@classytic/arc 2.15.4 → 2.16.0

package/dist/createActionRouter-S3MLVYot.mjs

@@ -1,220 +0,0 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import "./constants-Cxde4rpC.mjs";
-import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { a as buildAuthMiddlewareForPermissions, c as buildPreHandlerChain, f as resolveRouterPluginMw, l as buildRateLimitConfig, n as buildActionPipelineHandler, p as selectPluginMw, r as buildArcDecorator, t as buildActionPermissionMw, u as resolvePipelineSteps, y as sendControllerResponse } from "./routerShared-DrOa-26E.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-lYhC2gE5.mjs";
-//#region src/core/createActionRouter.ts
-var createActionRouter_exports = /* @__PURE__ */ __exportAll({
-	buildActionBodySchema: () => buildActionBodySchema,
-	createActionRouter: () => createActionRouter
-});
-/**
-* Register the unified action endpoint: `POST /:id/action`.
-*
-* Shares every lifecycle primitive with the CRUD router — the preHandler
-* chain, the arc decorator, idempotency, rate-limit, and the response
-* shaper. The only thing that stays local is the dynamic permission check
-* (keyed by `body.action` at request time).
-*/
-function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit } = config;
-	const actionEnum = Object.keys(actions);
-	if (actionEnum.length === 0) {
-		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
-		return;
-	}
-	const bodySchema = buildActionBodySchema(actionEnum, actionSchemas);
-	const routeSchema = {
-		tags: tag ? [tag] : void 0,
-		summary: `Perform action (${actionEnum.join("/")})`,
-		description: buildActionDescription(actions, actionPermissions),
-		params: {
-			type: "object",
-			properties: { id: {
-				type: "string",
-				description: "Resource ID"
-			} },
-			required: ["id"]
-		},
-		body: bodySchema
-	};
-	const arcDecorator = buildArcDecorator({
-		resourceName,
-		schemaOptions,
-		permissions: resourcePermissions,
-		hooks: fastify.arc?.hooks,
-		events: fastify.events,
-		fields: fieldPermissions,
-		idField
-	});
-	const authMw = buildAuthMiddlewareForPermissions(fastify, actionEnum.map((name) => actionPermissions[name] ?? globalAuth));
-	const pluginMw = resolveRouterPluginMw(fastify, false);
-	const wrappedHandlers = /* @__PURE__ */ new Map();
-	for (const [name, handler] of Object.entries(actions)) {
-		const steps = resolvePipelineSteps(pipeline, name);
-		wrappedHandlers.set(name, buildActionPipelineHandler(handler, steps, name, resourceName));
-	}
-	const preHandler = buildPreHandlerChain({
-		arcDecorator,
-		authMw,
-		permissionMw: buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName),
-		pluginMw: selectPluginMw("POST", pluginMw),
-		routeGuards
-	});
-	const rateLimitConfig = buildRateLimitConfig(rateLimit);
-	fastify.route({
-		method: "POST",
-		url: "/:id/action",
-		schema: routeSchema,
-		preHandler: preHandler.length > 0 ? preHandler : void 0,
-		...rateLimitConfig ? { config: rateLimitConfig } : {},
-		handler: async (req, reply) => {
-			const { action, ...data } = req.body;
-			const { id } = req.params;
-			const reqWithExtras = req;
-			reqWithExtras.arc = {
-				...reqWithExtras.arc ?? {},
-				entityId: id
-			};
-			const handler = wrappedHandlers.get(action);
-			if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionEnum.join(", ")}`, { validActions: actionEnum });
-			try {
-				return sendControllerResponse(reply, await handler(id, data, req), req);
-			} catch (error) {
-				if (onError) {
-					const { statusCode, error: errorMsg, code } = onError(error, action, id);
-					throw createError(statusCode, errorMsg, code ? { code } : void 0);
-				}
-				const err = error;
-				const statusCode = err.statusCode || err.status || 500;
-				const errorCode = err.code || "ACTION_FAILED";
-				if (statusCode >= 500) req.log.error({
-					err: error,
-					action,
-					id
-				}, "Action handler error");
-				if (error?.name === "ArcError" || error instanceof Error === false) throw error;
-				throw createError(statusCode, err.message || `Failed to execute '${action}' action`, { code: errorCode });
-			}
-		}
-	});
-	fastify.log.debug({
-		actions: actionEnum,
-		tag,
-		resourceName
-	}, "[createActionRouter] Registered action endpoint: POST /:id/action");
-}
-/**
-* Build a discriminated body schema for the unified action endpoint.
-*
-* Produces a schema of the form:
-* ```json
-* {
-*   "type": "object",
-*   "required": ["action"],
-*   "properties": {
-*     "action": { "type": "string", "enum": ["dispatch", "approve"] },
-*     "carrier": { "type": "string" }
-*   },
-*   "oneOf": [
-*     {
-*       "properties": {
-*         "action": { "const": "dispatch" },
-*         "carrier": { "type": "string" }       // ← every branch lists the union
-*       },
-*       "required": ["action", "carrier"]
-*     },
-*     {
-*       "properties": {
-*         "action": { "const": "approve" },
-*         "carrier": { "type": "string" }       // ← even though approve doesn't use it
-*       },
-*       "required": ["action"]
-*     }
-*   ]
-* }
-* ```
-*
-* **Why every branch carries the full property union.** AJV's
-* `removeAdditional: 'all'` (Fastify's framework default) interacts badly
-* with `oneOf`: when a branch's `properties` lacks a field, AJV strips it
-* from the body during that branch's evaluation — *even if a different
-* branch would have allowed it*. The strip mutates the body before
-* `oneOf` finishes discriminating, so by the time the matching branch
-* wins, the body has already lost fields. Concretely: `actions: { verify:
-* {}, hold: { schema: z.object({ amount, reason }.optional()) } }` +
-* `POST { action: 'hold', amount: 1, reason }` lands at the handler as
-* `{ action: 'hold' }`. Empirically reproduced and locked at
-* [tests/core/action-discriminator-strip.test.ts](../../tests/core/action-discriminator-strip.test.ts).
-*
-* Listing every action's properties on every branch makes per-branch
-* removeAdditional walks see every caller field as "in this branch's
-* properties," so nothing gets stripped during oneOf evaluation. The
-* `required` array stays per-action, so the handler still gets called
-* only when the matching branch's required-field contract is satisfied.
-* Per-branch `additionalProperties: false` (Zod v4 default) carries
-* through but, under host removeAdditional: 'all', it can no longer
-* reject sibling-action fields — those become silently stripped at top
-* level instead. That's the host's opt-in to stripping; arc's job is to
-* stop accidentally losing the action's *own* declared fields.
-*
-* Under arc's own `createApp` (`removeAdditional: false`), strict-mode
-* rejection still functions normally — see
-* [tests/core/action-strict-schema-parity.test.ts](../../tests/core/action-strict-schema-parity.test.ts).
-*
-* Exported so OpenAPI generation and MCP tool generation can reuse the same
-* schema shape (single source of truth).
-*/
-function buildActionBodySchema(actionEnum, actionSchemas = {}) {
-	const unionProperties = {};
-	const irs = [];
-	for (const actionName of actionEnum) {
-		const ir = normalizeSchemaIR(actionSchemas[actionName]);
-		irs.push({
-			name: actionName,
-			ir
-		});
-		for (const [key, val] of Object.entries(ir.properties)) unionProperties[key] = val;
-	}
-	const branches = [];
-	for (const { name, ir } of irs) branches.push(schemaIRToJsonSchemaBranch({
-		...ir,
-		properties: {
-			...unionProperties,
-			...ir.properties
-		}
-	}, {
-		properties: { action: {
-			type: "string",
-			const: name
-		} },
-		required: ["action"]
-	}));
-	return {
-		type: "object",
-		required: ["action"],
-		properties: {
-			action: {
-				type: "string",
-				enum: [...actionEnum]
-			},
-			...unionProperties
-		},
-		oneOf: branches
-	};
-}
-/**
-* Build OpenAPI description with action list + role hints.
-* Reads `_roles` metadata from permission checks for docs.
-*/
-function buildActionDescription(actions, actionPermissions) {
-	const lines = ["Unified action endpoint for state transitions.\n\n**Available actions:**"];
-	Object.keys(actions).forEach((action) => {
-		const roles = actionPermissions[action]?._roles;
-		const roleStr = roles?.length ? ` (requires: ${roles.join(" or ")})` : "";
-		lines.push(`- \`${action}\`${roleStr}`);
-	});
-	return lines.join("\n");
-}
-//#endregion
-export { createActionRouter_exports as n, buildActionBodySchema as t };