@classytic/arc 2.34.0 → 2.36.0

package/dist/integrations/webhooks.mjs

@@ -1,37 +1,24 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-Dm88DaTW.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-D1QfHqO4.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-jK99Ciw_.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-ClcFrq98.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent } from "@classytic/primitives/events";
 //#region src/integrations/webhooks.ts
 /**
-* @classytic/arc — Webhook Outbound Integration
+* Outbound webhooks — auto-dispatch arc events to registered endpoints with
+* HMAC-SHA256 signing, delivery logging, and a pluggable `WebhookStore`.
 *
-* Fastify plugin that auto-dispatches Arc events to registered webhook
-* endpoints with HMAC-SHA256 signing, delivery logging, and pluggable
-* persistence via WebhookStore.
-*
-* This is a SEPARATE subpath import — only loaded when explicitly used:
-*   import { webhookPlugin } from '@classytic/arc/integrations/webhooks';
+* A separate subpath, loaded only when used:
+* `@classytic/arc/integrations/webhooks`. For at-least-once delivery use
+* `durable: { store }` / `createDurableWebhookModule` — the in-process retry
+* is explicitly best-effort.
 *
 * @example
 * ```typescript
-* import { webhookPlugin } from '@classytic/arc/integrations/webhooks';
-*
 * await fastify.register(webhookPlugin);
-*
-* // Register a customer webhook
-* app.webhooks.register({
-*   id: 'wh-1',
-*   url: 'https://customer.com/webhook',
-*   events: ['order.created', 'order.shipped'],
-*   secret: 'whsec_abc123',
-* });
-*
-* // Events auto-dispatch — no manual wiring needed
-* await app.events.publish('order.created', { orderId: '123' });
-* // → POST https://customer.com/webhook with HMAC signature
+* app.webhooks.register({ id: 'wh-1', url, events: ['order.created'], secret });
+* await app.events.publish('order.created', { orderId: '123' }); // → signed POST
 * ```
 */
 /**
@@ -442,6 +429,8 @@ function createWebhookDeliveryTransport(options) {
 				timestamp,
 				deliveryId: payload.event.meta.id
 			});
+			const extraHeaders = options.resolveHeaders ? await options.resolveHeaders(sub, payload.event) : {};
+			assertWebhookHeaderOverrides(extraHeaders);
 			const ac = new AbortController();
 			const timer = setTimeout(() => ac.abort(), timeout);
 			let response;
@@ -452,7 +441,8 @@ function createWebhookDeliveryTransport(options) {
 						"content-type": "application/json",
 						"x-arc-webhook-signature": v1Signature,
 						"x-arc-webhook-timestamp": String(timestamp),
-						"x-arc-webhook-delivery": payload.event.meta.id
+						"x-arc-webhook-delivery": payload.event.meta.id,
+						...extraHeaders
 					},
 					body,
 					signal: ac.signal,
@@ -515,7 +505,7 @@ function webhookDeliveryFailurePolicy(options = {}) {
 * boot-checked, not discovered on the first row.
 */
 function createDurableWebhookModule(options) {
-	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, ...outboxOptions } = options;
+	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, resolveHeaders, ...outboxOptions } = options;
 	return createOutboxModule({
 		...outboxOptions,
 		name: name ?? "webhook-delivery",
@@ -533,11 +523,22 @@ function createDurableWebhookModule(options) {
 				},
 				...fetch !== void 0 ? { fetch } : {},
 				...timeout !== void 0 ? { timeout } : {},
-				...validateUrl !== void 0 ? { validateUrl } : {}
+				...validateUrl !== void 0 ? { validateUrl } : {},
+				...resolveHeaders !== void 0 ? { resolveHeaders } : {}
 			});
 		},
 		failurePolicy: failurePolicy ?? webhookDeliveryFailurePolicy(delivery)
 	});
 }
+const RESERVED_WEBHOOK_HEADERS = /* @__PURE__ */ new Set([
+	"content-type",
+	"x-arc-webhook-signature",
+	"x-arc-webhook-timestamp",
+	"x-arc-webhook-delivery"
+]);
+function assertWebhookHeaderOverrides(headers) {
+	const reserved = Object.keys(headers).find((name) => RESERVED_WEBHOOK_HEADERS.has(name.toLowerCase()));
+	if (reserved) throw new WebhookDeliveryError(`webhook authentication header '${reserved}' is reserved`, { transient: false });
+}
 //#endregion
 export { WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, createDurableWebhookModule, createWebhookDeliveryTransport, webhooks_default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";

package/dist/{interface-DznJrm9R.mjs → interface-B7awDx3b.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-CfGH-GxO.mjs → jsonBody-CiHih3ZU.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-Cd_yy7aW.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-DDKni6Tz.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-WeKvY1dE.mjs → keys-BcNl12HN.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-Bj-aSsXi.mjs → loadResources-DGlfRQc9.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-DwaxNcE2.mjs → loadResourcesFromEntry-VYPGSas8.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-DoALUlOO.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-DNuYVbmv.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.d.mts

@@ -54,10 +54,29 @@ interface ArcLogger {
   error: (...args: unknown[]) => void;
 }
 /**
- * Configure the Arc logger globally.
+ * Run `fn` with `options` as the active logger config.
  *
- * Called automatically by `createApp({ debug })`, but can also be
- * called manually for standalone usage outside of `createApp`.
+ * `options` is held BY REFERENCE deliberately: `createApp` enters the scope
+ * before Fastify exists, then fills in the pino writer once `fastify.log` is
+ * constructed. Copying here would freeze the pre-Fastify view and send every
+ * post-construction boot warning to the console instead of the app's logger.
+ */
+declare function runWithArcLogger<T>(options: ArcLoggerOptions, fn: () => T): T;
+/**
+ * Enter `options` for the remainder of the current async context.
+ *
+ * For Fastify's `onRequest` hook, where `run(store, done)` wraps the rest of
+ * the request lifecycle. Outside a hook, prefer {@link runWithArcLogger}.
+ */
+declare function enterArcLoggerScope(options: ArcLoggerOptions, done: () => void): void;
+/**
+ * Configure the PROCESS-GLOBAL Arc logger — the fallback used outside any app.
+ *
+ * `createApp` no longer routes its writer through here; each app carries its
+ * own scoped options (see {@link runWithArcLogger}) so two apps in one process
+ * cannot overwrite each other's. This remains the way to configure arcLog for
+ * standalone use — `defineResource()` at module import, CLI commands, and any
+ * code running before or outside a `createApp` boot.
  */
 declare function configureArcLogger(options: ArcLoggerOptions): void;
 /**
@@ -104,4 +123,4 @@ interface PinoLike {
  */
 declare function createPinoWriter(logger: PinoLike): ArcLogWriter;
 //#endregion
-export { ArcLogWriter, ArcLogger, ArcLoggerOptions, PinoLike, arcLog, configureArcLogger, createPinoWriter };
+export { ArcLogWriter, ArcLogger, ArcLoggerOptions, PinoLike, arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger };

package/dist/logger/index.mjs

@@ -1,11 +1,54 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger/index.ts
+/**
+* Per-app logger options, resolved from the async context.
+*
+* The process-global below is a FALLBACK, not the source of truth. It used to
+* be both, and `configureArcLogger` overwrote it on every boot — so the
+* last-created app owned the writer for every app in the process. One app's
+* framework warnings then surfaced through another app's transports, level,
+* and redaction config. Fine for one-app-per-process; wrong for multi-app test
+* files and for serverless containers that reuse a warm process across apps.
+*
+* Follows the same shape as `requestContext`: the scope is entered once and
+* wraps everything downstream, so the 23 `arcLog()` call sites keep their
+* zero-argument signature and resolve correctly without threading a logger.
+*/
+const scope = new AsyncLocalStorage();
 let globalOptions = {};
+/** Active options: the app's if we're inside one, else the process fallback. */
+function resolveOptions() {
+	return scope.getStore() ?? globalOptions;
+}
+/**
+* Run `fn` with `options` as the active logger config.
+*
+* `options` is held BY REFERENCE deliberately: `createApp` enters the scope
+* before Fastify exists, then fills in the pino writer once `fastify.log` is
+* constructed. Copying here would freeze the pre-Fastify view and send every
+* post-construction boot warning to the console instead of the app's logger.
+*/
+function runWithArcLogger(options, fn) {
+	return scope.run(options, fn);
+}
+/**
+* Enter `options` for the remainder of the current async context.
+*
+* For Fastify's `onRequest` hook, where `run(store, done)` wraps the rest of
+* the request lifecycle. Outside a hook, prefer {@link runWithArcLogger}.
+*/
+function enterArcLoggerScope(options, done) {
+	scope.run(options, done);
+}
 /**
-* Configure the Arc logger globally.
+* Configure the PROCESS-GLOBAL Arc logger — the fallback used outside any app.
 *
-* Called automatically by `createApp({ debug })`, but can also be
-* called manually for standalone usage outside of `createApp`.
+* `createApp` no longer routes its writer through here; each app carries its
+* own scoped options (see {@link runWithArcLogger}) so two apps in one process
+* cannot overwrite each other's. This remains the way to configure arcLog for
+* standalone use — `defineResource()` at module import, CLI commands, and any
+* code running before or outside a `createApp` boot.
 */
 function configureArcLogger(options) {
 	globalOptions = { ...options };
@@ -84,10 +127,10 @@ function createPinoWriter(logger) {
 	};
 }
 function getWriter() {
-	return globalOptions.writer ?? console;
+	return resolveOptions().writer ?? console;
 }
 function isDebugEnabled(module) {
-	const configDebug = globalOptions.debug;
+	const configDebug = resolveOptions().debug;
 	if (configDebug !== void 0 && configDebug !== false) return matchesModule(configDebug, module);
 	const envDebug = typeof process !== "undefined" ? process.env?.ARC_DEBUG : void 0;
 	if (envDebug) return matchesModule(envDebug, module);
@@ -107,4 +150,4 @@ function isSuppressed() {
 	return env === "1" || env === "true";
 }
 //#endregion
-export { arcLog, configureArcLogger, createPinoWriter };
+export { arcLog, configureArcLogger, createPinoWriter, enterArcLoggerScope, runWithArcLogger };

package/dist/{mcpPlugin-DX3PHD7K.mjs → mcpPlugin-NxSlc-Ks.mjs}

@@ -1,19 +1,18 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { r as evaluatePermissionDecision } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { p as isArcError, t as ArcError } from "./errors-Cd_yy7aW.mjs";
-import { n as requireSingleHeaderValue } from "./headers-CveNO9gR.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CoqIRrkY.mjs";
-import { t as BaseController } from "./BaseController-CbkuhNI2.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CojeUkS4.mjs";
-import { t as executePipeline } from "./pipe-BzzoEhHj.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BKM0Ui-s.mjs";
-import { r as resolvePipelineSteps } from "./pipeline-q69DZzgG.mjs";
-import { n as validateAggregations } from "./validate-CdQlz52F.mjs";
-import { n as executeAggregation } from "./buildHandler-BrdYrG_1.mjs";
-import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
-import { t as createIdempotencyResult } from "./interface-DznJrm9R.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CDvclAew.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-EsiY3nUu.mjs";
+import { p as isArcError, t as ArcError } from "./errors-DDKni6Tz.mjs";
+import { n as requireSingleHeaderValue } from "./headers-DKslnhey.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-B8lwJv9Q.mjs";
+import { t as BaseController } from "./BaseController-CTJKm6Cb.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DdP225wt.mjs";
+import { t as executePipeline } from "./pipe-Cjy1UiXX.mjs";
+import { t as buildRequestScopeProjection } from "./projection-koISNyQo.mjs";
+import { i as resolvePipelineSteps, t as resolveActionPermission } from "./actionPermissions-D97DniUQ.mjs";
+import { n as validateAggregations } from "./validate-DI3L5V9w.mjs";
+import { n as executeAggregation } from "./buildHandler-Dohd2JuY.mjs";
+import { t as pluralize } from "./pluralize-B7m0dPm8.mjs";
+import { t as createIdempotencyResult } from "./interface-B7awDx3b.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-CngYvpCF.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/{memory-qYSB7rMQ.mjs → memory-BU-C-MV3.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-D7uchLjN.mjs → metrics-7_1GbJpl.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DNg-KNCk.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-JJWfp8rp.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-BcR2bFZQ.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-C01wWGJt.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BxCoxmiN.mjs";
-import { t as multipartBody } from "../multipartBody-4w-S3-PU.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-DUoKAGYD.mjs";
+import { t as multipartBody } from "../multipartBody-Bi5yqW0M.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-BnWtbA2U.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-CgIGh0Ab.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -160,12 +160,14 @@ var MigrationRunner = class {
 	async withLock(fn) {
 		const lock = this.lock;
 		if (!lock) return fn(() => false);
-		if (!await lock.tryAcquire(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs)) throw new Error(`MigrationRunner: another runner holds the migration lock — refusing to run concurrently. If a previous runner crashed, the lease expires on its own (leaseMs: ${this.lockLeaseMs}).`);
+		const fenced = await lock.tryAcquireFenced?.(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs);
+		if (!(fenced !== void 0 ? fenced !== null : await lock.tryAcquire(MIGRATION_LOCK_NAME, this.holderId, this.lockLeaseMs))) throw new Error(`MigrationRunner: another runner holds the migration lock — refusing to run concurrently. If a previous runner crashed, the lease expires on its own (leaseMs: ${this.lockLeaseMs}).`);
 		const lease = startRenewingLease({
 			lock,
 			name: MIGRATION_LOCK_NAME,
 			holderId: this.holderId,
 			leaseMs: this.lockLeaseMs,
+			...fenced ? { token: fenced.token } : {},
 			onLost: () => this.log.error("MigrationRunner: lease renewal lost — another holder took the migration lock; no further migrations will start and this run will fail."),
 			onError: (error) => this.log.error(`MigrationRunner: lease renewal errored (lease may lapse mid-run): ${error.message}`)
 		});
@@ -230,7 +232,7 @@ var MigrationRunner = class {
 	* Rollback last migration
 	*/
 	async down(migrations) {
-		await this.withLock(async () => {
+		await this.withLock(async (leaseLost) => {
 			const applied = await this.store.getApplied();
 			const last = applied[applied.length - 1];
 			if (!last) {
@@ -239,6 +241,7 @@ var MigrationRunner = class {
 			}
 			const migration = migrations.find((m) => m.resource === last.resource && m.version === last.version);
 			if (!migration) throw new Error(`Migration ${last.resource}:${last.version} not found in migration files`);
+			if (leaseLost()) throw new Error("MigrationRunner: refusing to roll back — lock ownership lost between acquiring the lease and starting the rollback.");
 			this.log.info(`Rolling back ${migration.resource} v${migration.version}...`);
 			await this.runMigration(migration, "down", true);
 			this.log.info("Rollback completed");

package/dist/{module-CwKsgZXp.mjs → module-CQNHzE7g.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.

package/dist/{multipartBody-4w-S3-PU.mjs → multipartBody-Bi5yqW0M.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10485760;

package/dist/{openapi-CkV5mQ53.mjs → openapi-RpNbPBL-.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-CWF5pbZD.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-XH1RZRyu.mjs";
-import { t as pluralize } from "./pluralize-B7xf8qZF.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CUeCmpUd.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-D6T0jWhS.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-xQAi5bPF.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-gg0_aUPF.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-D97DniUQ.mjs";
+import { t as pluralize } from "./pluralize-B7m0dPm8.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-CZz6JO93.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/outbox-admin/index.d.mts

@@ -1,6 +1,6 @@
 
-import { l as PermissionCheck } from "../base-Csjc2oF-.mjs";
-import { t as ArcModule } from "../types-BcTumAz_.mjs";
+import { l as PermissionCheck } from "../base-C-NL2fTi.mjs";
+import { t as ArcModule } from "../types-DDD5RKTu.mjs";
 import { OutboxStore } from "@classytic/primitives/outbox";
 //#region src/outbox-admin/module.d.ts
 /**

package/dist/outbox-admin/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-Cd_yy7aW.mjs";
-import { t as defineResource } from "../defineResource-ZhuLonLm.mjs";
-import { n as getModuleExports, t as defineModule } from "../module-CwKsgZXp.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-DDKni6Tz.mjs";
+import { t as defineResource } from "../defineResource-DWzjyxb2.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-CQNHzE7g.mjs";
 //#region src/outbox-admin/module.ts
 /**
 * Strip the domain payload and the stack unless explicitly opted in.

package/dist/{outbox-module-D1QfHqO4.mjs → outbox-module-ClcFrq98.mjs}

@@ -1,6 +1,7 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { i as resolveEventTransport } from "./EventTransport-tq4CEB-q.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-B88p99Z2.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { t as transactionContext } from "./transactionContext-D2HwJM2z.mjs";
+import { i as resolveEventTransport } from "./EventTransport-D23Uvhg4.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "./store-helpers-Brt8OxWZ.mjs";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
 import { randomBytes } from "node:crypto";
 import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
@@ -822,7 +823,8 @@ function createOutboxModule(options) {
 							...info.event?.type !== void 0 ? { eventType: info.event.type } : {}
 						}, `outbox relay "${name}" failed`);
 					}),
-					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {}
+					...options.failurePolicy !== void 0 ? { failurePolicy: options.failurePolicy } : {},
+					...options.sessionProvider === false ? {} : { sessionProvider: options.sessionProvider ?? (() => transactionContext.get()) }
 				})
 			};
 			return exports;

package/dist/{outbox-module-C1Bs_FXF.d.mts → outbox-module-b1TyDGGi.d.mts}

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent, t as DeadLetteredEvent } from "./EventTransport-BEVP50ka.mjs";
-import { t as ArcModule } from "./types-BcTumAz_.mjs";
+import { t as ArcModule } from "./types-DDD5RKTu.mjs";
 import { FastifyInstance } from "fastify";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 import { OutboxFailurePolicy, OutboxStore, OutboxWriteOptions } from "@classytic/primitives/outbox";
@@ -336,6 +336,29 @@ interface OutboxModuleOptions {
    * shape is exponential backoff up to N attempts, then dead-letter.
    */
   failurePolicy?: OutboxFailurePolicy;
+  /**
+   * Unit-of-Work session provider. Defaults to `() => transactionContext.get()`.
+   *
+   * This is what makes the durable path the DEFAULT path rather than a
+   * discipline. `EventOutbox.store()` already auto-injects a session from this
+   * provider (explicit `options.session` still wins), and a `transactional:
+   * true` write now publishes its session on `transactionContext` — so with
+   * the default in place, `outbox.store(event)` inside a transactional write
+   * commits the event row atomically with the domain write. No threading the
+   * handle from the controller through every service layer to the call site.
+   *
+   * The default matters more than the capability: `auditPlugin` has defaulted
+   * its `sessionProvider` the same way since it shipped, while this module
+   * required every host to remember. A host that forgets does not get an
+   * error — it gets an event row written outside the transaction, which
+   * survives a rollback and reports something that never happened. That is
+   * precisely the guarantee an outbox exists to provide.
+   *
+   * Pass `false` (or `() => undefined`) to opt out — for a store whose
+   * writes must NOT join the caller's transaction (a separate connection,
+   * an external queue).
+   */
+  sessionProvider?: (() => unknown) | false;
   /**
    * Run one relay pass at boot. Default `true` — a process that restarts with a backlog should
    * drain it immediately rather than waiting a full interval, because that backlog is precisely

package/dist/permissions/index.d.mts

@@ -1,5 +1,5 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-Csjc2oF-.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, m as normalizeRoles, p as getUserRoles, s as AuthorizationDecision, u as PermissionContext } from "../base-C-NL2fTi.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
-import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-B-DvUzsr.mjs";
+import { $ as requireAuth, A as RequireGrantOptions, B as ConnectEventsOptions, C as requireServiceScope, D as GRANT_MODES, E as createRoleHierarchy, F as PermissionRequirement, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, I as collectPublicSurface, J as allowPublic, K as allOf, L as describePermission, M as requireGrant, N as conjoinPolicyFilters, O as GrantMode, P as AccessExplanation, Q as not, R as describePermissionMap, S as requireScopeContext, T as RoleHierarchy, U as PermissionEventBus, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, X as deny, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, a as PermissionMatrixRegistry, at as scopeOf, b as requireOrgMembership, c as introspectModule, ct as evaluatePermissionDecision, d as authenticated, dt as RequireMandateOptions, et as requireOwnership, f as fullPublic, ft as requireAgentScope, g as publicRead, h as presets_d_exports, i as PermissionMatrixOptions, it as when, j as modeSatisfies, k as GrantResolution, l as introspectRegistry, lt as normalizeToDecision, m as permissionMatrix, mt as requireMandate, n as PermissionEntryType, nt as requireRoles, o as buildPermissionMatrix, ot as PermissionCheckReturn, p as ownerWithAdminBypass, pt as requireDPoP, q as allow, r as PermissionMatrix, rt as roles, s as introspectCheck, st as applyAuthorizationDecision, t as PermissionEntry, tt as requirePlatformRole, u as adminOnly, ut as RequireAgentScopeOptions, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope, z as explainAccess } from "../index-BtYoMip1.mjs";
 export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEntry, type PermissionEntryType, type PermissionEventBus, type PermissionMatrix, type PermissionMatrixOptions, type PermissionMatrixRegistry, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-CMMLWmuZ.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-CWF5pbZD.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CojeUkS4.mjs";
-import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-CP47jdi7.mjs";
+/*! @classytic/arc v2.36.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-EsiY3nUu.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-xQAi5bPF.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-DdP225wt.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-DgPrZsJh.mjs";
 export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };