 added limited support, but
- * chained mixins over 4 levels deep still break because each factory
- * would need its own TDoc binding — TS can't infer a shared `TDoc` across
- * the chain without losing the base `extends Constructor<Base>` constraint).
- *
- * The composed runtime pins `BaseCrudController` to `AnyRecord` at the
- * mixin-chain base; the TYPE surface hosts interact with threads `TDoc` so
- * `new BaseController<Product>().list(req)` returns
- * `Promise<IControllerResponse<ListResult<Product>>>` and not
- * `ListResult<AnyRecord>`. Declaration merging bridges the two.
- *
- * **Why `TDoc extends AnyRecord` IS load-bearing:** the derived class
- * inherits the mixin-composed base which is pinned to `AnyRecord`.
- * Inherited methods return `ListResult<AnyRecord>` and the derived
- * interface returns `ListResult<TDoc>`. For TS's "derived is assignable
- * to base" check to pass, `TDoc` must be assignable to `AnyRecord` —
- * which requires the `extends AnyRecord` bound. Dropping the bound fails
- * with `Type 'TDoc[]' is not assignable to type 'AnyRecord[]'` at the
- * class declaration. Hosts therefore need one of:
- *   (a) `class X extends BaseController { ... }` — drop the generic,
- *       lose return-type narrowing for `list` / `get` / etc.
- *   (b) `interface IUser extends AnyRecord { ... }` — add an index
- *       signature to the domain interface (preferred when you own it).
- *   (c) Use the utility types (`ArcListResult<typeof this>`,
- *       `ArcCreateResult<typeof this>`) when overriding methods — they
- *       read the return type from the class, sidestepping the bound
- *       for method bodies even when `TDoc` is unbound elsewhere.
- *
- * **Why `TRepository` defaults to `RepositoryLike<TDoc>`:** keeps
- * diagnostics symmetric. With the older `RepositoryLike = RepositoryLike<unknown>`
- * default, error messages mixed `AnyRecord` and `unknown` in the same
- * signature, which confused the reader about where the mismatch was.
- *
- * **Cost this pays:** every method that participates in the `TDoc`
- * narrowing is redeclared on the interface. Adding a new method to a
- * mixin means updating this interface too. The alternative (losing
- * host-side generics OR rewriting mixins as a non-generic union) is
- * strictly worse.
- *
- * Spec reference: https://www.typescriptlang.org/docs/handbook/declaration-merging.html#merging-classes-with-other-types
+ * COST: every `TDoc`-narrowed method is redeclared on the interface, so a new
+ * mixin method must be added here too.
  */
 interface BaseController<TDoc extends AnyRecord = AnyRecord, _TRepository extends RepositoryLike = RepositoryLike<TDoc>> {
   accessControl: AccessControl;
@@ -3333,47 +3291,17 @@ interface ResourceConfig<TDoc = AnyRecord> {
    */
   tenantField?: string | false;
   /**
-   * Tenant-cleanup declaration — what `cascadeDeleteForOrganization`
-   * does with this resource's rows when an organization is deleted.
-   * Required for the resource to participate in the cascade; unflagged
-   * resources are never touched.
-   *
-   *   - `{ strategy: { type: 'hard' } }` — permanent delete (GDPR).
-   *   - `{ strategy: { type: 'soft' } }` — set `deleted: true` + `deletedAt`
-   *     (recoverable; pair with TTL for eventual hard-purge).
-   *   - `{ strategy: { type: 'anonymize', fields: { name: '[REDACTED]', email: null } } }`
-   *     — keep the row (legal retention) but clear PII linkage. HIPAA /
-   *     PCI / SOX-compatible. Field values can be static or `(doc) =>
-   *     value` for derived patches (hashes, etc.).
-   *   - `{ strategy: { type: 'skip', reason: 'audit-retained-per-SOX' } }`
-   *     — explicit opt-out with **mandatory** reason. Surfaces in audit reports.
-   *
-   * **Priority** — lower runs first. Default `100`. Use to land leaf data
-   * before aggregate references:
-   *   - `10`  : bulk leaf data (events, logs)
-   *   - `50`  : business entities (orders, invoices)
-   *   - `100` : default
-   *
-   * Priority groups are barriers even under concurrency — all
-   * priority-10 resources finish before any priority-50 starts.
-   *
-   * **Batch size** — rows per chunk for the underlying `purgeByField`
-   * call. Default kit-specific (~1000). Tune for very large tenants.
-   *
-   * @example Compliance-retained financial ledger
-   * ```ts
-   * defineResource({
-   *   name: 'invoice',
-   *   tenantField: 'organizationId',
-   *   onTenantDelete: {
-   *     strategy: {
-   *       type: 'anonymize',
-   *       fields: { customerName: '[REDACTED]', customerEmail: null },
-   *     },
-   *     priority: 50,
-   *   },
-   * });
-   * ```
+   * How `cascadeDeleteForOrganization` treats this resource's rows. Absent
+   * means the resource is NEVER touched by the cascade — participation is
+   * opt-in. Strategies: `hard` (GDPR erase) · `soft` (`deleted`+`deletedAt`,
+   * pair with a TTL) · `anonymize` (keep the row for legal retention, clear
+   * PII; values static or `(doc) => value`) · `skip` (explicit opt-out,
+   * `reason` MANDATORY and surfaced in audit reports).
+   *
+   * `priority` (default 100) orders leaf data before aggregates — 10 bulk
+   * logs, 50 business entities. Groups are BARRIERS: every priority-10
+   * resource finishes before any priority-50 starts. `batchSize` chunks the
+   * underlying `purgeByField` (kit default ~1000).
    */
   onTenantDelete?: OnTenantDeleteConfig;
   /**

package/dist/{index-C5NnMEKF.d.mts → index-C50BUxKs.d.mts}

@@ -1,5 +1,5 @@
 
-import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BcTumAz_.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-DDD5RKTu.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**

package/dist/{index-CFAJEWCX.d.mts → index-RdpLP71b.d.mts}

@@ -1,8 +1,8 @@
 
-import { i as RequestScope } from "./types-ChuShpCP.mjs";
-import { l as PermissionCheck, t as AnyRecord } from "./base-Csjc2oF-.mjs";
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-BcR2bFZQ.mjs";
-import "./fastify-augmentation-DVsTAy6X.mjs";
+import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
+import { l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-C01wWGJt.mjs";
+import "./fastify-augmentation-Bk_9PoiV.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";
@@ -70,40 +70,17 @@ declare const RESERVED_QUERY_PARAMS: Readonly<Set<string>>;
  * `defineResource({ aggregations: { ... } })` either as named keys or
  * via auto-discovery patterns (loadAggregations — future).
  *
- * @example Inline
- * ```ts
- * defineResource({
- *   name: 'order',
- *   aggregations: {
- *     revenueByStatus: defineAggregation({
- *       groupBy: 'status',
- *       measures: { count: 'count', revenue: 'sum:totalPrice' },
- *       permissions: requireRoles(['admin']),
- *     }),
- *   },
- * });
- * ```
+ * A namespace import lets many live in their own files and flow in at once
+ * (`import * as aggregations` → `defineResource({ aggregations })`).
  *
- * @example Multi-file
+ * @example
  * ```ts
- * // orders/aggregations/revenue-by-status.ts
- * import { defineAggregation } from '@classytic/arc';
- *
  * export const revenueByStatus = defineAggregation({
  *   groupBy: 'status',
  *   measures: { count: 'count', revenue: 'sum:totalPrice' },
  *   permissions: requireRoles(['admin']),
- *   timeout: 5000,
  *   cache: { staleTime: 60 },
  * });
- *
- * // orders/order.resource.ts
- * import * as aggregations from './aggregations/index.js';
- *
- * defineResource({
- *   name: 'order',
- *   aggregations,                                  // 30+ entries flow in
- * });
  * ```
  */
 declare function defineAggregation(config: AggregationConfig): AggregationConfig;

package/dist/{index-ugr1tQlW.d.mts → index-eyg5WEcy.d.mts}

@@ -1,5 +1,5 @@
 
-import { l as PermissionCheck } from "./base-Csjc2oF-.mjs";
+import { l as PermissionCheck } from "./base-C-NL2fTi.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/integrations/jobs/execution.d.ts
 /**

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-Csjc2oF-.mjs";
-import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-BcR2bFZQ.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-C-NL2fTi.mjs";
+import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-C01wWGJt.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-DVsTAy6X.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-CFAJEWCX.mjs";
-import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-B-DvUzsr.mjs";
+import "./fastify-augmentation-Bk_9PoiV.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-RdpLP71b.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-BtYoMip1.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,15 +1,14 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BxCoxmiN.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Cd_yy7aW.mjs";
-import { t as nativePolicyFilter } from "./repositoryFilter-BANpz6BX.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CbkuhNI2.mjs";
-import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-ZhuLonLm.mjs";
-import { c as getControllerScope } from "./pipeline-q69DZzgG.mjs";
-import { t as defineAggregation } from "./defineAggregation-Nv-DwfOf.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BYKa8wHu.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DUoKAGYD.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DDKni6Tz.mjs";
+import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-CTJKm6Cb.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-DdP225wt.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-DWzjyxb2.mjs";
+import { l as getControllerScope } from "./actionPermissions-D97DniUQ.mjs";
+import { t as defineAggregation } from "./defineAggregation-CpQfcM8R.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-DTXsiNTJ.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-DgPrZsJh.mjs";
 //#region src/index.ts
-const version = "2.34.0";
+const version = "2.36.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-mdJ-v4Xp.mjs → init-LuGxIbQ_.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-Cf0jUHsh.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-Bxt03Hk5.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,8 +1,8 @@
 
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
-import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-ugr1tQlW.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-BfC83KsP.mjs";
+import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-eyg5WEcy.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-BXnTOsXP.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.d.mts

@@ -1,3 +1,3 @@
 
-import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-ugr1tQlW.mjs";
+import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-eyg5WEcy.mjs";
 export { type ExecuteTimedHandlerOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobRepeatOptions, type JobStatus, type JobsPluginOptions, type QueueStats, type TimedHandlerLogger, defineJob, executeTimedHandler, jobsPlugin };

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-CMMLWmuZ.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-EsiY3nUu.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.d.mts

@@ -1,9 +1,9 @@
 
-import { i as RequestScope } from "../../types-ChuShpCP.mjs";
-import { l as PermissionCheck } from "../../base-Csjc2oF-.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-BcR2bFZQ.mjs";
+import { i as RequestScope } from "../../types-Ddl9OjmE.mjs";
+import { l as PermissionCheck } from "../../base-C-NL2fTi.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-C01wWGJt.mjs";
 import { n as FieldPermissionMap } from "../../fields-I_EeRWND.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-BfC83KsP.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-BXnTOsXP.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-DX3PHD7K.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-NxSlc-Ks.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,5 +1,5 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-BfC83KsP.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-BXnTOsXP.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-DX3PHD7K.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-NxSlc-Ks.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities
@@ -50,7 +50,7 @@ async function createTestMcpClient(options = {}) {
 		resources: [],
 		...options.pluginOptions
 	};
-	const auth = options.auth ?? { userId: "test-user" };
+	const auth = options.auth === void 0 ? { userId: "test-user" } : options.auth;
 	const serverName = options.serverName ?? "test-mcp";
 	const overrides = pluginOpts.overrides ?? {};
 	const tools = filterResourcesForMcp(pluginOpts.resources ?? [], {

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-Cd_yy7aW.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DsT1B5zJ.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-DDKni6Tz.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-CiTJW8kZ.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-C1Bs_FXF.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-b1TyDGGi.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
@@ -310,6 +310,8 @@ interface WebhookDeliveryTransportOptions {
    * an allowed URL can't 302 into a blocked target; a rejection is permanent.
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
+  /** Resolve private auth headers at delivery time; reserved Arc headers cannot be replaced. */
+  resolveHeaders?: (subscription: WebhookSubscription, event: WebhookDeliveryPayload["event"]) => Record<string, string> | Promise<Record<string, string>>;
 }
 /**
  * Publish-only `EventTransport` whose `publish()` IS the webhook POST —
@@ -338,7 +340,7 @@ interface WebhookDeliveryPolicyOptions {
  * retry on exponential backoff until `maxAttempts`, then dead-letter.
  */
 declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
-interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl"> {
+interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
   /** Module name / `dependsOn` key. Default `'webhook-delivery'`. */
   name?: string;
   /** Retry/backoff tuning for the default failure policy. */