@classytic/arc 2.41.1 → 2.44.0

package/dist/factory/index.d.mts

@@ -1,25 +1,17 @@
 
-import { _ as HealthCheck, a as ModuleContribution, c as LoadResourcesOptions, d as loadResources, i as EventHandlerDefinition, l as ResourceLike, n as ArcModuleInput, o as ModuleDisposer, r as ArcModuleRegistry, s as ModuleSetupContext, t as ArcModule, u as ResourceModule } from "../types-DfVDvkdP.mjs";
-import { _ as collectModuleScheduledJobs, a as lazyModuleExports, c as getModuleState, d as resolveModule, f as orderModules, g as collectModuleHealthChecks, h as extendModule, i as hasModuleExports, l as hasModule, m as ModuleExtension, n as getModuleExports, o as lazyRequiredModuleExports, p as subscribeModuleEventHandlers, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as resolveContribution, v as collectModuleWorkflows } from "../index-CFfLKMH4.mjs";
-import { c as ResolvedResourceDescriptor, l as describeResolvedModule, o as ResolvedModuleDescriptor, s as ResolvedModuleLifecycle } from "../fastify-augmentation-Cq2nHVaW.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-CjS2OfpU.mjs";
+import { _ as ResourceLike, a as ArcPortRegistry, c as LazyBridge, d as ModulePorts, f as ModuleRequirements, g as LoadResourcesOptions, h as ModuleSetupContext, i as ArcModuleRegistry, l as ModuleContribution, m as ModuleDisposer, n as ArcModule, o as ArcPorts, p as PortName, r as ArcModuleInput, s as EventHandlerDefinition, t as ArcCompositionConfig, u as ModuleName, v as ResourceModule, w as HealthCheck, y as loadResources } from "../types-BJ-2XqVF.mjs";
+import { $ as verifyModuleGraph, A as AsyncApiCatalogEntry, B as ModuleGraphMode, C as planModules, D as ModuleExtension, E as subscribeModuleEventHandlers, F as DurabilityFacts, G as activateBridges, H as ModuleGraphOptions, I as HandlerDurabilityFact, J as crudEventsOf, K as analyzeModuleGraph, L as ModuleGraph, M as toAsyncApi, N as CrudSurface, O as extendModule, P as DerivedPublishes, Q as verifyEventDurability, R as ModuleGraphAnalysis, S as compositionProblems, T as orderModules, U as ModuleKind, V as ModuleGraphNode, W as SkippedBridge, X as eventTopology, Y as dependentsOf, Z as renderModuleGraph, _ as ClosureNode, a as lazyModuleExports, b as PlanModulesOptions, c as getModuleResources, d as resolveContribution, f as resolveModule, g as withRelayNudge, h as createRelayNudge, i as hasModuleExports, j as AsyncApiInfo, k as collectModuleWorkflows, l as getModuleState, m as RelayOption, n as getModuleExports, o as lazyRequiredModuleExports, p as RelayNudge, q as buildModuleGraph, r as getOptionalModuleExports, s as ModuleState, t as defineModule, u as hasModule, v as CompositionProblem, w as resolveModuleClosure, x as assertComposable, y as ModulePlan, z as ModuleGraphIssue } from "../index-CUJvoyw3.mjs";
+import { a as ResolvedModuleDescriptor, o as ResolvedModuleLifecycle, s as ResolvedResourceDescriptor } from "../fastify-augmentation-DRlCIWE9.mjs";
+import { a as UnderPressureOptions, c as CustomAuthenticatorOption, i as RawBodyOptions, l as CustomPluginAuthOption, n as CreateAppOptions, o as AuthOption, r as MultipartOptions, s as BetterAuthOption, t as BootDisposer, u as JwtAuthOption } from "../index-BkV55WlV.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**
- * Default redact paths layered into Fastify's pino logger when the host
- * doesn't supply a `logger.redact` of their own. Covers the common token /
- * cookie / password leak surfaces — `Authorization` and `Cookie` headers
- * (and their case-variants because Node lower-cases incoming headers but
- * outgoing logs may carry either), API-key headers, and any nested
- * `password` / `token` / `secret` / `apiKey` fields anywhere in the log
- * tree.
- *
- * Hosts that need NO redaction (test fixtures, security audits) opt out
- * with `logger: { redact: [] }`. Hosts that need MORE redaction supply
- * their own `redact` and arc steps aside — this default never overrides
- * an explicit setting.
+ * Default pino redact paths (auth/cookie/API-key headers, nested
+ * password/token/secret fields), applied only when the host supplies no
+ * `logger.redact`. Opt out with `logger: { redact: [] }`; an explicit
+ * `redact` always wins.
  */
-declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', 'req.headers["x-device-token"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
+export declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization", 'req.headers["x-api-key"]', 'req.headers["x-internal-api-key"]', 'req.headers["x-device-token"]', "req.headers.cookie", 'req.headers["set-cookie"]', 'res.headers["set-cookie"]', "*.password", "*.passwordHash", "*.token", "*.accessToken", "*.refreshToken", "*.secret", "*.apiKey"];
 /**
  * Create a production-ready Fastify application with Arc framework.
  *
@@ -42,11 +34,11 @@ declare const DEFAULT_LOGGER_REDACT_PATHS: readonly ["req.headers.authorization"
  * **Boot is all-or-nothing.** If any phase throws, the partially-built
  * instance is closed before the error propagates — see the wrapper below.
  */
-declare function createApp(options: CreateAppOptions): Promise<FastifyInstance>;
+export declare function createApp(options: CreateAppOptions): Promise<FastifyInstance>;
 /**
  * Quick factory for common scenarios
  */
-declare const ArcFactory: {
+export declare const ArcFactory: {
   production(options: Omit<CreateAppOptions, "preset">): Promise<FastifyInstance>;
   development(options: Omit<CreateAppOptions, "preset">): Promise<FastifyInstance>;
   testing(options: Omit<CreateAppOptions, "preset">): Promise<FastifyInstance>;
@@ -73,7 +65,7 @@ interface ArcWorker {
   /** Close app → module onClose (reverse) → app onClose. Idempotent. */
   close(): Promise<void>;
 }
-declare function createWorker(options: CreateAppOptions, workerOptions?: CreateWorkerOptions): Promise<ArcWorker>;
+export declare function createWorker(options: CreateAppOptions, workerOptions?: CreateWorkerOptions): Promise<ArcWorker>;
 //#endregion
 //#region src/factory/edge.d.ts
 interface FetchHandlerOptions {
@@ -109,21 +101,44 @@ interface FetchHandlerOptions {
  * (protobuf, images, non-UTF-8 charsets) survive intact — the
  * content-type parser decides how to decode, same as a real socket.
  */
-declare function toFetchHandler(app: FastifyInstance, options?: FetchHandlerOptions): (request: Request) => Promise<Response>;
+export declare function toFetchHandler(app: FastifyInstance, options?: FetchHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/factory/preloadResources.d.ts
+/** Eager glob result: `{ '/path/to/file.ts': resourceModule }` */
+type EagerGlobResult = Record<string, unknown>;
+/** Lazy glob result: `{ '/path/to/file.ts': () => Promise<unknown> }` */
+type LazyGlobResult = Record<string, () => Promise<unknown>>;
+/**
+ * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+ *
+ * Accepts either:
+ * - `{ import: 'default' }` form: values are the resource directly
+ * - default form: values are the full module — picks first export with `toPlugin()`
+ *
+ * Throws if any module doesn't yield a valid `ResourceLike`.
+ */
+export declare function preloadResources(globResult: EagerGlobResult): ResourceLike[];
+/**
+ * Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+ *
+ * Use this when resources depend on prior bootstrap (e.g., engine init) and
+ * cannot be evaluated at import time of the preload file.
+ */
+export declare function preloadResourcesAsync(globResult: LazyGlobResult): Promise<ResourceLike[]>;
 //#endregion
 //#region src/factory/presets.d.ts
 /**
  * Production preset - strict security, performance optimized
  */
-declare const productionPreset: Partial<CreateAppOptions>;
+export declare const productionPreset: Partial<CreateAppOptions>;
 /**
  * Development preset - relaxed security, verbose logging
  */
-declare const developmentPreset: Partial<CreateAppOptions>;
+export declare const developmentPreset: Partial<CreateAppOptions>;
 /**
  * Testing preset - minimal setup, fast startup
  */
-declare const testingPreset: Partial<CreateAppOptions>;
+export declare const testingPreset: Partial<CreateAppOptions>;
 /**
  * Edge/Serverless preset — minimal cold-start overhead
  *
@@ -149,7 +164,7 @@ declare const testingPreset: Partial<CreateAppOptions>;
  * modern edge runtimes with Node.js compat flags. No TCP server is needed
  * when using `toFetchHandler()` (routes through Fastify's `.inject()`).
  */
-declare const edgePreset: Partial<CreateAppOptions>;
-declare function getPreset(name: "production" | "development" | "testing" | "edge" | "worker"): Partial<CreateAppOptions>;
+export declare const edgePreset: Partial<CreateAppOptions>;
+export declare function getPreset(name: "production" | "development" | "testing" | "edge" | "worker"): Partial<CreateAppOptions>;
 //#endregion
-export { ArcFactory, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcWorker, type AuthOption, type BetterAuthOption, type CreateAppOptions, type CreateWorkerOptions, type CustomAuthenticatorOption, type CustomPluginAuthOption, DEFAULT_LOGGER_REDACT_PATHS, type EventHandlerDefinition, type FetchHandlerOptions, type JwtAuthOption, type LoadResourcesOptions, type ModuleContribution, type ModuleDisposer, type ModuleExtension, type ModuleSetupContext, type ModuleState, type MultipartOptions, type RawBodyOptions, type ResolvedModuleDescriptor, type ResolvedModuleLifecycle, type ResolvedResourceDescriptor, type ResourceLike, type ResourceModule, type UnderPressureOptions, type WorkerHealthOptions, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+export { type ArcCompositionConfig, type ArcModule, type ArcModuleInput, type ArcModuleRegistry, type ArcPortRegistry, type ArcPorts, type ArcWorker, type AsyncApiCatalogEntry, type AsyncApiInfo, type AuthOption, type BetterAuthOption, type BootDisposer, type ClosureNode, type CompositionProblem, type CreateAppOptions, type CreateWorkerOptions, type CrudSurface, type CustomAuthenticatorOption, type CustomPluginAuthOption, type DerivedPublishes, type DurabilityFacts, type EagerGlobResult, type EventHandlerDefinition, type FetchHandlerOptions, type HandlerDurabilityFact, type JwtAuthOption, type LazyBridge, type LazyGlobResult, type LoadResourcesOptions, type ModuleContribution, type ModuleDisposer, type ModuleExtension, type ModuleGraph, type ModuleGraphAnalysis, type ModuleGraphIssue, type ModuleGraphMode, type ModuleGraphNode, type ModuleGraphOptions, type ModuleKind, type ModuleName, type ModulePlan, type ModulePorts, type ModuleRequirements, type ModuleSetupContext, type ModuleState, type MultipartOptions, type PlanModulesOptions, type PortName, type RawBodyOptions, type RelayNudge, type RelayOption, type ResolvedModuleDescriptor, type ResolvedModuleLifecycle, type ResolvedResourceDescriptor, type ResourceLike, type ResourceModule, type SkippedBridge, type UnderPressureOptions, type WorkerHealthOptions, activateBridges, analyzeModuleGraph, assertComposable, buildModuleGraph, collectModuleWorkflows, compositionProblems, createRelayNudge, crudEventsOf, defineModule, dependentsOf, eventTopology, extendModule, getModuleExports, getModuleResources, getModuleState, getOptionalModuleExports, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, planModules, renderModuleGraph, resolveContribution, resolveModule, resolveModuleClosure, subscribeModuleEventHandlers, toAsyncApi, verifyEventDurability, verifyModuleGraph, withRelayNudge };

package/dist/factory/index.mjs

@@ -1,8 +1,64 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { r as mergeHealthChecks, t as healthPlugin } from "../health-ZRHeDHXH.mjs";
-import { S as resolveModule, _ as describeResolvedModule, a as createApp, b as collectModuleWorkflows, c as edgePreset, d as testingPreset, f as workerPreset, g as subscribeModuleEventHandlers, h as orderModules, i as DEFAULT_LOGGER_REDACT_PATHS, l as getPreset, m as hasModule, n as preloadResourcesAsync, p as getModuleState, r as ArcFactory, s as developmentPreset, t as preloadResources, u as productionPreset, v as collectModuleHealthChecks, x as resolveContribution, y as collectModuleScheduledJobs } from "../preloadResources-f3boenVZ.mjs";
-import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module-DpLJG2_N.mjs";
-import { t as loadResources } from "../loadResources-BPfWiI5s.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { r as mergeHealthChecks, t as healthPlugin } from "../health-CrqUp3sz.mjs";
+import { a as developmentPreset, c as productionPreset, d as getModuleResources, f as getModuleState, g as collectModuleWorkflows, l as testingPreset, m as subscribeModuleEventHandlers, n as DEFAULT_LOGGER_REDACT_PATHS, o as edgePreset, p as hasModule, r as createApp, s as getPreset, t as ArcFactory, u as workerPreset } from "../createApp-BGLYtErt.mjs";
+import { _ as dependentsOf, b as verifyEventDurability, d as resolveModule, g as crudEventsOf, h as buildModuleGraph, i as planModules, m as analyzeModuleGraph, o as resolveModuleClosure, p as activateBridges, r as compositionProblems, s as orderModules, t as assertComposable, u as resolveContribution, v as eventTopology, x as verifyModuleGraph, y as renderModuleGraph } from "../plan-CJGMKoui.mjs";
+import { a as lazyModuleExports, i as hasModuleExports, n as getModuleExports, o as lazyRequiredModuleExports, r as getOptionalModuleExports, t as defineModule } from "../module--L0iBIZz.mjs";
+import { t as loadResources } from "../loadResources-6jO52-RR.mjs";
+//#region src/factory/module/asyncapi.ts
+/**
+* The module graph as an AsyncAPI 3.0 document — one channel per event (addressed by the event
+* name, payload from the event registry), a `send` operation for its owner and a `receive` for
+* every consumer (wildcards resolved). The standard format tooling, docs and contract tests read.
+*/
+/** A JSON-Pointer-safe id for an event name. */
+const idOf = (event) => event.replace(/[^A-Za-z0-9_.-]/g, "_");
+function toAsyncApi(graph, catalog, info, analysis = analyzeModuleGraph(graph)) {
+	const byName = new Map(catalog.map((entry) => [entry.name, entry]));
+	const channels = {};
+	const messages = {};
+	const operations = {};
+	const kindOf = new Map(graph.modules.map((m) => [m.name, m.kind]));
+	const ensureChannel = (event) => {
+		const id = idOf(event);
+		if (channels[id]) return id;
+		const entry = byName.get(event);
+		messages[id] = {
+			name: event,
+			...entry?.description ? { summary: entry.description } : {},
+			payload: entry?.schema ?? {},
+			...entry ? { "x-version": entry.version } : { "x-uncatalogued": true }
+		};
+		channels[id] = {
+			address: event,
+			messages: { [id]: { $ref: `#/components/messages/${id}` } }
+		};
+		return id;
+	};
+	const operation = (module, action, event) => {
+		const id = ensureChannel(event);
+		operations[`${module}.${action}.${id}`] = {
+			action,
+			channel: { $ref: `#/channels/${id}` },
+			messages: [{ $ref: `#/channels/${id}/messages/${id}` }],
+			tags: [{ name: module }],
+			"x-arc-kind": kindOf.get(module)
+		};
+	};
+	for (const [event, owners] of analysis.owners) for (const owner of owners) operation(owner, "send", event);
+	for (const [consumer, byPattern] of analysis.reaches) for (const events of byPattern.values()) for (const event of events) operation(consumer, "receive", event);
+	return {
+		asyncapi: "3.0.0",
+		info: {
+			title: info.title,
+			version: info.version,
+			...info.description ? { description: info.description } : {}
+		},
+		channels,
+		operations,
+		components: { messages }
+	};
+}
+//#endregion
 //#region src/factory/module/extend.ts
 /** Concatenate two contributions, resolving factories only when arc asks. */
 function mergeContribution(own, extra) {
@@ -33,6 +89,19 @@ function mergeNames(own, extra) {
 	if (extra === void 0) return own;
 	return [.../* @__PURE__ */ new Set([...own, ...extra])];
 }
+function mergeRequires(own, extra) {
+	if (own === void 0) return extra;
+	if (extra === void 0) return own;
+	const ports = mergeNames(own.ports, extra.ports);
+	const required = new Set(ports ?? []);
+	const optional = mergeNames(own.optionalPorts, extra.optionalPorts)?.filter((p) => !required.has(p));
+	const modules = mergeNames(own.modules, extra.modules);
+	return {
+		...ports ? { ports } : {},
+		...optional && optional.length > 0 ? { optionalPorts: optional } : {},
+		...modules ? { modules } : {}
+	};
+}
 function mergeOwns(own, extra) {
 	if (own === "provided" || extra === "provided") return "provided";
 	return mergeNames(own, extra);
@@ -110,7 +179,12 @@ function extendModule(mod, extension) {
 	const set = (key, value) => {
 		if (value !== void 0) out[key] = value;
 	};
+	if (extension.kind !== void 0) {
+		if (mod.kind !== void 0 && mod.kind !== extension.kind) throw new Error(`[arc] extendModule("${mod.name}"): the module declares kind "${mod.kind}"; refusing to relabel it "${extension.kind}". A kind changes activation and ordering — change it in the module.`);
+		out.kind = extension.kind;
+	}
 	set("dependsOn", mergeNames(mod.dependsOn, extension.dependsOn));
+	set("requires", mergeRequires(mod.requires, extension.requires));
 	set("owns", mergeOwns(mod.owns, extension.owns));
 	set("resources", mergeContribution(mod.resources, extension.resources));
 	set("eventHandlers", mergeContribution(mod.eventHandlers, extension.eventHandlers));
@@ -121,10 +195,64 @@ function extendModule(mod, extension) {
 	set("plugins", mergeHook(mod.plugins, extension.plugins));
 	set("afterResources", mergeHook(mod.afterResources, extension.afterResources));
 	set("onClose", mergeOnClose(mod.onClose, extension.onClose));
+	set("publishes", mergeArray(mod.publishes, extension.publishes));
+	if (extension.eventNamespace !== void 0) set("eventNamespace", mergeNames(mod.eventNamespace === void 0 ? [mod.name] : [mod.eventNamespace].flat(), [extension.eventNamespace].flat()));
 	if (extension.bootstrap) out.bootstrap = extension.bootstrap(mod.bootstrap);
 	return out;
 }
 //#endregion
+//#region src/factory/module/relay-nudge.ts
+function isRelayFromModule(relay) {
+	return typeof relay === "object" && relay !== null && "fromModule" in relay;
+}
+/**
+* Merge an `afterCommit` nudge into a runtime whose `dispatch` is `'relay'`.
+*
+* - `'inline'` / no dispatch: returned untouched.
+* - `'relay'` + a resolvable `relay`: `afterCommit` nudges; a host's own hook runs first.
+* - `'relay'` + no `relay`: THROWS — a worker-drained deployment and a forgotten wire
+*   look identical, so the host has to say which.
+*/
+function withRelayNudge(label, runtime, relay) {
+	if (!runtime || typeof runtime !== "object") return runtime;
+	const rt = runtime;
+	if (rt.dispatch !== "relay") return runtime;
+	if (relay === void 0) throw new Error(`[${label}] runtime.dispatch is 'relay' but no \`relay\` was given. Pass the outbox module's exports (\`{ requestDrain }\`, a thunk, or \`{ fromModule: 'outbox' }\`) so a committed write is delivered now — or \`relay: 'external'\` when a separate relay process drains the outbox.`);
+	const resolved = relay;
+	if (resolved === "external") return runtime;
+	if (typeof resolved !== "function" && !("requestDrain" in resolved)) throw new Error(`[${label}] withRelayNudge received the unresolved \`{ fromModule }\` form — createRelayNudge resolves it after resources; a direct caller passes \`{ requestDrain }\` or a thunk.`);
+	const hostAfterCommit = typeof rt.afterCommit === "function" ? rt.afterCommit : void 0;
+	const drain = typeof resolved === "function" ? () => resolved().requestDrain() : () => resolved.requestDrain();
+	return {
+		...rt,
+		afterCommit: (info) => {
+			try {
+				hostAfterCommit?.(info);
+			} finally {
+				drain();
+			}
+		}
+	};
+}
+/** The one way a module wires `relay` — `{ fromModule }` included. */
+function createRelayNudge(label, relay) {
+	if (!isRelayFromModule(relay)) return { apply: (runtime) => withRelayNudge(label, runtime, relay) };
+	const moduleName = relay.fromModule;
+	let moduleDrain;
+	const thunk = () => {
+		if (!moduleDrain) throw new Error(`[${label}] the relay drain from module "${moduleName}" is not resolved yet — a write committed before afterResources ran. Mount the outbox module alongside this one, or pass \`relay\` directly.`);
+		return { requestDrain: moduleDrain };
+	};
+	return {
+		apply: (runtime) => withRelayNudge(label, runtime, thunk),
+		afterResources: async (fastify) => {
+			const exports = getModuleExports(fastify, moduleName);
+			if (typeof exports?.requestDrain !== "function") throw new Error(`[${label}] module "${moduleName}" exports no requestDrain(), so a committed write cannot nudge the relay. Arc >=2.40 adds it to createOutboxModule; pass \`relay: 'external'\` if a separate process drains the outbox.`);
+			moduleDrain = exports.requestDrain;
+		}
+	};
+}
+//#endregion
 //#region src/factory/createWorker.ts
 async function createWorker(options, workerOptions = {}) {
 	const { auth: _auth, helmet: _helmet, cors: _cors, rateLimit: _rateLimit, multipart: _multipart, rawBody: _rawBody, sensible: _sensible, underPressure: _underPressure, replyHelpers: _replyHelpers, ...runtimeOptions } = options;
@@ -139,32 +267,41 @@ async function createWorker(options, workerOptions = {}) {
 		preset: "worker",
 		arcPlugins: workerArcPlugins
 	});
-	if (workerOptions.health) {
-		const { port, host = "0.0.0.0", checks = [] } = workerOptions.health;
-		const moduleChecks = app.arc?.healthChecks ?? [];
-		const mergedChecks = mergeHealthChecks([
-			{
-				owner: "the module graph",
-				checks: moduleChecks
-			},
-			{
-				owner: "shared arcPlugins.health",
-				checks: sharedHealth.checks
-			},
-			{
-				owner: "the worker probe",
-				checks
-			}
-		]);
-		await app.register(healthPlugin, {
-			...sharedHealth,
-			checks: mergedChecks
-		});
-		await app.listen({
-			port,
-			host
-		});
-	} else await app.ready();
+	try {
+		if (workerOptions.health) {
+			const { port, host = "0.0.0.0", checks = [] } = workerOptions.health;
+			const moduleChecks = app.arc?.healthChecks ?? [];
+			const mergedChecks = mergeHealthChecks([
+				{
+					owner: "the module graph",
+					checks: moduleChecks
+				},
+				{
+					owner: "shared arcPlugins.health",
+					checks: sharedHealth.checks
+				},
+				{
+					owner: "the worker probe",
+					checks
+				}
+			]);
+			await app.register(healthPlugin, {
+				...sharedHealth,
+				checks: mergedChecks
+			});
+			await app.listen({
+				port,
+				host
+			});
+		} else await app.ready();
+	} catch (err) {
+		try {
+			await app.close();
+		} catch (closeErr) {
+			app.log.error({ err: closeErr }, "[arc] failed worker startup cleanup failed");
+		}
+		throw err;
+	}
 	let closed = false;
 	return {
 		app,
@@ -243,4 +380,48 @@ function payloadTooLarge(limit) {
 	});
 }
 //#endregion
-export { ArcFactory, DEFAULT_LOGGER_REDACT_PATHS, collectModuleHealthChecks, collectModuleScheduledJobs, collectModuleWorkflows, createApp, createWorker, defineModule, describeResolvedModule, developmentPreset, edgePreset, extendModule, getModuleExports, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, preloadResources, preloadResourcesAsync, productionPreset, resolveContribution, resolveModule, subscribeModuleEventHandlers, testingPreset, toFetchHandler };
+//#region src/factory/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { ArcFactory, DEFAULT_LOGGER_REDACT_PATHS, activateBridges, analyzeModuleGraph, assertComposable, buildModuleGraph, collectModuleWorkflows, compositionProblems, createApp, createRelayNudge, createWorker, crudEventsOf, defineModule, dependentsOf, developmentPreset, edgePreset, eventTopology, extendModule, getModuleExports, getModuleResources, getModuleState, getOptionalModuleExports, getPreset, hasModule, hasModuleExports, lazyModuleExports, lazyRequiredModuleExports, loadResources, orderModules, planModules, preloadResources, preloadResourcesAsync, productionPreset, renderModuleGraph, resolveContribution, resolveModule, resolveModuleClosure, subscribeModuleEventHandlers, testingPreset, toAsyncApi, toFetchHandler, verifyEventDurability, verifyModuleGraph, withRelayNudge };

package/dist/{fastify-augmentation-Cq2nHVaW.d.mts → fastify-augmentation-DRlCIWE9.d.mts}

@@ -1,8 +1,8 @@
 
-import { on as HookSystem, z as ResourceRegistry } from "./index-DHbyPo5j.mjs";
+import { M as ResourceRegistry, dn as HookSystem } from "./index-WH7xgvxS.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
-import { _ as HealthCheck, f as ScheduleDefinition, r as ArcModuleRegistry, t as ArcModule } from "./types-DfVDvkdP.mjs";
-import { s as ModuleState } from "./index-CFfLKMH4.mjs";
+import { b as ScheduleDefinition, i as ArcModuleRegistry, n as ArcModule, w as HealthCheck } from "./types-BJ-2XqVF.mjs";
+import { L as ModuleGraph, s as ModuleState } from "./index-CUJvoyw3.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/factory/module/descriptor.d.ts
 /**
@@ -65,26 +65,6 @@ interface ResolvedModuleDescriptor {
   readonly owns: readonly string[];
   readonly lifecycle: ResolvedModuleLifecycle;
 }
-/** Minimal resource shape the descriptor reads. Structural — matches `ResourceLike`. */
-interface DescribableResource {
-  readonly name?: string | undefined;
-  readonly prefix?: string | undefined;
-  readonly skipGlobalPrefix?: boolean | undefined;
-}
-/**
- * Build a descriptor. Called by `registerResources` once per module, after
- * resources are resolved and `owns` is effective.
- *
- * Frozen at every level: a descriptor is a snapshot of a completed decision,
- * and a consumer mutating it would silently disagree with the running app.
- */
-declare function describeResolvedModule(input: {
-  readonly name: string;
-  readonly dependsOn?: readonly string[] | undefined;
-  readonly resources: readonly DescribableResource[];
-  readonly owns: readonly string[];
-  readonly lifecycle: ResolvedModuleLifecycle;
-}): ResolvedModuleDescriptor;
 //#endregion
 //#region src/core/arcCorePlugin.d.ts
 interface ArcCorePluginOptions {
@@ -159,6 +139,13 @@ interface ArcCore {
    * or hand to tooling.
    */
   moduleDescriptors?: readonly ResolvedModuleDescriptor[];
+  /** Active modules, the events each owns and consumes, and the bridges left inactive. */
+  moduleGraph?: ModuleGraph;
+  /**
+   * Event types actually published with no declared owner (and no external source) — observed
+   * at the transport while `moduleGraph.events` is on. A test asserts it empty after a flow.
+   */
+  undeclaredEvents?: ReadonlySet<string>;
   /**
    * Module-contributed recurring schedules, resolved once in dependency order
    * and frozen after bootstraps. The same definitions are executed by Arc's
@@ -166,7 +153,6 @@ interface ArcCore {
    */
   scheduledJobs?: readonly Readonly<ScheduleDefinition>[];
 }
-declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
 declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
 //#endregion
 //#region src/types/fastify-augmentation.d.ts
@@ -176,4 +162,4 @@ declare module "fastify" {
   }
 }
 //#endregion
-export { arcCorePlugin as a, ResolvedResourceDescriptor as c, _default as i, describeResolvedModule as l, ArcCorePluginOptions as n, ResolvedModuleDescriptor as o, PluginMeta as r, ResolvedModuleLifecycle as s, ArcCore as t };
+export { ResolvedModuleDescriptor as a, _default as i, ArcCorePluginOptions as n, ResolvedModuleLifecycle as o, PluginMeta as r, ResolvedResourceDescriptor as s, ArcCore as t };

package/dist/{fields-BHrkoF5y.mjs → fields-A5crhsJb.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/permissions/fields.ts
 /**
 * Field-Level Permissions

package/dist/{fields-I_EeRWND.d.mts → fields-BBSpf8pS.d.mts}

@@ -119,4 +119,4 @@ declare function applyFieldWritePermissions<T extends Record<string, unknown>>(b
  */
 declare function resolveEffectiveRoles(userRoles: readonly string[], orgRoles: readonly string[]): string[];
 //#endregion
-export { applyFieldWritePermissions as a, applyFieldReadPermissions as i, FieldPermissionMap as n, fields as o, FieldPermissionType as r, resolveEffectiveRoles as s, FieldPermission as t };
+export { applyFieldReadPermissions as a, resolveEffectiveRoles as c, FieldWritePermissionResult as i, FieldPermissionMap as n, applyFieldWritePermissions as o, FieldPermissionType as r, fields as s, FieldPermission as t };

package/dist/filter-merge-DGM-GQ1J.mjs

@@ -0,0 +1,99 @@
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+//#region src/permissions/filter-merge.ts
+/**
+* Policy-filter composition — logical AND, never last-writer-wins.
+*
+* Row-level policy filters can arrive from several INDEPENDENT sources for one
+* request: a tenant preset, an `ownedByUser` grant, an `allOf(...)` branch, a
+* host permission check. Every one of them is a RESTRICTION the row must
+* satisfy, so composing them is logical AND.
+*
+* The historical `{ ...base, ...incoming }` shallow spread did NOT implement AND:
+* when two sources constrained the SAME key with different values, the later one
+* silently REPLACED the earlier one — widening (or erasing) a restriction another
+* layer deliberately imposed. That is a defense-in-depth defect, not a
+* refinement. "Later can refine" is only sound when the refinement is provably
+* narrower, and a bare overwrite proves nothing.
+*
+* {@link conjoinPolicyFilters} composes with AND semantics while preserving the
+* common case byte-for-byte:
+*
+*  - key present on only one side      → carried through flat. Non-overlapping
+*    filters (the ~99% case) produce exactly the same object the old spread did,
+*    so there is ZERO behavior change for them.
+*  - same key, deep-equal value        → kept once (idempotent — e.g. two checks
+*    both pinning the same `organizationId`).
+*  - same key, DIFFERENT value         → BOTH constraints are preserved under an
+*    `$and`, so a row must satisfy both. For flat equality that conjunction is
+*    unsatisfiable, so the query returns nothing — the safe, correct outcome for
+*    contradictory policies (deny), and the earlier restriction is never dropped.
+*
+* Adapter safety: mongokit / sqlitekit compile `$and` natively at the DB layer,
+* and arc's in-memory `simpleEqualityMatcher` (AccessControl.checkPolicyFilters)
+* already fail-closes on operator-shaped filters. So a produced `$and` is either
+* evaluated correctly by the DB or rejected fail-closed in memory — both safe.
+*
+* This is the pragmatic, adapter-neutral form of the AND semantics. A canonical
+* filter IR in `repo-core` (nested and/or/not nodes each adapter compiles) is the
+* fuller design, but this closes the security defect without one.
+*/
+/**
+* Validate + return a `$and` operand's fragment array. A security-policy
+* normalizer must NEVER silently drop a malformed constraint — a non-array
+* `$and` (e.g. `{ $and: { organizationId: "a" } }`) is a policy bug, so fail
+* loud (fail-closed) rather than discard the restriction it was meant to carry.
+*/
+function coercePolicyAnd(value) {
+	if (!Array.isArray(value)) throw new Error(`conjoinPolicyFilters: malformed '$and' — expected an array of filter fragments, got ${value === null ? "null" : typeof value}. A policy filter constraint must not be silently dropped.`);
+	return value;
+}
+/** Are two flat policy-filter values equivalent for conjunction purposes? */
+function filterValueEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (a !== null && b !== null && typeof a === "object" && typeof b === "object") try {
+		return JSON.stringify(a) === JSON.stringify(b);
+	} catch {
+		return false;
+	}
+	return false;
+}
+/**
+* Conjoin two policy-filter maps with AND semantics. Never silently overwrites a
+* same-key constraint with a different value — conflicting keys are preserved
+* under `$and`. See the module doc for the full contract.
+*/
+function conjoinPolicyFilters(base, incoming) {
+	const baseEmpty = !base || Object.keys(base).length === 0;
+	const incomingEmpty = !incoming || Object.keys(incoming).length === 0;
+	if (baseEmpty) return incomingEmpty ? {} : { ...incoming };
+	if (incomingEmpty) return { ...base };
+	const result = {};
+	const andParts = [];
+	const baseAnd = base.$and;
+	if (baseAnd !== void 0) andParts.push(...coercePolicyAnd(baseAnd));
+	for (const [key, value] of Object.entries(base)) {
+		if (key === "$and") continue;
+		result[key] = value;
+	}
+	for (const [key, value] of Object.entries(incoming)) {
+		if (key === "$and") {
+			andParts.push(...coercePolicyAnd(value));
+			continue;
+		}
+		if (!(key in result)) {
+			result[key] = value;
+			continue;
+		}
+		if (filterValueEqual(result[key], value)) continue;
+		andParts.push({ [key]: result[key] }, { [key]: value });
+		delete result[key];
+	}
+	if (andParts.length > 0) result.$and = andParts;
+	for (const source of [base, incoming]) for (const symbol of Object.getOwnPropertySymbols(source)) {
+		const descriptor = Object.getOwnPropertyDescriptor(source, symbol);
+		if (descriptor) Object.defineProperty(result, symbol, descriptor);
+	}
+	return result;
+}
+//#endregion
+export { conjoinPolicyFilters as t };

package/dist/{generate-BLRf2m3y.mjs → generate-BXKo2Gc8.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as pluralize } from "./pluralize-CXWZIzTv.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { t as pluralize } from "./pluralize-COUNYo3d.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/generate/name-helpers.ts

package/dist/{headers-BIXWKrzQ.mjs → headers-DKZQKL-Z.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { u as ValidationError } from "./errors-BH7YU_9O.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { u as ValidationError } from "./errors-CW4anJBy.mjs";
 //#region src/utils/headers.ts
 /**
 * Canonical header typing + accessor.

package/dist/health-BYAwA6YS.mjs

@@ -0,0 +1,22 @@
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+//#region src/events/outbox/health.ts
+/** Pending age past which the relay counts as stalled. */
+const DEFAULT_RELAY_LAG_UNHEALTHY_MS = 3e5;
+function canReportHealth(store) {
+	return typeof store.countByStatus === "function" && typeof store.oldestPendingAgeMs === "function";
+}
+async function readOutboxHealth(store, relayLagUnhealthyMs = DEFAULT_RELAY_LAG_UNHEALTHY_MS) {
+	const [pending, deadLetter, relayLagMs] = await Promise.all([
+		store.countByStatus("pending"),
+		store.countByStatus("dead_letter"),
+		store.oldestPendingAgeMs()
+	]);
+	return {
+		pending,
+		deadLetter,
+		relayLagMs,
+		healthy: deadLetter === 0 && (relayLagMs === null || relayLagMs < relayLagUnhealthyMs)
+	};
+}
+//#endregion
+export { canReportHealth as n, readOutboxHealth as r, DEFAULT_RELAY_LAG_UNHEALTHY_MS as t };