@classytic/arc 2.41.0 → 2.43.0

package/dist/integrations/webhooks.d.mts

@@ -1,6 +1,6 @@
 
-import { a as EventTransport, n as DomainEvent } from "../EventTransport-CbUKDzZZ.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-BHdUnuuK.mjs";
+import { a as EventTransport, n as DomainEvent } from "../EventTransport-CiicKz2Z.mjs";
+import { i as createOutboxModule, r as OutboxModuleOptions } from "../outbox-module-gZCHoE4H.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
@@ -42,24 +42,15 @@ interface WebhookPluginOptions {
   timeout?: number;
   /** Max delivery log entries kept in memory (default: 1000) */
   maxLogEntries?: number;
-  /**
-   * Max concurrent deliveries per event (default: 5). Set to 1 for
-   * sequential. Must be >= 1 — the plugin throws at registration otherwise
-   * (a zero would make the delivery loop spin forever without progress).
-   */
+  /** Max concurrent deliveries per event, integer >= 1 (default: 5). */
   concurrency?: number;
   /**
-   * In-process retry for failed deliveries. Default: single attempt.
-   * Retries fire on network errors, timeouts, 429 and 5xx — NOT on other
-   * 4xx (the receiver rejected the payload; repeating it can't succeed).
-   * Each attempt is re-signed with a fresh timestamp so the receiver's
-   * replay-tolerance window applies per attempt; `x-arc-webhook-delivery`
-   * stays constant, which is exactly what receiver-side dedup keys on.
+   * In-process retry (default: single attempt) on network errors, timeouts,
+   * 429 and 5xx — not other 4xx. Each attempt is re-signed with a fresh
+   * timestamp; `x-arc-webhook-delivery` stays constant for receiver dedup.
    *
-   * This is BEST-EFFORT: attempts live in this process, so a crash or
-   * deploy drops the remaining ones. Guaranteed delivery is a durable-job
-   * concern (queue keyed by subscription + delivery id) — pair the events
-   * outbox with a worker if you need it.
+   * BEST-EFFORT: a crash or deploy drops remaining attempts. Use `durable`
+   * for guaranteed delivery.
    */
   retry?: {
     /** Total attempts including the first. Must be an integer >= 1. */
@@ -68,39 +59,24 @@ interface WebhookPluginOptions {
     backoffMs?: number;
   };
   /**
-   * URL policy hook — the SSRF seam for tenant-registered URLs. Throw to
-   * reject. Pass {@link defaultWebhookUrlPolicy} to require HTTPS and block
-   * localhost / link-local / private-network / cloud-metadata destinations,
-   * or supply your own (allowlists, per-tenant rules).
-   *
-   * Enforcement points when set:
-   *  - `register()` — new subscriptions are validated BEFORE saving.
-   *  - Plugin init — every PERSISTED subscription is re-validated; failures
-   *    are excluded from dispatch and logged (they stay in the store for
-   *    the host to fix), so pre-policy rows and out-of-band store writes
-   *    can't bypass the policy.
-   *  - Delivery — `fetch` runs with `redirect: "manual"`, so an allowed
-   *    public URL can't 302 into a blocked private/metadata target; a 3xx
-   *    records as a failed delivery.
+   * URL policy — the SSRF seam for tenant-registered URLs; throw to reject.
+   * Pass {@link defaultWebhookUrlPolicy} or your own. No policy applies by
+   * default (internal webhooks to private services are legitimate).
    *
-   * Arc deliberately ships no DEFAULT policy — deployments differ (internal
-   * webhooks to private services are legitimate), and DNS-rebinding
-   * protection belongs at the actual outbound network boundary, not in the
-   * framework.
+   * When set it is enforced:
+   *  - on `register()`, before saving;
+   *  - at init on every PERSISTED subscription — failures are excluded from
+   *    dispatch and logged, so pre-policy / out-of-band rows can't bypass it;
+   *  - at delivery via `redirect: "manual"`, so an allowed URL can't 302 into
+   *    a blocked target (a 3xx records as failed).
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
   /**
-   * DURABLE delivery — the outbox→worker composition. When set, a matching
-   * event no longer POSTs inline: each (event × subscription) pair becomes ONE
-   * durable row in the given outbox store, and `createDurableWebhookModule`'s
-   * relay claims, delivers, retries with backoff, and dead-letters — all
-   * surviving crash and deploy, which the in-process `retry` cannot.
-   *
-   * The row id is deterministic (`<event id>:wh:<subscription id>`) and the
-   * save carries it as `dedupeKey`, so an at-least-once upstream (Redis
-   * Streams, an events outbox) redelivering the same event enqueues each
-   * delivery exactly once. Mutually exclusive with `retry` — the retry axis
-   * moves to the relay's failure policy.
+   * Durable delivery: each (event × subscription) becomes one outbox row that
+   * `createDurableWebhookModule`'s relay delivers, retries and dead-letters,
+   * surviving crash and deploy. The row id `<event id>:wh:<subscription id>`
+   * doubles as `dedupeKey`, so an at-least-once upstream enqueues each
+   * delivery once. Mutually exclusive with `retry`.
    */
   durable?: {
     /** Outbox store the delivery rows are written to — share it with the module. */
@@ -112,16 +88,9 @@ type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
 interface WebhookManager {
   register(sub: WebhookSubscription): Promise<void> | void;
   unregister(id: string): Promise<void> | void;
-  /**
-   * Enumerate subscriptions WITHOUT their secrets — safe to surface in
-   * admin UIs / API responses. Use {@link WebhookManager.getSecret} for
-   * the privileged retrieval path.
-   */
+  /** Subscriptions WITHOUT secrets — safe for admin UIs / API responses. */
   list(): WebhookSubscriptionPublic[];
-  /**
-   * Privileged secret retrieval — separate from `list()` so enumerating
-   * subscriptions never leaks signing material into logs or UIs.
-   */
+  /** Privileged secret retrieval, kept out of `list()` so enumeration never leaks it. */
   getSecret(id: string): string | undefined;
   deliveryLog(limit?: number): WebhookDeliveryRecord[];
 }
@@ -131,14 +100,11 @@ declare module "fastify" {
   }
 }
 /**
- * Signed-string layout for the v1 webhook contract:
- *
- *     v1.<timestampMs>.<deliveryId>.<body>
+ * Sign a v1 webhook. Signed string: `v1.<timestampMs>.<deliveryId>.<body>`.
  *
- * Binding the timestamp bounds replay to the verifier's tolerance window,
- * and binding the delivery id lets receivers deduplicate redeliveries on an
- * AUTHENTICATED value (the legacy `x-webhook-id` header was unsigned — an
- * attacker replaying a captured request could change it and defeat dedup).
+ * The timestamp bounds replay to the verifier's tolerance window; the
+ * delivery id is signed so receivers dedupe on an AUTHENTICATED value (an
+ * unsigned id header could be altered on replay to defeat dedup).
  *
  * Wire headers:
  *   - `x-arc-webhook-signature: v1=<hex hmac-sha256>`
@@ -204,6 +170,13 @@ type VerifyWebhookResult = {
  * ```
  */
 declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
+/**
+ * Opt-in URL policy: requires HTTPS and rejects loopback, link-local,
+ * private-network and cloud-metadata hosts. Pass as `validateUrl`.
+ *
+ * Validates the URL LITERAL only — no DNS resolution. Rebinding protection
+ * belongs at the outbound network boundary (egress proxy / network policy).
+ */
 declare function defaultWebhookUrlPolicy(url: URL): void;
 /** Options for `verifySignature` — customize for non-Arc webhook senders */
 interface VerifySignatureOptions {
@@ -219,47 +192,25 @@ interface VerifySignatureOptions {
   algorithm?: string;
 }
 /**
- * Verify an INBOUND third-party webhook signature using timing-safe
- * comparison — for webhooks arc RECEIVES (GitHub, Stripe, ...), not for
- * arc-to-arc delivery. Arc's own outbound contract is v1
- * (`x-arc-webhook-*`) — receivers of arc webhooks use {@link verifyWebhook}.
- *
- * Defaults to the common `sha256=<hex>` format; configurable for any HMAC
- * scheme via options.
+ * Timing-safe verification of an INBOUND third-party webhook (GitHub,
+ * Stripe, ...). Defaults to `sha256=<hex>`; prefix/algorithm configurable.
+ * Receivers of arc's own webhooks use {@link verifyWebhook}.
  *
- * ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
- * parses JSON bodies by default and the re-serialised object will NOT match
- * the original signature. Register `fastify-raw-body` (arc's createApp does
- * this automatically with `global: false`) and opt the route in via
- * `config: { rawBody: true }`, then pass `req.rawBody` here.
+ * ⚠ `body` must be the exact signed bytes: opt the route into
+ * `config: { rawBody: true }` (arc registers fastify-raw-body with
+ * `global: false`) and pass `req.rawBody` — re-serialised JSON won't match.
  *
- * @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
- * @param secret    - Shared secret between sender and receiver
- * @param signature - The signature header value (e.g. `req.headers['x-webhook-signature']`)
- * @param options   - Override prefix/algorithm for non-Arc senders
- * @returns `true` if valid, `false` otherwise — never throws
+ * @returns `true` if valid, `false` otherwise. Throws `TypeError` only when
+ *   `body` is not a string/Buffer.
  *
  * @example
  * ```typescript
- * import { verifySignature } from '@classytic/arc/integrations/webhooks';
- *
- * // `config: { rawBody: true }` is REQUIRED — arc registers
- * // fastify-raw-body with `global: false`, so routes opt in per-route;
- * // without it `req.rawBody` is undefined and verifySignature throws a
- * // TypeError.
- *
- * // GitHub-style sender (sha256=<hex>)
  * fastify.post('/webhooks/github', { config: { rawBody: true } }, async (req, reply) => {
  *   const sig = req.headers['x-hub-signature-256'] as string;
  *   if (!verifySignature(req.rawBody, secret, sig)) {
  *     return reply.status(401).send({ error: 'Invalid signature' });
  *   }
  * });
- *
- * // Stripe-style (bare hex, different header)
- * const valid = verifySignature(body, stripeSecret, req.headers['stripe-signature'], {
- *   prefix: '',
- * });
  * ```
  */
 declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
@@ -278,10 +229,8 @@ interface WebhookDeliveryPayload {
   };
 }
 /**
- * A failed webhook POST, classified for the failure policy: `transient`
- * failures (network error, timeout, 429, 5xx) are worth retrying; the rest
- * (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
- * malformed row) are final for this payload and dead-letter immediately.
+ * A failed webhook POST. `transient` (network, timeout, 429, 5xx) retries;
+ * anything else (4xx, 3xx, URL-policy rejection, malformed row) dead-letters.
  */
 declare class WebhookDeliveryError extends Error {
   readonly status?: number;
@@ -294,9 +243,8 @@ declare class WebhookDeliveryError extends Error {
 }
 interface WebhookDeliveryTransportOptions {
   /**
-   * Resolve a subscription (WITH secret) at delivery time — fresh URL and
-   * secret apply to every attempt, and an unregistered id is an acknowledged
-   * no-op (the delivery is moot, not an error).
+   * Resolve a subscription (WITH secret) per attempt. `undefined` (unregistered)
+   * acknowledges the delivery as moot.
    */
   getSubscription: (id: string) => WebhookSubscription | undefined | Promise<WebhookSubscription | undefined>;
   /** Custom fetch (for testing). */
@@ -304,25 +252,20 @@ interface WebhookDeliveryTransportOptions {
   /** Per-POST timeout in ms (default: 10000). */
   timeout?: number;
   /**
-   * URL policy — same seam as {@link WebhookPluginOptions.validateUrl}, but
-   * enforced at DELIVERY time (covers rows enqueued before a policy existed
-   * and out-of-band store writes). When set, `redirect: "manual"` applies so
-   * an allowed URL can't 302 into a blocked target; a rejection is permanent.
+   * Same seam as {@link WebhookPluginOptions.validateUrl}, enforced at
+   * DELIVERY time (with `redirect: "manual"`); a rejection is permanent.
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
   /** Resolve private auth headers at delivery time; reserved Arc headers cannot be replaced. */
   resolveHeaders?: (subscription: WebhookSubscription, event: WebhookDeliveryPayload["event"]) => Record<string, string> | Promise<Record<string, string>>;
 }
 /**
- * Publish-only `EventTransport` whose `publish()` IS the webhook POST —
- * plugged into an outbox relay, delivery inherits the relay's guarantees.
- * Throws {@link WebhookDeliveryError} on failure so the relay observes it
- * (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
- * unregistered subscriptions (acknowledge).
+ * Publish-only `EventTransport` whose `publish()` IS the webhook POST, for an
+ * outbox relay. Throws {@link WebhookDeliveryError} on failure; returns on
+ * 2xx or an unregistered subscription.
  *
- * The wire contract is IDENTICAL to inline dispatch: v1 signing, and
- * `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
- * across retries, so receiver-side dedup is unchanged.
+ * Same wire contract as inline dispatch: `x-arc-webhook-delivery` is the
+ * ORIGINAL event's `meta.id`, stable across retries.
  */
 declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
 interface WebhookDeliveryPolicyOptions {
@@ -334,10 +277,9 @@ interface WebhookDeliveryPolicyOptions {
   maxMs?: number;
 }
 /**
- * Default failure policy for durable webhook delivery: permanent failures
- * ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
- * first attempt — repeating a rejected payload can't succeed; transient ones
- * retry on exponential backoff until `maxAttempts`, then dead-letter.
+ * Default durable-delivery policy: non-transient {@link WebhookDeliveryError}s
+ * dead-letter immediately; others retry with exponential backoff until
+ * `maxAttempts`.
  */
 declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
 interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
@@ -363,11 +305,9 @@ interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" |
  * });
  * ```
  *
- * The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
- * delivery and `role: 'api'` deployments only enqueue. The delivering process
- * must ALSO register `webhookPlugin` (with the shared subscription store) —
- * subscriptions resolve through `fastify.webhooks` at delivery time, which is
- * boot-checked, not discovered on the first row.
+ * `role: 'relay'` deployments deliver; `role: 'api'` only enqueues. The
+ * delivering process must ALSO register `webhookPlugin` with the shared
+ * subscription store (boot-checked).
  */
 declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
 //#endregion

package/dist/integrations/webhooks.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-dsCyLxXH.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-Bjgzl6tg.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
-import { createChildEvent } from "@classytic/primitives/events";
+import { createChildEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/integrations/webhooks.ts
 /**
 * Outbound webhooks — auto-dispatch arc events to registered endpoints with
@@ -22,14 +22,11 @@ import { createChildEvent } from "@classytic/primitives/events";
 * ```
 */
 /**
-* Signed-string layout for the v1 webhook contract:
+* Sign a v1 webhook. Signed string: `v1.<timestampMs>.<deliveryId>.<body>`.
 *
-*     v1.<timestampMs>.<deliveryId>.<body>
-*
-* Binding the timestamp bounds replay to the verifier's tolerance window,
-* and binding the delivery id lets receivers deduplicate redeliveries on an
-* AUTHENTICATED value (the legacy `x-webhook-id` header was unsigned — an
-* attacker replaying a captured request could change it and defeat dedup).
+* The timestamp bounds replay to the verifier's tolerance window; the
+* delivery id is signed so receivers dedupe on an AUTHENTICATED value (an
+* unsigned id header could be altered on replay to defeat dedup).
 *
 * Wire headers:
 *   - `x-arc-webhook-signature: v1=<hex hmac-sha256>`
@@ -98,18 +95,14 @@ function verifyWebhook(input) {
 		timestamp
 	};
 }
+const BLOCKED_V4 = /^(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|0\.)/;
 /**
-* Opt-in URL policy for tenant-registered webhooks: requires HTTPS and
-* rejects loopback, link-local, private-network, and cloud-metadata
-* destinations. Pass as `validateUrl: defaultWebhookUrlPolicy`.
+* Opt-in URL policy: requires HTTPS and rejects loopback, link-local,
+* private-network and cloud-metadata hosts. Pass as `validateUrl`.
 *
-* Scope note: this validates the URL LITERAL at registration time. It does
-* not resolve DNS — rebinding/level-2 SSRF protection belongs at the actual
-* outbound network boundary (egress proxy, network policy), where the real
-* connection target is known. Internal deployments that legitimately POST
-* to private services should write their own narrower policy instead.
+* Validates the URL LITERAL only — no DNS resolution. Rebinding protection
+* belongs at the outbound network boundary (egress proxy / network policy).
 */
-const BLOCKED_V4 = /^(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|0\.)/;
 function defaultWebhookUrlPolicy(url) {
 	if (url.protocol !== "https:") throw new Error(`Webhook URL must use https (got ${url.protocol}//)`);
 	let host = url.hostname.toLowerCase();
@@ -136,47 +129,25 @@ function decodeMappedV4(host) {
 	return `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
 }
 /**
-* Verify an INBOUND third-party webhook signature using timing-safe
-* comparison — for webhooks arc RECEIVES (GitHub, Stripe, ...), not for
-* arc-to-arc delivery. Arc's own outbound contract is v1
-* (`x-arc-webhook-*`) — receivers of arc webhooks use {@link verifyWebhook}.
+* Timing-safe verification of an INBOUND third-party webhook (GitHub,
+* Stripe, ...). Defaults to `sha256=<hex>`; prefix/algorithm configurable.
+* Receivers of arc's own webhooks use {@link verifyWebhook}.
 *
-* Defaults to the common `sha256=<hex>` format; configurable for any HMAC
-* scheme via options.
+* ⚠ `body` must be the exact signed bytes: opt the route into
+* `config: { rawBody: true }` (arc registers fastify-raw-body with
+* `global: false`) and pass `req.rawBody` — re-serialised JSON won't match.
 *
-* ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
-* parses JSON bodies by default and the re-serialised object will NOT match
-* the original signature. Register `fastify-raw-body` (arc's createApp does
-* this automatically with `global: false`) and opt the route in via
-* `config: { rawBody: true }`, then pass `req.rawBody` here.
-*
-* @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
-* @param secret    - Shared secret between sender and receiver
-* @param signature - The signature header value (e.g. `req.headers['x-webhook-signature']`)
-* @param options   - Override prefix/algorithm for non-Arc senders
-* @returns `true` if valid, `false` otherwise — never throws
+* @returns `true` if valid, `false` otherwise. Throws `TypeError` only when
+*   `body` is not a string/Buffer.
 *
 * @example
 * ```typescript
-* import { verifySignature } from '@classytic/arc/integrations/webhooks';
-*
-* // `config: { rawBody: true }` is REQUIRED — arc registers
-* // fastify-raw-body with `global: false`, so routes opt in per-route;
-* // without it `req.rawBody` is undefined and verifySignature throws a
-* // TypeError.
-*
-* // GitHub-style sender (sha256=<hex>)
 * fastify.post('/webhooks/github', { config: { rawBody: true } }, async (req, reply) => {
 *   const sig = req.headers['x-hub-signature-256'] as string;
 *   if (!verifySignature(req.rawBody, secret, sig)) {
 *     return reply.status(401).send({ error: 'Invalid signature' });
 *   }
 * });
-*
-* // Stripe-style (bare hex, different header)
-* const valid = verifySignature(body, stripeSecret, req.headers['stripe-signature'], {
-*   prefix: '',
-* });
 * ```
 */
 function verifySignature(body, secret, signature, options) {
@@ -197,16 +168,9 @@ function verifySignature(body, secret, signature, options) {
 		return false;
 	}
 }
+/** The transports' own matcher — a local copy missed `order:*` (the `:` convention). */
 function matchesPattern(patterns, eventType) {
-	for (const pattern of patterns) {
-		if (pattern === "*") return true;
-		if (pattern === eventType) return true;
-		if (pattern.endsWith(".*")) {
-			const prefix = pattern.slice(0, -2);
-			if (eventType.startsWith(`${prefix}.`)) return true;
-		}
-	}
-	return false;
+	return patterns.some((pattern) => matchEventPattern(pattern, eventType));
 }
 var MemoryWebhookStore = class {
 	name = "memory";
@@ -376,10 +340,8 @@ var webhooks_default = fp(webhookPlugin, {
 /** Event type carried by durable webhook delivery rows. */
 const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
 /**
-* A failed webhook POST, classified for the failure policy: `transient`
-* failures (network error, timeout, 429, 5xx) are worth retrying; the rest
-* (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
-* malformed row) are final for this payload and dead-letter immediately.
+* A failed webhook POST. `transient` (network, timeout, 429, 5xx) retries;
+* anything else (4xx, 3xx, URL-policy rejection, malformed row) dead-letters.
 */
 var WebhookDeliveryError = class extends Error {
 	status;
@@ -392,15 +354,12 @@ var WebhookDeliveryError = class extends Error {
 	}
 };
 /**
-* Publish-only `EventTransport` whose `publish()` IS the webhook POST —
-* plugged into an outbox relay, delivery inherits the relay's guarantees.
-* Throws {@link WebhookDeliveryError} on failure so the relay observes it
-* (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
-* unregistered subscriptions (acknowledge).
+* Publish-only `EventTransport` whose `publish()` IS the webhook POST, for an
+* outbox relay. Throws {@link WebhookDeliveryError} on failure; returns on
+* 2xx or an unregistered subscription.
 *
-* The wire contract is IDENTICAL to inline dispatch: v1 signing, and
-* `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
-* across retries, so receiver-side dedup is unchanged.
+* Same wire contract as inline dispatch: `x-arc-webhook-delivery` is the
+* ORIGINAL event's `meta.id`, stable across retries.
 */
 function createWebhookDeliveryTransport(options) {
 	const fetchFn = options.fetch ?? globalThis.fetch;
@@ -464,10 +423,9 @@ function createWebhookDeliveryTransport(options) {
 	};
 }
 /**
-* Default failure policy for durable webhook delivery: permanent failures
-* ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
-* first attempt — repeating a rejected payload can't succeed; transient ones
-* retry on exponential backoff until `maxAttempts`, then dead-letter.
+* Default durable-delivery policy: non-transient {@link WebhookDeliveryError}s
+* dead-letter immediately; others retry with exponential backoff until
+* `maxAttempts`.
 */
 function webhookDeliveryFailurePolicy(options = {}) {
 	const maxAttempts = options.maxAttempts ?? 8;
@@ -498,11 +456,9 @@ function webhookDeliveryFailurePolicy(options = {}) {
 * });
 * ```
 *
-* The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
-* delivery and `role: 'api'` deployments only enqueue. The delivering process
-* must ALSO register `webhookPlugin` (with the shared subscription store) —
-* subscriptions resolve through `fastify.webhooks` at delivery time, which is
-* boot-checked, not discovered on the first row.
+* `role: 'relay'` deployments deliver; `role: 'api'` only enqueues. The
+* delivering process must ALSO register `webhookPlugin` with the shared
+* subscription store (boot-checked).
 */
 function createDurableWebhookModule(options) {
 	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, resolveHeaders, ...outboxOptions } = options;

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -1,5 +1,5 @@
 
-import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-Dov9l4qE.mjs";
+import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-UxCkoA4C.mjs";
 //#region src/integrations/websocket-pushref-redis.d.ts
 /**
  * Minimal `ioredis` shape — typed structurally so this file doesn't

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.

package/dist/integrations/websocket-redis.d.mts

@@ -1,5 +1,5 @@
 
-import { f as WebSocketAdapter } from "../websocket-BOXVggMf.mjs";
+import { f as WebSocketAdapter } from "../websocket-Cs4awVyD.mjs";
 //#region src/integrations/websocket-redis.d.ts
 interface RedisLike {
   publish(channel: string, message: string): Promise<number>;

package/dist/integrations/websocket-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-redis.ts
 /**
 * Redis Pub/Sub adapter for cross-instance WebSocket broadcast.

package/dist/integrations/websocket.d.mts

@@ -1,4 +1,4 @@
 
-import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
-import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore } from "../pushref-registry-Dov9l4qE.mjs";
-export { type AuthResult, type GeoPoint, type GeoPublishOpts, GeoRoom, type GeoRoomOptions, LocalWebSocketAdapter, MemoryPushRefStore, type Principal, PushRefRegistry, type PushRefRegistryOptions, type PushRefStore, RoomManager, type SerializedEntry, type WebSocketAdapter, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, websocketPlugin };
+import { a as GeoRoomOptions, c as WebSocketClient, d as LocalWebSocketAdapter, f as WebSocketAdapter, i as GeoRoom, l as WebSocketMessage, n as GeoPoint, o as RoomManager, r as GeoPublishOpts, s as AuthResult, t as websocketPlugin, u as WebSocketPluginOptions } from "../websocket-Cs4awVyD.mjs";
+import { a as PushRefRegistry, c as SerializedEntry, i as Principal, o as PushRefRegistryOptions, r as MemoryPushRefStore, s as PushRefStore, u as DeadQueueEntry } from "../pushref-registry-UxCkoA4C.mjs";
+export { type AuthResult, type DeadQueueEntry, type GeoPoint, type GeoPublishOpts, GeoRoom, type GeoRoomOptions, LocalWebSocketAdapter, MemoryPushRefStore, type Principal, PushRefRegistry, type PushRefRegistryOptions, type PushRefStore, RoomManager, type SerializedEntry, type WebSocketAdapter, type WebSocketClient, type WebSocketMessage, type WebSocketPluginOptions, websocketPlugin };

package/dist/integrations/websocket.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-DSA_dH1_.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-0tccjRlj.mjs";
 import { randomUUID } from "node:crypto";
 import sjson from "secure-json-parse";
 import fp from "fastify-plugin";

package/dist/{interface-DEWNOMza.d.mts → interface-C0395yUN.d.mts}

@@ -9,12 +9,20 @@
 interface IdempotencyResult {
   /** The idempotency key */
   key: string;
+  /**
+   * `fingerprintRequest` of the body the key was first used with. A retry under the same key
+   * with a different body is refused (422), never answered with this response. Absent on
+   * entries written before 2.43 — those replay without the check.
+   */
+  requestFingerprint?: string;
   /** HTTP status code of the cached response */
   statusCode: number;
   /** Response headers to replay */
   headers: Record<string, string>;
   /** Response body */
   body: unknown;
+  /** Binary responses are stored as base64 so JSON-backed stores preserve their bytes. */
+  bodyEncoding?: "base64";
   /** When this entry was created */
   createdAt: Date;
   /** When this entry expires */
@@ -33,6 +41,8 @@ interface IdempotencyLock {
 interface IdempotencyStore {
   /** Store name for logging */
   readonly name: string;
+  /** false when a conditional completion method cannot be atomic with this backing client. */
+  readonly supportsFencedCompletion?: boolean;
   /**
    * Get a cached result for an idempotency key.
    * Returns undefined if not found or expired.
@@ -43,6 +53,8 @@ interface IdempotencyStore {
    * TTL is handled by the store implementation.
    */
   set(key: string, result: Omit<IdempotencyResult, "key">): Promise<void>;
+  /** Atomically record only while requestId owns an unexpired lock. false means ownership lost. */
+  setIfLocked?(key: string, requestId: string, result: Omit<IdempotencyResult, "key">): Promise<boolean>;
   /**
    * Try to acquire a lock for processing a key.
    * Returns true if lock acquired, false if already locked.
@@ -73,6 +85,6 @@ interface IdempotencyStore {
 /**
  * Helper to create a result object
  */
-declare function createIdempotencyResult(statusCode: number, body: unknown, headers: Record<string, string>, ttlMs: number): Omit<IdempotencyResult, "key">;
+declare function createIdempotencyResult(statusCode: number, body: unknown, headers: Record<string, string>, ttlMs: number, requestFingerprint?: string): Omit<IdempotencyResult, "key">;
 //#endregion
 export { createIdempotencyResult as i, IdempotencyResult as n, IdempotencyStore as r, IdempotencyLock as t };

package/dist/{jsonBody-Cq9KYl2Z.mjs → jsonBody-B4YVGcql.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as ArcError } from "./errors-C_YhELhe.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as ArcError } from "./errors-CtrywMHP.mjs";
 import sjson from "secure-json-parse";
 //#region src/utils/jsonBody.ts
 /**

package/dist/{keys-Cmv4cBRa.mjs → keys-B2KtgMLJ.mjs}

@@ -1,4 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { contentHash } from "@classytic/repo-core/hash";
 //#region src/cache/keys.ts
 /**
 * Cache Key Utilities
@@ -20,25 +21,13 @@ function tagVersionKey(tag) {
 	return `arc:tagver:${tag}`;
 }
 /**
-* Stable hash for query params.
-* Sorts keys recursively, serializes to JSON, then applies djb2 hash.
-* Returns hex string.
+* Digest of the query params for a cache key — repo-core's canonical serialiser (escaped,
+* type-preserving, key-order-free) under SHA-256. Two different queries never share a key: a
+* delimiter inside a value, `1` vs `"1"`, two dates or two regexes all stay distinct, and a
+* cryptographic digest leaves no crafted collision onto another caller's cached result.
 */
 function hashParams(params) {
-	return djb2(stableStringify(params)).toString(36);
-}
-function stableStringify(value) {
-	if (value === null || value === void 0) return "";
-	if (typeof value !== "object") return String(value);
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (value instanceof RegExp) return `/${value.source}/${value.flags}`;
-	if (value instanceof Date) return `d${value.getTime()}`;
-	return "{" + Object.keys(value).sort().map((k) => `${k}:${stableStringify(value[k])}`).join(",") + "}";
-}
-function djb2(str) {
-	let hash = 5381;
-	for (let i = 0; i < str.length; i++) hash = (hash << 5) + hash + str.charCodeAt(i) >>> 0;
-	return hash;
+	return contentHash(params, { encoding: "base64url" });
 }
 //#endregion
 export { versionKey as i, hashParams as n, tagVersionKey as r, buildQueryKey as t };