@classytic/arc 2.35.0 → 2.37.0

package/dist/events/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as MemoryEventTransport } from "../EventTransport-BrPeGUil.mjs";
-import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-Dh2BnzJf.mjs";
-import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-ClPn5kjn.mjs";
-import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-SGIZz6oS.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as MemoryEventTransport } from "../EventTransport-pGNNDQ__.mjs";
+import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-BrcG3NlV.mjs";
+import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-DEIfV1iC.mjs";
+import { i as exponentialBackoff, n as EventOutbox, r as repositoryAsOutboxStore, t as createOutboxModule } from "../outbox-module-CKaLL5BH.mjs";
 import { MemoryOutboxStore } from "@classytic/primitives/memory-outbox";
 //#region src/events/eventTypes.ts
 /**

package/dist/events/transports/redis-stream-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis-stream.ts
 /**

package/dist/events/transports/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/events/transports/redis.ts
 /**

package/dist/factory/index.d.mts

@@ -1,8 +1,8 @@
 
-import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-DDD5RKTu.mjs";
-import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-C50BUxKs.mjs";
-import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-CMMTL3cj.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources--ZtY9pe9.mjs";
+import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-BMa2EPtv.mjs";
+import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-DCxxRwLC.mjs";
+import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-CdY8FINU.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-BYFfYnjZ.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**

package/dist/factory/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-_Zs3R_Sb.mjs";
-import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-DYMzmUk1.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-Bh5OC7ww.mjs";
-import { t as loadResources } from "../loadResources-DdQb0qgV.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-Cc_sb94d.mjs";
+import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-BUoGKPaS.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-DIvG8qOg.mjs";
+import { t as loadResources } from "../loadResources-CPlRWJCv.mjs";
 //#region src/factory/module/extend.ts
 /** Concatenate two contributions, resolving factories only when arc asks. */
 function mergeContribution(own, extra) {

package/dist/{fastify-augmentation-CMMTL3cj.d.mts → fastify-augmentation-CdY8FINU.d.mts}

@@ -1,8 +1,8 @@
 
-import { on as HookSystem, z as ResourceRegistry } from "./index-C5K78SXo.mjs";
+import { on as HookSystem, z as ResourceRegistry } from "./index-C01wWGJt.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
-import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-DDD5RKTu.mjs";
-import { s as ModuleState } from "./index-C50BUxKs.mjs";
+import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-BMa2EPtv.mjs";
+import { s as ModuleState } from "./index-DCxxRwLC.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/factory/module/descriptor.d.ts
 /**

package/dist/{fields-UtpiJO5R.mjs → fields-DvGz47Ul.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions

package/dist/{generate-BoAVy3_b.mjs → generate-D7CIIWhS.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-DGAQQKL8.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-DgaYX91M.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts

package/dist/{headers-DODWf7aC.mjs → headers-BFu1st_i.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-CLid6atr.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-DsdZc1Xv.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/{health-_Zs3R_Sb.mjs → health-Cc_sb94d.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/plugins/requestId.ts

package/dist/hooks/index.d.mts

@@ -1,3 +1,3 @@
 
-import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-C5K78SXo.mjs";
+import { an as HookRegistration, cn as afterCreate, dn as beforeCreate, en as DefineHookOptions, fn as beforeDelete, hn as defineHook, in as HookPhase, ln as afterDelete, mn as createHookSystem, nn as HookHandler, on as HookSystem, pn as beforeUpdate, rn as HookOperation, sn as HookSystemOptions, tn as HookContext, un as afterUpdate } from "../index-C01wWGJt.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,3 +1,3 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-LlPm3Anm.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-CuhHvcyZ.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.mjs

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as requireSingleHeaderValue } from "../headers-DODWf7aC.mjs";
-import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-kIJCY0wI.mjs";
-import { t as createIdempotencyResult } from "../interface-my7sxjw5.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as requireSingleHeaderValue } from "../headers-BFu1st_i.mjs";
+import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-bU8H5c-A.mjs";
+import { t as createIdempotencyResult } from "../interface-CaPVHoVJ.mjs";
 import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";

package/dist/idempotency/redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/redis.ts
 var RedisIdempotencyStore = class {
 	name = "redis";

package/dist/{index-K7auNNW0.d.mts → index-BtYoMip1.d.mts}

@@ -1,6 +1,6 @@
 
 import { i as RequestScope, n as Mandate } from "./types-Ddl9OjmE.mjs";
-import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-GZU3LlzP.mjs";
+import { l as PermissionCheck, s as AuthorizationDecision, u as PermissionContext } from "./base-C-NL2fTi.mjs";
 import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
@@ -567,6 +567,14 @@ type PermissionRequirement = {
   readonly conditional?: boolean;
 } | {
   readonly kind: "authenticated";
+} |
+/**
+ * Nobody passes — an explicit `denyAll()`. Distinct from "no rule found",
+ * which is `public` (public-by-omission): one is a closed door, the other is
+ * an open one, and before this existed both were reported as `authenticated`.
+ */
+{
+  readonly kind: "denied";
 };
 /**
  * Extract a check's static requirement from its `PermissionCheckMeta`. Public
@@ -991,7 +999,17 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
 //#region src/permissions/matrix.d.ts
-type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped";
+/**
+ * `denied` is a CLOSED door — an explicit `denyAll()`. It is not the same as
+ * "no rule found", which surfaces as `public` (public-by-omission). Before it
+ * existed a denyAll gate was reported as `authenticated`, so a permission UI
+ * rendered the action for every signed-in user and the server refused every
+ * attempt.
+ *
+ * A CLIENT MUST treat an unrecognised type as DENIED, never as permitted — the
+ * next type added here will otherwise read as "allowed" on every older client.
+ */
+type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped" | "denied";
 interface PermissionEntry {
   type: PermissionEntryType;
   roles: string[];

package/dist/{index-C5K78SXo.d.mts → index-C01wWGJt.d.mts}

@@ -1,6 +1,6 @@
 
 import { P as ArcHeaders, i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-GZU3LlzP.mjs";
+import { d as UserBase, l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
 import { a as QueryCacheConfig } from "./QueryCache-DFA-QrU9.mjs";
 import "./elevation-BXCfVcNG.mjs";
 import { n as FieldPermissionMap } from "./fields-I_EeRWND.mjs";

package/dist/{index-C50BUxKs.d.mts → index-DCxxRwLC.d.mts}

@@ -1,5 +1,5 @@
 
-import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-DDD5RKTu.mjs";
+import { _ as HealthCheck, a as ModuleContribution, f as ScheduleDefinition, n as ArcModuleInput, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule } from "./types-BMa2EPtv.mjs";
 import { FastifyInstance } from "fastify";
 //#region src/factory/module/contributions.d.ts
 /**

package/dist/{index-h-mTgMqy.d.mts → index-du18bJjH.d.mts}

@@ -1,8 +1,8 @@
 
 import { i as RequestScope } from "./types-Ddl9OjmE.mjs";
-import { l as PermissionCheck, t as AnyRecord } from "./base-GZU3LlzP.mjs";
-import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-C5K78SXo.mjs";
-import "./fastify-augmentation-CMMTL3cj.mjs";
+import { l as PermissionCheck, t as AnyRecord } from "./base-C-NL2fTi.mjs";
+import { C as RequestContext, Et as ActionDefinition, F as FastifyWithDecorators, Fn as IControllerResponse, H as CrudController, In as IRequestContext, L as RequestWithExtras, Pn as IController, T as CrudRouterOptions, U as ResourceConfig, V as ResourceDefinition, et as RouteSchemaOptions, jt as RouteMcpConfig, tt as ArcFieldRule, ut as AggregationConfig } from "./index-C01wWGJt.mjs";
+import "./fastify-augmentation-CdY8FINU.mjs";
 import { Filter } from "@classytic/repo-core/filter";
 import { AggDateBucket, AggMeasure, AggTopN } from "@classytic/repo-core/repository";
 import { FastifyReply, FastifyRequest, RouteHandlerMethod } from "fastify";

package/dist/{index-CJCcbADG.d.mts → index-eyg5WEcy.d.mts}

@@ -1,5 +1,5 @@
 
-import { l as PermissionCheck } from "./base-GZU3LlzP.mjs";
+import { l as PermissionCheck } from "./base-C-NL2fTi.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/integrations/jobs/execution.d.ts
 /**

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 
-import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-GZU3LlzP.mjs";
-import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-C5K78SXo.mjs";
+import { c as DataPolicy, d as UserBase, l as PermissionCheck, n as ArcRequest, o as UserOrganization, r as JWTPayload, s as AuthorizationDecision, t as AnyRecord, u as PermissionContext } from "./base-C-NL2fTi.mjs";
+import { A as RequestIdOptions, An as WriteVerbKey, B as defineResource, Bt as BaseController, C as RequestContext, Cn as ControllerConstructionOptions, D as HealthCheck, Dn as MutationWriteContext, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as IControllerResponse, Ft as AuthPluginOptions, Gt as SlugExt, H as CrudController, Ht as SoftDeleteMixin, In as IRequestContext, Jt as BulkMixin, Kt as SlugMixin, L as RequestWithExtras, Ln as RawRouteHandler, Mn as ControllerLike, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ResourceWrites, P as FastifyWithAuth, Pn as IController, Q as MiddlewareConfig, Rn as RouteHandler, S as QueryParserInterface, Sn as ControllerConfigurableOptions, T as CrudRouterOptions, U as ResourceConfig, Ut as TreeExt, V as ResourceDefinition, Vt as SoftDeleteExt, Wt as TreeMixin, X as CrudRouteKey, Y as PresetResult, Yt as BaseCrudController, Z as CrudSchemas, _n as ArcDeleteResult, a as InferAdapterDoc, bn as ArcUpdateResult, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gn as ArcCreateResult, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, k as IntrospectionPluginOptions, kn as WriteContext, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, qt as BulkExt, r as ValidateOptions, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, u as TypedResourceConfig, ut as AggregationConfig, vn as ArcGetResult, w as ServiceContext, wn as ListResult, xn as BaseControllerOptions, y as OwnershipCheck, yn as ArcListResult } from "./index-C01wWGJt.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
-import "./fastify-augmentation-CMMTL3cj.mjs";
-import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-h-mTgMqy.mjs";
-import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-K7auNNW0.mjs";
+import "./fastify-augmentation-CdY8FINU.mjs";
+import { A as CRUD_OPERATIONS, B as HookOperation, C as SeamedResourceConfig, E as defineAction, F as DEFAULT_SORT, G as MUTATION_OPERATIONS, H as MAX_FILTER_DEPTH, I as DEFAULT_TENANT_FIELD, J as SYSTEM_FIELDS, K as MutationOperation, L as DEFAULT_UPDATE_METHOD, M as DEFAULT_ID_FIELD, N as DEFAULT_LIMIT, P as DEFAULT_MAX_LIMIT, R as HOOK_OPERATIONS, S as ResourceSeams, U as MAX_REGEX_LENGTH, V as HookPhase, W as MAX_SEARCH_LENGTH, b as defineResourceVariants, c as nativePolicyFilter, h as getControllerScope, j as CrudOperation, k as defineAggregation, q as RESERVED_QUERY_PARAMS, s as NativePolicyFilter, w as mergeResourceConfig, x as AdapterLike, z as HOOK_PHASES } from "./index-du18bJjH.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-BtYoMip1.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;

package/dist/index.mjs

@@ -1,14 +1,14 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-BhzLXCfN.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-CLid6atr.mjs";
-import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-C-pofd0v.mjs";
-import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-UtpiJO5R.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-BOrGeocE.mjs";
-import { l as getControllerScope } from "./actionPermissions-LFuOra7W.mjs";
-import { t as defineAggregation } from "./defineAggregation-DoIijIFq.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-DdEvmmkY.mjs";
-import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-CpSBlFXZ.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-CUpamQMJ.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DsdZc1Xv.mjs";
+import { a as BulkMixin, h as nativePolicyFilter, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B5GZfUBy.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-DvGz47Ul.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-WcbE1kJL.mjs";
+import { l as getControllerScope } from "./actionPermissions-CQQrR4tu.mjs";
+import { t as defineAggregation } from "./defineAggregation-cCitY2FA.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-C8GWw-Iu.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-DWkl60hx.mjs";
 //#region src/index.ts
-const version = "2.35.0";
+const version = "2.37.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, nativePolicyFilter, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-Ce4R0ZGK.mjs → init-BMgU1wYR.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";

package/dist/integrations/event-gateway.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-DUIP1XH6.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-vRuwDd6N.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,8 +1,8 @@
 
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
-import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-CJCcbADG.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-DSvHH0uR.mjs";
+import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-eyg5WEcy.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-BXnTOsXP.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1,2 +1,2 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.d.mts

@@ -1,3 +1,3 @@
 
-import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-CJCcbADG.mjs";
+import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-eyg5WEcy.mjs";
 export { type ExecuteTimedHandlerOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobRepeatOptions, type JobStatus, type JobsPluginOptions, type QueueStats, type TimedHandlerLogger, defineJob, executeTimedHandler, jobsPlugin };

package/dist/integrations/jobs/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "../../authorizationDecision-DYXBBgtg.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "../../authorizationDecision-DgyWdav8.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/jobs/execution.ts
 async function executeTimedHandler(options) {

package/dist/integrations/mcp/index.d.mts

@@ -1,9 +1,9 @@
 
 import { i as RequestScope } from "../../types-Ddl9OjmE.mjs";
-import { l as PermissionCheck } from "../../base-GZU3LlzP.mjs";
-import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-C5K78SXo.mjs";
+import { l as PermissionCheck } from "../../base-C-NL2fTi.mjs";
+import { Fn as IControllerResponse, In as IRequestContext, V as ResourceDefinition, zn as ServerAccessor } from "../../index-C01wWGJt.mjs";
 import { n as FieldPermissionMap } from "../../fields-I_EeRWND.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-DSvHH0uR.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-BXnTOsXP.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";

package/dist/integrations/mcp/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-DkzZ7Nfx.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-dxMxBPIg.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,5 +1,5 @@
 
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-DSvHH0uR.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-BXnTOsXP.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-DkzZ7Nfx.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-dxMxBPIg.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities

package/dist/integrations/streamline.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-CLid6atr.mjs";
-import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-DOpZVht6.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { f as createError, i as NotFoundError, r as ForbiddenError } from "../errors-DsdZc1Xv.mjs";
+import { a as promoteStreamTokenToHeader, n as forwardedStreamHeaders } from "../streaming-weWcFCk4.mjs";
 import fp from "fastify-plugin";
 //#region src/integrations/streamline.ts
 /**

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
 import { a as EventTransport, n as DomainEvent } from "../EventTransport-BEVP50ka.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-b1TyDGGi.mjs";
+import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-BbdaMyqy.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
@@ -310,6 +310,8 @@ interface WebhookDeliveryTransportOptions {
    * an allowed URL can't 302 into a blocked target; a rejection is permanent.
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
+  /** Resolve private auth headers at delivery time; reserved Arc headers cannot be replaced. */
+  resolveHeaders?: (subscription: WebhookSubscription, event: WebhookDeliveryPayload["event"]) => Record<string, string> | Promise<Record<string, string>>;
 }
 /**
  * Publish-only `EventTransport` whose `publish()` IS the webhook POST —
@@ -338,7 +340,7 @@ interface WebhookDeliveryPolicyOptions {
  * retry on exponential backoff until `maxAttempts`, then dead-letter.
  */
 declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
-interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl"> {
+interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
   /** Module name / `dependsOn` key. Default `'webhook-delivery'`. */
   name?: string;
   /** Retry/backoff tuning for the default failure policy. */

package/dist/integrations/webhooks.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-BagWc3TI.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-SGIZz6oS.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-c4Sc85X-.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-CKaLL5BH.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 import { createChildEvent } from "@classytic/primitives/events";
@@ -429,6 +429,8 @@ function createWebhookDeliveryTransport(options) {
 				timestamp,
 				deliveryId: payload.event.meta.id
 			});
+			const extraHeaders = options.resolveHeaders ? await options.resolveHeaders(sub, payload.event) : {};
+			assertWebhookHeaderOverrides(extraHeaders);
 			const ac = new AbortController();
 			const timer = setTimeout(() => ac.abort(), timeout);
 			let response;
@@ -439,7 +441,8 @@ function createWebhookDeliveryTransport(options) {
 						"content-type": "application/json",
 						"x-arc-webhook-signature": v1Signature,
 						"x-arc-webhook-timestamp": String(timestamp),
-						"x-arc-webhook-delivery": payload.event.meta.id
+						"x-arc-webhook-delivery": payload.event.meta.id,
+						...extraHeaders
 					},
 					body,
 					signal: ac.signal,
@@ -502,7 +505,7 @@ function webhookDeliveryFailurePolicy(options = {}) {
 * boot-checked, not discovered on the first row.
 */
 function createDurableWebhookModule(options) {
-	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, ...outboxOptions } = options;
+	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, resolveHeaders, ...outboxOptions } = options;
 	return createOutboxModule({
 		...outboxOptions,
 		name: name ?? "webhook-delivery",
@@ -520,11 +523,22 @@ function createDurableWebhookModule(options) {
 				},
 				...fetch !== void 0 ? { fetch } : {},
 				...timeout !== void 0 ? { timeout } : {},
-				...validateUrl !== void 0 ? { validateUrl } : {}
+				...validateUrl !== void 0 ? { validateUrl } : {},
+				...resolveHeaders !== void 0 ? { resolveHeaders } : {}
 			});
 		},
 		failurePolicy: failurePolicy ?? webhookDeliveryFailurePolicy(delivery)
 	});
 }
+const RESERVED_WEBHOOK_HEADERS = /* @__PURE__ */ new Set([
+	"content-type",
+	"x-arc-webhook-signature",
+	"x-arc-webhook-timestamp",
+	"x-arc-webhook-delivery"
+]);
+function assertWebhookHeaderOverrides(headers) {
+	const reserved = Object.keys(headers).find((name) => RESERVED_WEBHOOK_HEADERS.has(name.toLowerCase()));
+	if (reserved) throw new WebhookDeliveryError(`webhook authentication header '${reserved}' is reserved`, { transient: false });
+}
 //#endregion
 export { WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, createDurableWebhookModule, createWebhookDeliveryTransport, webhooks_default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";

package/dist/{interface-my7sxjw5.mjs → interface-CaPVHoVJ.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/idempotency/stores/interface.ts
 /**
 * Helper to create a result object

package/dist/{jsonBody-CVKA7C5m.mjs → jsonBody-BuzxOZV8.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-CLid6atr.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-DsdZc1Xv.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-GlU7XpmG.mjs → keys-DoUI9-yP.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities

package/dist/{loadResources-DdQb0qgV.mjs → loadResources-CPlRWJCv.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CEvvVXTC.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-DrZrabOW.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-s6aGs6-0.mjs → loadResourcesFromEntry-CPCZiX9n.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
-import { t as ResourceRegistry } from "./ResourceRegistry-yuD1Ra53.mjs";
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-DFOmazXg.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.35.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.37.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger/index.ts
 /**