@classytic/arc 2.41.1 → 2.43.0

package/dist/testing/index.mjs

@@ -1,12 +1,13 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-D5Ubn1fe.mjs";
-import { g as getUserId } from "../types-CgenB1gv.mjs";
-import { t as BaseController } from "../BaseController-CYEwjyjN.mjs";
-import { t as defineAggregation } from "../defineAggregation-D_eJjm5A.mjs";
-import { t as defineResource } from "../defineResource-DxkMTjRn.mjs";
-import { E as requireOrgRole } from "../permissions-D8TBH44E.mjs";
-import { a as createApp, n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-f3boenVZ.mjs";
-import { n as getModuleExports } from "../module-DpLJG2_N.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-Cu7Mx7_U.mjs";
+import { c as BaseController } from "../plugin-BccET1tL.mjs";
+import { g as getUserId } from "../types-Bk9NOgOC.mjs";
+import { t as defineAggregation } from "../defineAggregation-Bm8RjMbq.mjs";
+import { t as defineResource } from "../defineResource-DIC7JZGU.mjs";
+import { E as requireOrgRole } from "../permissions-Cm0uYHvd.mjs";
+import { h as asModulePorts, r as createApp } from "../createApp-D-953ZAq.mjs";
+import { d as resolveModule, l as isLazyBridge, o as resolveModuleClosure } from "../plan-FVR6LP59.mjs";
+import { n as getModuleExports } from "../module-BSvOQC7E.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -134,6 +135,243 @@ function expectArc(response) {
 	return assertion;
 }
 //#endregion
+//#region src/testing/testActor.ts
+/**
+* Test-only actor installation — how a package's HTTP tests say "run this
+* request as a manager in org X".
+*
+* Identity in arc comes from `request.scope` and only from `request.scope`;
+* headers like `x-role` are not identity. That rule left tests with no seam —
+* `bootModuleApp` boots with `auth: false`, so every injected request arrived as
+* `PUBLIC_SCOPE` and any role-gated route answered 401 with no supported way to
+* be somebody.
+*
+* The `x-test-actor` header is a TRANSPORT for the test's intent, not a trusted
+* claim. The authenticator that reads it is installed by `bootModuleApp` alone,
+* behind the `@classytic/arc/testing` entrypoint; `createApp` never registers
+* it, so no production build turns a forged header into identity. It is
+* per-request rather than boot-only because the interesting authorization tests
+* are the ones where a cashier is refused what a manager is allowed.
+*
+* Gate the routes under test with arc's own primitives — `requireRoles`,
+* `requireOrgMembership`, `allOf(...)`. A test-specific gate would be a second
+* implementation of authorization whose semantics could drift from the one
+* actually shipping.
+*/
+/** The header the testing harness uses to carry a request's actor. */
+const TEST_ACTOR_HEADER = "x-test-actor";
+/**
+* Build the headers that make an injected request act as `actor`.
+*
+* A string is shorthand for a single role. `null` means "stay public", so a test
+* can prove an endpoint is reachable anonymously.
+*
+* @example
+* ```ts
+* t.app.inject({ method: 'GET', url: '/pos/shifts/current',
+*   headers: testActorHeaders('manager', ORG) });
+* ```
+*/
+function testActorHeaders(actor, organizationId) {
+	if (actor === null) return {};
+	const org = organizationId !== void 0 ? { organizationId } : {};
+	const spec = typeof actor === "string" ? {
+		roles: [actor],
+		...org
+	} : {
+		...actor,
+		...org
+	};
+	return { [TEST_ACTOR_HEADER]: JSON.stringify(spec) };
+}
+/**
+* Turn a spec into a `RequestScope`.
+*
+* `orgRoles` defaults to `roles`: a test that says "manager" means it at both
+* levels, and making the caller repeat itself only produces tests that pass a
+* global gate and mysteriously fail an org one.
+*/
+function scopeFromTestActor(spec) {
+	const roles = spec.roles ?? [];
+	const userId = spec.userId ?? `test-${roles.join("-") || "anon"}`;
+	if (spec.elevated !== void 0 && spec.elevated !== false) return {
+		kind: "elevated",
+		userId,
+		elevatedBy: spec.elevated === true ? "test" : spec.elevated,
+		...spec.organizationId !== void 0 ? { organizationId: spec.organizationId } : {},
+		...spec.context !== void 0 ? { context: Object.freeze({ ...spec.context }) } : {}
+	};
+	if (spec.organizationId !== void 0) return {
+		kind: "member",
+		userId,
+		userRoles: roles,
+		organizationId: spec.organizationId,
+		orgRoles: spec.orgRoles ?? roles,
+		...spec.teamId !== void 0 ? { teamId: spec.teamId } : {},
+		...spec.context !== void 0 ? { context: Object.freeze({ ...spec.context }) } : {}
+	};
+	return {
+		kind: "authenticated",
+		userId,
+		userRoles: roles
+	};
+}
+/**
+* Build the `auth` option that makes the test actor arc's authenticator.
+*
+* It must be an authenticator, not a hook. Fastify encapsulates plugins and
+* modules register DURING `createApp`, so a hook added to the root instance
+* afterwards never runs for their routes — every request still resolves as
+* public and every role gate still answers 401, which reads exactly like a
+* broken authorization rule in the code under test. Registering as
+* `auth: { type: 'authenticator' }` puts the scope where arc's own auth would,
+* at the phase arc expects, so tenant filtering and permission checks behave
+* identically to production.
+*
+* `defaultActor` applies to requests carrying no header. A malformed header
+* REJECTS rather than falling back to public — a test that meant to be an admin
+* and got quietly demoted is the most expensive way to fail.
+*/
+function testActorAuth(defaultActor) {
+	const authenticate = async (request) => {
+		const req = request;
+		const raw = req.headers[TEST_ACTOR_HEADER];
+		let spec = defaultActor;
+		if (typeof raw === "string") try {
+			spec = JSON.parse(raw);
+		} catch {
+			throw new Error(`[arc-testing] malformed ${TEST_ACTOR_HEADER} header: ${raw}. Build it with testActorHeaders() rather than by hand.`);
+		}
+		if (spec === void 0) return;
+		req.scope = scopeFromTestActor(spec);
+		req.user = {
+			id: getUserId(req.scope) ?? "test-anon",
+			...spec.roles !== void 0 ? { role: spec.roles } : {},
+			...spec.organizationId !== void 0 ? { organizationId: spec.organizationId } : {}
+		};
+	};
+	return {
+		type: "authenticator",
+		authenticate
+	};
+}
+//#endregion
+//#region src/testing/bootModuleApp.ts
+/**
+* The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+* Everything Mongo-specific about the harness lives HERE — the harness
+* itself is driver-blind and any kit can replace this via `database`.
+*/
+async function mongoMemoryDatabase(opts) {
+	let mms;
+	try {
+		mms = await import("mongodb-memory-server");
+	} catch {
+		throw new Error("[arc-testing] bootModuleApp's default database is in-memory MongoDB — install 'mongodb-memory-server' + 'mongoose' as devDependencies, or inject your own `database` factory for a different store");
+	}
+	const server = opts.replset ? await mms.MongoMemoryReplSet.create({ replSet: { count: 1 } }) : await mms.MongoMemoryServer.create();
+	const uri = server.getUri();
+	const mongoose = (await import("mongoose")).default;
+	if (mongoose.connection.readyState !== 0) await mongoose.disconnect();
+	await mongoose.connect(uri);
+	mongoose.connection.deleteModel(/.*/);
+	return {
+		uri,
+		connection: mongoose.connection,
+		teardown: async () => {
+			if (mongoose.connection.readyState !== 0) await mongoose.disconnect().catch(() => void 0);
+			await server.stop().catch(() => void 0);
+		}
+	};
+}
+async function bootModuleApp(modules, options = {}) {
+	const db = await (options.database ?? mongoMemoryDatabase)({ replset: options.replset ?? false });
+	const ctx = {
+		uri: db.uri,
+		connection: db.connection
+	};
+	const resolved = typeof modules === "function" ? await modules(ctx) : modules;
+	const list = Array.isArray(resolved) ? resolved : [resolved];
+	let app;
+	try {
+		app = await createApp({
+			preset: "testing",
+			/**
+			* The test actor is arc's AUTHENTICATOR rather than a bolted-on hook, so the scope
+			* lands at the phase the rest of the pipeline expects — tenant filtering and
+			* permission checks then behave exactly as they do in production.
+			*
+			* This replaces the old `auth: false`. The authenticator is inert for a request
+			* carrying no `x-test-actor` header and no configured default, so a suite that
+			* never mentions an actor behaves as it did before. `options.app` still wins, so a
+			* suite exercising real auth can override it.
+			*/
+			auth: testActorAuth(options.actor),
+			sensible: false,
+			...options.app,
+			...options.ports ? { ports: options.ports } : {},
+			modules: list
+		});
+		await app.ready();
+	} catch (err) {
+		await db.teardown().catch(() => void 0);
+		throw err;
+	}
+	let closed = false;
+	return {
+		app,
+		uri: db.uri,
+		connection: db.connection,
+		exports: (name) => getModuleExports(app, name),
+		close: async () => {
+			if (closed) return;
+			closed = true;
+			await app.close().catch(() => void 0);
+			await db.teardown().catch(() => void 0);
+		}
+	};
+}
+//#endregion
+//#region src/testing/assertModuleBootsAlone.ts
+/**
+* Boot a module inside its closure — `resolveModuleClosure` (its `dependsOn` and
+* `requires.modules`, transitively, plus every platform module) and every bridge in the list,
+* which arc activates only when both ends are present — and fail naming the module when the boot
+* or the `probe` throws. A hidden edge fails here, by name.
+*
+* ```ts
+* it("order boots alone", () => assertModuleBootsAlone(allModules, "order", { probe: (t) => drivePorts(t) }));
+* ```
+*/
+async function assertModuleBootsAlone(modules, name, options = {}) {
+	const roots = typeof name === "string" ? [name] : name;
+	const label = roots.map((r) => `"${r}"`).join(" + ");
+	let closure = [];
+	try {
+		const { probe, ...bootOptions } = options;
+		const t = await bootModuleApp(async (ctx) => {
+			const resolved = typeof modules === "function" ? await modules(ctx) : modules;
+			const inputs = isInputList(resolved) ? resolved : [resolved];
+			const nodes = await Promise.all(inputs.map((input) => isLazyBridge(input) ? input : resolveModule(input)));
+			const included = new Set(resolveModuleClosure(nodes, roots).map((m) => m.name));
+			closure = nodes.filter((m) => included.has(m.name)).map((m) => m.name);
+			return nodes.filter((m) => included.has(m.name) || m.kind === "bridge");
+		}, bootOptions);
+		try {
+			await probe?.(t);
+		} finally {
+			await t.close();
+		}
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		throw new Error(`[arc/testing] module ${label} does not boot alone in its closure [${closure.join(", ") || "unresolved"}]: ${msg}`, { cause: err });
+	}
+	return { closure };
+}
+function isInputList(value) {
+	return Array.isArray(value);
+}
+//#endregion
 //#region src/testing/mocks.ts
 /**
 * Create a mock repository for testing
@@ -833,202 +1071,6 @@ async function setupBetterAuthTestApp(input) {
 	};
 }
 //#endregion
-//#region src/testing/testActor.ts
-/**
-* Test-only actor installation — how a package's HTTP tests say "run this
-* request as a manager in org X".
-*
-* Identity in arc comes from `request.scope` and only from `request.scope`;
-* headers like `x-role` are not identity. That rule left tests with no seam —
-* `bootModuleApp` boots with `auth: false`, so every injected request arrived as
-* `PUBLIC_SCOPE` and any role-gated route answered 401 with no supported way to
-* be somebody.
-*
-* The `x-test-actor` header is a TRANSPORT for the test's intent, not a trusted
-* claim. The authenticator that reads it is installed by `bootModuleApp` alone,
-* behind the `@classytic/arc/testing` entrypoint; `createApp` never registers
-* it, so no production build turns a forged header into identity. It is
-* per-request rather than boot-only because the interesting authorization tests
-* are the ones where a cashier is refused what a manager is allowed.
-*
-* Gate the routes under test with arc's own primitives — `requireRoles`,
-* `requireOrgMembership`, `allOf(...)`. A test-specific gate would be a second
-* implementation of authorization whose semantics could drift from the one
-* actually shipping.
-*/
-/** The header the testing harness uses to carry a request's actor. */
-const TEST_ACTOR_HEADER = "x-test-actor";
-/**
-* Build the headers that make an injected request act as `actor`.
-*
-* A string is shorthand for a single role. `null` means "stay public", so a test
-* can prove an endpoint is reachable anonymously.
-*
-* @example
-* ```ts
-* t.app.inject({ method: 'GET', url: '/pos/shifts/current',
-*   headers: testActorHeaders('manager', ORG) });
-* ```
-*/
-function testActorHeaders(actor, organizationId) {
-	if (actor === null) return {};
-	const org = organizationId !== void 0 ? { organizationId } : {};
-	const spec = typeof actor === "string" ? {
-		roles: [actor],
-		...org
-	} : {
-		...actor,
-		...org
-	};
-	return { [TEST_ACTOR_HEADER]: JSON.stringify(spec) };
-}
-/**
-* Turn a spec into a `RequestScope`.
-*
-* `orgRoles` defaults to `roles`: a test that says "manager" means it at both
-* levels, and making the caller repeat itself only produces tests that pass a
-* global gate and mysteriously fail an org one.
-*/
-function scopeFromTestActor(spec) {
-	const roles = spec.roles ?? [];
-	const userId = spec.userId ?? `test-${roles.join("-") || "anon"}`;
-	if (spec.elevated !== void 0 && spec.elevated !== false) return {
-		kind: "elevated",
-		userId,
-		elevatedBy: spec.elevated === true ? "test" : spec.elevated,
-		...spec.organizationId !== void 0 ? { organizationId: spec.organizationId } : {},
-		...spec.context !== void 0 ? { context: Object.freeze({ ...spec.context }) } : {}
-	};
-	if (spec.organizationId !== void 0) return {
-		kind: "member",
-		userId,
-		userRoles: roles,
-		organizationId: spec.organizationId,
-		orgRoles: spec.orgRoles ?? roles,
-		...spec.teamId !== void 0 ? { teamId: spec.teamId } : {},
-		...spec.context !== void 0 ? { context: Object.freeze({ ...spec.context }) } : {}
-	};
-	return {
-		kind: "authenticated",
-		userId,
-		userRoles: roles
-	};
-}
-/**
-* Build the `auth` option that makes the test actor arc's authenticator.
-*
-* It must be an authenticator, not a hook. Fastify encapsulates plugins and
-* modules register DURING `createApp`, so a hook added to the root instance
-* afterwards never runs for their routes — every request still resolves as
-* public and every role gate still answers 401, which reads exactly like a
-* broken authorization rule in the code under test. Registering as
-* `auth: { type: 'authenticator' }` puts the scope where arc's own auth would,
-* at the phase arc expects, so tenant filtering and permission checks behave
-* identically to production.
-*
-* `defaultActor` applies to requests carrying no header. A malformed header
-* REJECTS rather than falling back to public — a test that meant to be an admin
-* and got quietly demoted is the most expensive way to fail.
-*/
-function testActorAuth(defaultActor) {
-	const authenticate = async (request) => {
-		const req = request;
-		const raw = req.headers[TEST_ACTOR_HEADER];
-		let spec = defaultActor;
-		if (typeof raw === "string") try {
-			spec = JSON.parse(raw);
-		} catch {
-			throw new Error(`[arc-testing] malformed ${TEST_ACTOR_HEADER} header: ${raw}. Build it with testActorHeaders() rather than by hand.`);
-		}
-		if (spec === void 0) return;
-		req.scope = scopeFromTestActor(spec);
-		req.user = {
-			id: getUserId(req.scope) ?? "test-anon",
-			...spec.roles !== void 0 ? { role: spec.roles } : {},
-			...spec.organizationId !== void 0 ? { organizationId: spec.organizationId } : {}
-		};
-	};
-	return {
-		type: "authenticator",
-		authenticate
-	};
-}
-//#endregion
-//#region src/testing/bootModuleApp.ts
-/**
-* The built-in DB factory: in-memory MongoDB via lazy devDep imports.
-* Everything Mongo-specific about the harness lives HERE — the harness
-* itself is driver-blind and any kit can replace this via `database`.
-*/
-async function mongoMemoryDatabase(opts) {
-	let mms;
-	try {
-		mms = await import("mongodb-memory-server");
-	} catch {
-		throw new Error("[arc-testing] bootModuleApp's default database is in-memory MongoDB — install 'mongodb-memory-server' + 'mongoose' as devDependencies, or inject your own `database` factory for a different store");
-	}
-	const server = opts.replset ? await mms.MongoMemoryReplSet.create({ replSet: { count: 1 } }) : await mms.MongoMemoryServer.create();
-	const uri = server.getUri();
-	const mongoose = (await import("mongoose")).default;
-	if (mongoose.connection.readyState !== 0) await mongoose.disconnect();
-	await mongoose.connect(uri);
-	mongoose.connection.deleteModel(/.*/);
-	return {
-		uri,
-		connection: mongoose.connection,
-		teardown: async () => {
-			if (mongoose.connection.readyState !== 0) await mongoose.disconnect().catch(() => void 0);
-			await server.stop().catch(() => void 0);
-		}
-	};
-}
-async function bootModuleApp(modules, options = {}) {
-	const db = await (options.database ?? mongoMemoryDatabase)({ replset: options.replset ?? false });
-	const ctx = {
-		uri: db.uri,
-		connection: db.connection
-	};
-	const resolved = typeof modules === "function" ? await modules(ctx) : modules;
-	const list = Array.isArray(resolved) ? resolved : [resolved];
-	let app;
-	try {
-		app = await createApp({
-			preset: "testing",
-			/**
-			* The test actor is arc's AUTHENTICATOR rather than a bolted-on hook, so the scope
-			* lands at the phase the rest of the pipeline expects — tenant filtering and
-			* permission checks then behave exactly as they do in production.
-			*
-			* This replaces the old `auth: false`. The authenticator is inert for a request
-			* carrying no `x-test-actor` header and no configured default, so a suite that
-			* never mentions an actor behaves as it did before. `options.app` still wins, so a
-			* suite exercising real auth can override it.
-			*/
-			auth: testActorAuth(options.actor),
-			sensible: false,
-			...options.app,
-			modules: list
-		});
-		await app.ready();
-	} catch (err) {
-		await db.teardown().catch(() => void 0);
-		throw err;
-	}
-	let closed = false;
-	return {
-		app,
-		uri: db.uri,
-		connection: db.connection,
-		exports: (name) => getModuleExports(app, name),
-		close: async () => {
-			if (closed) return;
-			closed = true;
-			await app.close().catch(() => void 0);
-			await db.teardown().catch(() => void 0);
-		}
-	};
-}
-//#endregion
 //#region src/testing/fixtures.ts
 function createTestFixtures() {
 	const registry = /* @__PURE__ */ new Map();
@@ -1356,13 +1398,45 @@ function createHttpTestHarness(resource, optionsOrGetter) {
 }
 //#endregion
 //#region src/testing/moduleSetup.ts
-function createTestModuleSetup() {
+/**
+* A real `ModuleSetupContext` for tests that invoke a module's setup phases
+* DIRECTLY — `mod.bootstrap(app, ctx)`, `mod.plugins(app, ctx)` — instead of
+* booting a whole app through `createApp` / `bootModuleApp`.
+*
+* ## Why this is not `{ defer: () => {} }`
+*
+* That literal satisfies the type and throws away every disposer the module
+* registers. A test written against it passes whether the module releases what
+* it acquired or leaks it, so the one thing `defer` exists to make testable
+* becomes the one thing that cannot be tested. It also gives a false negative
+* in the other direction: a module that starts deferring later keeps its green
+* test, which is precisely the "compiles today, wrong tomorrow" shape the
+* disposer contract was introduced to remove.
+*
+* This collects them instead, and `dispose()` unwinds LIFO — the same order
+* arc's own teardown uses, so an ordering bug surfaces here rather than in
+* production shutdown.
+*
+* @example
+* ```ts
+* const setup = createTestModuleSetup();
+* const engine = await mod.bootstrap?.(app, setup.context);
+*
+* expect(setup.deferred).toHaveLength(1);   // it registered its teardown
+* await setup.dispose();                    // and it actually releases
+* expect(engine.closed).toBe(true);
+* ```
+*/
+function createTestModuleSetup(options = {}) {
 	const deferred = [];
 	return {
-		context: { defer(disposer) {
-			if (typeof disposer !== "function") throw new TypeError(`[arc/testing] defer() expected a function, received ${typeof disposer}.`);
-			deferred.push(disposer);
-		} },
+		context: {
+			ports: asModulePorts(Object.freeze({ ...options.ports })),
+			defer(disposer) {
+				if (typeof disposer !== "function") throw new TypeError(`[arc/testing] defer() expected a function, received ${typeof disposer}.`);
+				deferred.push(disposer);
+			}
+		},
 		deferred,
 		async dispose() {
 			const errors = [];
@@ -1504,7 +1578,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../preloadResources-f3boenVZ.mjs").then((n) => n.o);
+	const { createApp } = await import("../createApp-D-953ZAq.mjs").then((n) => n.i);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;
@@ -1574,4 +1648,4 @@ function createMinimalTestApp(options = {}) {
 	});
 }
 //#endregion
-export { HttpTestHarness, TEST_ACTOR_HEADER, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };
+export { HttpTestHarness, TEST_ACTOR_HEADER, assertModuleBootsAlone, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestModuleSetup, createTestTimer, expectArc, mongoMemoryDatabase, runAuthorizationConformance, runStorageContract, safeParseBody, scopeFromTestActor, scopeRoleGate, setupBetterAuthTestApp, testActorAuth, testActorHeaders, waitFor };

package/dist/testing/outboxStoreContract.mjs

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { OutboxOwnershipError } from "@classytic/primitives/outbox";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as claimedAttempts } from "../claimed-B10RTfkM.mjs";
+import { OutboxConflictError, OutboxOwnershipError } from "@classytic/primitives/outbox";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 //#region src/testing/outboxStoreContract.ts
 let seq = 0;
@@ -81,6 +82,26 @@ function runOutboxStoreContract(name, setup) {
 				expect((await store.getPending(10)).length).toBe(0);
 			});
 		});
+		describe("save — one row per event id", () => {
+			it("a second save of the same id and payload is a no-op", async () => {
+				const e = event();
+				await store.save(e);
+				await store.save({
+					...e,
+					meta: { ...e.meta }
+				});
+				expect((await store.getPending(10)).map(idOf)).toEqual([idOf(e)]);
+			});
+			it("THROWS OutboxConflictError when the same id arrives with a different payload", async () => {
+				const e = event();
+				await store.save(e);
+				await expect(store.save({
+					...e,
+					payload: { n: -1 }
+				})).rejects.toBeInstanceOf(OutboxConflictError);
+				expect((await store.getPending(10)).length).toBe(1);
+			});
+		});
 		describe("getPending", () => {
 			it("returns events FIFO (oldest first)", async () => {
 				const saved = await seed(3);
@@ -164,6 +185,120 @@ function runOutboxStoreContract(name, setup) {
 				expect(claimed.map(idOf)).toEqual(saved.slice(0, 2).map(idOf));
 			});
 		});
+		/**
+		* The fenced claim had NO coverage here, though it is the path the relay
+		* prefers and the one fencing exists for. Two guarantees, both silent when
+		* broken:
+		*   - a re-claim after lease expiry mints a STRICTLY GREATER token, so the
+		*     crashed-and-resumed ex-holder cannot acknowledge an event it no longer
+		*     owns;
+		*   - `attempts`, when a store reports it, is the DURABLE count — it must
+		*     rise across claims by different consumers, because a count that each
+		*     relay keeps for itself is the thing it exists to replace.
+		*/
+		describe("claimPendingFenced — fencing tokens + durable attempts", () => {
+			it("mints a STRICTLY GREATER token when a lease is taken over", async ({ skip }) => {
+				if (!store.claimPendingFenced) return skip();
+				await seed(1);
+				const [first] = await store.claimPendingFenced({
+					consumerId: "dead",
+					limit: 1,
+					leaseMs: 0
+				});
+				const [second] = await store.claimPendingFenced({
+					consumerId: "c2",
+					limit: 1
+				});
+				if (!first || !second) return skip();
+				expect(second.fencingToken).toBeGreaterThan(first.fencingToken);
+			});
+			it("REJECTS an acknowledge carrying the superseded token", async ({ skip }) => {
+				if (!store.claimPendingFenced) return skip();
+				await seed(1);
+				const [stale] = await store.claimPendingFenced({
+					consumerId: "dead",
+					limit: 1,
+					leaseMs: 0
+				});
+				const [current] = await store.claimPendingFenced({
+					consumerId: "c2",
+					limit: 1
+				});
+				if (!stale || !current) return skip();
+				await expect(store.acknowledge(idOf(stale.event), { fencingToken: stale.fencingToken })).rejects.toBeInstanceOf(OutboxOwnershipError);
+			});
+			it("reports attempts = 1 on the first claim, when it reports attempts at all", async ({ skip }) => {
+				if (!store.claimPendingFenced) return skip();
+				await seed(1);
+				const [claimed] = await store.claimPendingFenced({
+					consumerId: "c1",
+					limit: 1
+				});
+				const attempts = claimed ? claimedAttempts(claimed) : void 0;
+				if (attempts === void 0) return skip();
+				expect(attempts).toBe(1);
+			});
+			it("attempts is DURABLE — it rises across claims by DIFFERENT consumers", async ({ skip }) => {
+				if (!store.claimPendingFenced || !store.fail) return skip();
+				await seed(1);
+				const seen = [];
+				for (const consumerId of [
+					"relay-a",
+					"relay-b",
+					"relay-c"
+				]) {
+					const [claimed] = await store.claimPendingFenced({
+						consumerId,
+						limit: 1
+					});
+					if (!claimed) return skip();
+					const attempts = claimedAttempts(claimed);
+					if (attempts === void 0) return skip();
+					seen.push(attempts);
+					await store.fail(idOf(claimed.event), { message: "boom" }, {
+						consumerId,
+						fencingToken: claimed.fencingToken
+					});
+				}
+				expect(seen).toEqual([
+					1,
+					2,
+					3
+				]);
+			});
+			it("requeue RESETS attempts — a re-driven event starts over", async ({ skip }) => {
+				if (!store.claimPendingFenced || !store.fail || !store.requeue) return skip();
+				await seed(1);
+				const [claimed] = await store.claimPendingFenced({
+					consumerId: "c1",
+					limit: 1
+				});
+				if (!claimed || claimedAttempts(claimed) === void 0) return skip();
+				await store.fail(idOf(claimed.event), { message: "fatal" }, {
+					consumerId: "c1",
+					fencingToken: claimed.fencingToken,
+					deadLetter: true
+				});
+				expect(await store.requeue(idOf(claimed.event))).toBe(true);
+				const [again] = await store.claimPendingFenced({
+					consumerId: "c2",
+					limit: 1
+				});
+				expect(again ? claimedAttempts(again) : void 0).toBe(1);
+			});
+		});
+		describe("acknowledgeMany — one write per flush", () => {
+			it("marks every listed event delivered and ignores unknown ids", async ({ skip }) => {
+				if (!store.acknowledgeMany) return skip();
+				const events = await seed(3);
+				await store.acknowledgeMany([
+					idOf(events[0]),
+					idOf(events[2]),
+					"nope"
+				]);
+				expect((await store.getPending(10)).map(idOf)).toEqual([idOf(events[1])]);
+			});
+		});
 		describe("acknowledge", () => {
 			it("removes the event from pending", async () => {
 				const [e] = await seed(1);