@classytic/arc 2.11.3 → 2.13.1

package/dist/{multipartBody-CvTR1Un6.mjs → multipartBody-BOvVSVCD.mjs}

@@ -65,13 +65,15 @@ function multipartBody(options = {}) {
 			for await (const part of parts) if (part.type === "file") {
 				if (fileCount >= maxFiles) continue;
 				if (mimeMatcher && !mimeMatcher.matches(part.mimetype)) return reply.code(415).send({
-					success: false,
-					error: `File type '${part.mimetype}' not allowed. Accepted: ${mimeMatcher.describe()}`
+					code: "arc.unsupported_media_type",
+					message: `File type '${part.mimetype}' not allowed. Accepted: ${mimeMatcher.describe()}`,
+					status: 415
 				});
 				const buffer = await part.toBuffer();
 				if (buffer.length > maxFileSize) return reply.code(413).send({
-					success: false,
-					error: `File '${part.filename}' exceeds maximum size of ${Math.round(maxFileSize / 1024 / 1024)}MB`
+					code: "arc.payload_too_large",
+					message: `File '${part.filename}' exceeds maximum size of ${Math.round(maxFileSize / 1024 / 1024)}MB`,
+					status: 413
 				});
 				files[part.fieldname] = {
 					filename: part.filename,
@@ -85,16 +87,17 @@ function multipartBody(options = {}) {
 		} catch (err) {
 			request.log.error({ err }, "multipartBody: failed to parse multipart form");
 			return reply.code(400).send({
-				success: false,
-				error: "Failed to parse multipart form data"
+				code: "arc.bad_request",
+				message: "Failed to parse multipart form data",
+				status: 400
 			});
 		}
 		if (requiredFields) {
 			const missing = requiredFields.filter((name) => !(name in files));
 			if (missing.length > 0) return reply.code(400).send({
-				success: false,
-				error: `Missing required file field${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`,
 				code: "MISSING_FILE_FIELDS",
+				message: `Missing required file field${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`,
+				status: 400,
 				details: { missing }
 			});
 		}

package/dist/{openapi-BGUn7Ki1.mjs → openapi-CiOMVW1p.mjs}

@@ -1,7 +1,7 @@
-import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-B0oKLuqI.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-sUUKDhtP.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-u3ql2EDo.mjs";
+import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-De34B1ZG.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-CyUkQu6O.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-CEvzKcy8.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi.ts
 const openApiPlugin = async (fastify, opts = {}) => {
@@ -160,7 +160,6 @@ const DEFAULT_LIST_PARAMS = [
 function generateResourcePaths(resource, apiPrefix = "", additionalSecurity = []) {
 	const paths = {};
 	const basePath = `${apiPrefix}${resource.prefix}`;
-	if (resource.disableDefaultRoutes && (!resource.customRoutes || resource.customRoutes.length === 0) && (!resource.actions || resource.actions.length === 0)) return paths;
 	if (!resource.disableDefaultRoutes) {
 		const disabledSet = new Set(resource.disabledRoutes ?? []);
 		const updateMethod = resource.updateMethod ?? "PATCH";
@@ -173,7 +172,7 @@ function generateResourcePaths(resource, apiPrefix = "", additionalSecurity = []
 					type: "object",
 					properties: {
 						success: { type: "boolean" },
-						docs: {
+						data: {
 							type: "array",
 							items: { $ref: `#/components/schemas/${resource.name}` }
 						},
@@ -358,9 +357,136 @@ function generateResourcePaths(resource, apiPrefix = "", additionalSecurity = []
 			}
 		}, anyAuthRequired, additionalSecurity);
 	}
+	if (resource.aggregations && resource.aggregations.length > 0) appendAggregationPaths(paths, resource, basePath, additionalSecurity);
 	return paths;
 }
 /**
+* Emit one OpenAPI path entry per declared aggregation.
+*
+* Path:     `GET /:resource/aggregations/<name>`
+* Response: `{ rows: AggregationRow[] }` where each row is keyed by
+*           the groupBy fields (nested object for joined-alias paths)
+*           plus the measure aliases.
+*
+* Auth requirement is read from the aggregation's own `permissions`
+* function — same fallback chain runtime + MCP use.
+*/
+function appendAggregationPaths(paths, resource, basePath, additionalSecurity) {
+	if (!resource.aggregations) return;
+	for (const agg of resource.aggregations) {
+		const path = toOpenApiPath(`${basePath}/aggregations/${agg.name}`);
+		const requiresAuth = !agg.permissions?._isPublic;
+		const rowSchema = buildAggregationRowSchema(normalizeGroupByForOpenApi(agg.groupBy), agg.measures, agg.lookupAliases);
+		const querystring = {
+			type: "object",
+			properties: {},
+			additionalProperties: true
+		};
+		if (agg.requireDateRange) {
+			const props = querystring.properties;
+			const f = agg.requireDateRange.field;
+			props[`${f}[gte]`] = {
+				type: "string",
+				description: `Lower bound (inclusive) of required date range on \`${f}\`.`
+			};
+			props[`${f}[lte]`] = {
+				type: "string",
+				description: `Upper bound (inclusive) of required date range on \`${f}\`.`
+			};
+		}
+		if (agg.requireFilters?.length) {
+			const props = querystring.properties;
+			for (const f of agg.requireFilters) props[f] = {
+				type: "string",
+				description: `Required filter on \`${f}\` — request rejected (400) if missing.`
+			};
+		}
+		const descLines = [];
+		if (agg.description) descLines.push(agg.description);
+		descLines.push("Portable aggregation. Caller filters via query string narrow the base + tenant scope; response shape is `{ rows: [...] }` matching repo-core's `AggResult` contract.");
+		if (Object.keys(agg.measures).length > 0) {
+			const measureLines = Object.entries(agg.measures).map(([alias, op]) => `- \`${alias}\` — \`${op}\``).join("\n");
+			descLines.push("", "**Measures:**", measureLines);
+		}
+		if (agg.requireDateRange) descLines.push("", `**Required date range** on \`${agg.requireDateRange.field}\` — supply \`?${agg.requireDateRange.field}[gte]=...&${agg.requireDateRange.field}[lte]=...\`.` + (agg.requireDateRange.maxRangeDays ? ` Range cap: ${agg.requireDateRange.maxRangeDays} days.` : ""));
+		if (!paths[path]) paths[path] = {};
+		paths[path].get = createOperation(resource, `aggregation.${agg.name}`, agg.summary ?? `Aggregation: ${agg.name}`, {
+			description: descLines.join("\n"),
+			parameters: [{
+				name: "querystring",
+				in: "query",
+				required: false,
+				schema: querystring,
+				description: "Filter narrowing — composes with base filter + tenant scope."
+			}],
+			responses: {
+				"200": {
+					description: "Aggregation result",
+					content: { "application/json": { schema: {
+						type: "object",
+						required: ["rows"],
+						properties: { rows: {
+							type: "array",
+							items: rowSchema
+						} }
+					} } }
+				},
+				"400": { description: "Missing required filter or invalid date range" },
+				"401": { description: "Authentication required" },
+				"403": { description: "Permission denied" },
+				"422": { description: "Result row count exceeded `maxGroups` cap" },
+				"501": { description: "Adapter does not implement `aggregate()`" },
+				"504": { description: "Aggregation execution timed out" }
+			}
+		}, requiresAuth, additionalSecurity);
+	}
+}
+/**
+* Build the JSON Schema for a single aggregation row. Combines the
+* groupBy field shape (nested for joined-alias paths) with the
+* measure-alias scalars.
+*
+* Group keys with dotted paths (e.g. `'category.code'`) emit a nested
+* `category: { code: string }` object, matching the cross-kit
+* `nestDottedKeys` output. Plain group keys are flat.
+*
+* Measure scalars are always `number` — every measure op
+* (`count` / `sum` / `avg` / `min` / `max` / `countDistinct`)
+* produces a numeric result.
+*/
+function buildAggregationRowSchema(groupByFields, measures, _lookupAliases) {
+	const properties = {};
+	for (const field of groupByFields) setNestedSchemaProp(properties, field.split("."), { type: "string" });
+	for (const alias of Object.keys(measures)) properties[alias] = { type: "number" };
+	return {
+		type: "object",
+		properties,
+		additionalProperties: false
+	};
+}
+function normalizeGroupByForOpenApi(groupBy) {
+	if (!groupBy) return [];
+	return typeof groupBy === "string" ? [groupBy] : groupBy;
+}
+function setNestedSchemaProp(target, path, leaf) {
+	if (path.length === 1) {
+		target[path[0]] = leaf;
+		return;
+	}
+	const head = path[0];
+	const rest = path.slice(1);
+	let nested = target[head];
+	if (!nested || typeof nested !== "object") {
+		nested = {
+			type: "object",
+			properties: {}
+		};
+		target[head] = nested;
+	}
+	if (!nested.properties) nested.properties = {};
+	setNestedSchemaProp(nested.properties, rest, leaf);
+}
+/**
 * Create an operation object
 * @param requiresAuthOverride - Override for whether auth is required (for additional routes)
 * @param additionalSecurity - Extra security alternatives from external integrations (OR'd with bearerAuth)
@@ -511,13 +637,17 @@ function generateSchemas(resources) {
 				}
 			}
 		};
-		if (fieldPerms && schemas[resource.name]?.properties) {
-			const props = schemas[resource.name].properties;
-			for (const [field, perm] of Object.entries(fieldPerms)) if (props[field]) {
-				const desc = props[field]?.description ?? "";
-				const permDesc = formatFieldPermDescription(perm);
-				props[field].description = desc ? `${desc} (${permDesc})` : permDesc;
-			} else if (perm.type === "hidden") {}
+		const resourceSchema = schemas[resource.name];
+		if (fieldPerms && resourceSchema?.properties) {
+			const props = resourceSchema.properties;
+			for (const [field, perm] of Object.entries(fieldPerms)) {
+				const propSchema = props[field];
+				if (propSchema) {
+					const desc = propSchema.description ?? "";
+					const permDesc = formatFieldPermDescription(perm);
+					propSchema.description = desc ? `${desc} (${permDesc})` : permDesc;
+				} else if (perm.type === "hidden") {}
+			}
 		}
 		if (storedSchemas?.createBody) {
 			schemas[`${resource.name}Input`] = {

package/dist/org/index.d.mts

@@ -1,5 +1,5 @@
-import { yt as RouteHandler } from "../index-6u4_Gg6G.mjs";
-import { d as UserBase } from "../fields-C8Y0XLAu.mjs";
+import { yt as RouteHandler } from "../index-BtW7qYwa.mjs";
+import { d as UserBase } from "../fields-COhcH3fk.mjs";
 import { InvitationAdapter, InvitationDoc, MemberDoc, OrgAdapter, OrgDoc, OrgPermissionStatement, OrgRole, OrganizationPluginOptions } from "./types.mjs";
 import { FastifyPluginAsync, RouteHandlerMethod } from "fastify";
 

package/dist/org/index.mjs

@@ -1,4 +1,4 @@
-import { _ as isElevated, h as hasOrgAccess, n as PUBLIC_SCOPE, s as getOrgRoles, v as isMember } from "../types-AOD8fxIw.mjs";
+import { _ as hasOrgAccess, b as isMember, l as getOrgRoles, n as PUBLIC_SCOPE, y as isElevated } from "../types-C_s5moIu.mjs";
 import fp from "fastify-plugin";
 //#region src/org/organizationPlugin.ts
 const DEFAULT_ROLES = [

package/dist/permissions/index.d.mts

@@ -1,3 +1,3 @@
-import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-C8Y0XLAu.mjs";
-import { A as requireRoles, C as allOf, D as not, E as denyAll, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig } from "../index-BYCqHCVu.mjs";
-export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+import { a as applyFieldWritePermissions, c as PermissionCheck, d as UserBase, f as getUserRoles, i as applyFieldReadPermissions, l as PermissionContext, n as FieldPermissionMap, o as fields, p as normalizeRoles, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission, u as PermissionResult } from "../fields-COhcH3fk.mjs";
+import { A as requireRoles, C as allOf, D as not, E as denyAll, F as RequireAgentScopeOptions, I as RequireMandateOptions, L as requireAgentScope, M as when, N as applyPermissionResult, O as requireAuth, P as normalizePermissionResult, R as requireDPoP, S as createOrgPermissions, T as anyOf, _ as ConnectEventsOptions, a as presets_d_exports, b as PermissionEventBus, c as readOnly, d as requireOrgRole, f as requireScopeContext, g as createRoleHierarchy, h as RoleHierarchy, i as ownerWithAdminBypass, j as roles, k as requireOwnership, l as requireOrgInScope, m as requireTeamMembership, n as authenticated, o as publicRead, p as requireServiceScope, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as requireOrgMembership, v as DynamicPermissionMatrix, w as allowPublic, x as createDynamicPermissionMatrix, y as DynamicPermissionMatrixConfig, z as requireMandate } from "../index-BTqLEvhu.mjs";
+export { ConnectEventsOptions, DynamicPermissionMatrix, DynamicPermissionMatrixConfig, FieldPermission, FieldPermissionMap, FieldPermissionType, PermissionCheck, PermissionContext, PermissionEventBus, PermissionResult, RequireAgentScopeOptions, RequireMandateOptions, RoleHierarchy, UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };

package/dist/permissions/index.mjs

@@ -1,3 +1,3 @@
-import { A as normalizePermissionResult, C as requireAuth, D as when, E as roles, M as applyFieldWritePermissions, N as fields, O as applyPermissionResult, P as resolveEffectiveRoles, S as not, T as requireRoles, _ as requireTeamMembership, a as presets_exports, b as anyOf, c as readOnly, d as createOrgPermissions, f as requireOrgInScope, g as requireServiceScope, h as requireScopeContext, i as ownerWithAdminBypass, j as applyFieldReadPermissions, l as createRoleHierarchy, m as requireOrgRole, n as authenticated, o as publicRead, p as requireOrgMembership, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as createDynamicPermissionMatrix, v as allOf, w as requireOwnership, x as denyAll, y as allowPublic } from "../permissions-gd_aUWrR.mjs";
-import { n as normalizeRoles, t as getUserRoles } from "../types-DV9WDfeg.mjs";
-export { adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+import { A as roles, C as allowPublic, D as requireAuth, E as not, F as applyPermissionResult, L as normalizePermissionResult, M as requireAgentScope, N as requireDPoP, O as requireOwnership, P as requireMandate, S as allOf, T as denyAll, _ as requireOrgMembership, a as presets_exports, b as requireServiceScope, c as readOnly, d as applyFieldWritePermissions, f as fields, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as when, k as requireRoles, l as createRoleHierarchy, m as createDynamicPermissionMatrix, n as authenticated, o as publicRead, p as resolveEffectiveRoles, r as fullPublic, s as publicReadAdminWrite, t as adminOnly, u as applyFieldReadPermissions, v as requireOrgRole, w as anyOf, x as requireTeamMembership, y as requireScopeContext } from "../permissions-ohQyv50e.mjs";
+import { n as normalizeRoles, t as getUserRoles } from "../types-D57iXYb8.mjs";
+export { adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };