@classytic/arc 2.16.0 → 2.16.1

package/dist/{validate-By96rH0r.mjs → validate-DFIP2VrM.mjs}

@@ -11,6 +11,13 @@ var ArcAggregationConfigError = class extends Error {
 	name = "ArcAggregationConfigError";
 };
 /**
+* Framework cap on URL-driven aggregation limits when the host opts
+* in to `defaultLimit` without explicit `maxLimit`. Set to the same
+* order of magnitude as a "large dashboard page" — bigger than every
+* realistic grouped tile, smaller than "we returned the whole table."
+*/
+const AGG_FRAMEWORK_MAX_LIMIT = 1e3;
+/**
 * Validate + normalize all aggregations on a resource. Throws on first
 * misconfig with the offending aggregation name in the message — hosts
 * see exactly which entry needs fixing.
@@ -53,6 +60,8 @@ function validateAggregations(resourceName, aggregations, schemaOptions) {
 			bucketAliases
 		});
 		if (config.topN) validateTopNConfig(resourceName, name, config.topN, groupBy, measures, bucketAliases);
+		validateLimitConfig(resourceName, name, config);
+		const limitPolicy = resolveLimitPolicy(config);
 		out.push({
 			name,
 			base: config,
@@ -65,13 +74,47 @@ function validateAggregations(resourceName, aggregations, schemaOptions) {
 				having: config.having,
 				sort: config.sort,
 				limit: config.limit,
-				topN: config.topN
+				topN: config.topN,
+				...limitPolicy ? { limitPolicy } : {}
 			}
 		});
 	}
 	return out;
 }
 /**
+* Validate `limit` / `defaultLimit` / `maxLimit` triad. Throws on
+* misconfig at boot — boundary value, hosts see exactly what to fix.
+*/
+function validateLimitConfig(resourceName, aggName, config) {
+	const hasStatic = config.limit !== void 0;
+	const hasDynamic = config.defaultLimit !== void 0;
+	if (hasStatic && hasDynamic) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" sets both \`limit\` (static cap) and \`defaultLimit\` (URL-driven cap). Pick one — static \`limit\` ignores the URL; \`defaultLimit\` reads \`?limit=N\` and caps it at \`maxLimit\`.`);
+	if (config.maxLimit !== void 0 && !hasDynamic) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" sets \`maxLimit\` without \`defaultLimit\`. \`maxLimit\` only applies to URL-driven limits — set \`defaultLimit\` or remove \`maxLimit\`.`);
+	if (hasStatic) {
+		if (!Number.isInteger(config.limit) || config.limit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`limit\` must be a positive integer — got ${String(config.limit)}.`);
+	}
+	if (hasDynamic) {
+		if (!Number.isInteger(config.defaultLimit) || config.defaultLimit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`defaultLimit\` must be a positive integer — got ${String(config.defaultLimit)}.`);
+		if (config.maxLimit !== void 0) {
+			if (!Number.isInteger(config.maxLimit) || config.maxLimit <= 0) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`maxLimit\` must be a positive integer — got ${String(config.maxLimit)}.`);
+			if (config.maxLimit < config.defaultLimit) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggName}" \`maxLimit\` (${config.maxLimit}) is less than \`defaultLimit\` (${config.defaultLimit}). The ceiling must be ≥ the default.`);
+		}
+	}
+}
+/**
+* Resolve the URL-driven limit policy into a concrete `{ default, max }`
+* pair. Returns `undefined` when the host uses the static `limit` form
+* (or no limit at all) — the request handler reads the absence to know
+* "do not parse `?limit=N` from the URL."
+*/
+function resolveLimitPolicy(config) {
+	if (config.defaultLimit === void 0) return void 0;
+	return {
+		defaultLimit: config.defaultLimit,
+		maxLimit: config.maxLimit ?? AGG_FRAMEWORK_MAX_LIMIT
+	};
+}
+/**
 * Adapter feature-detect for `aggregate()`. Called at boot when the
 * repository instance is available. Returns `true` when the kit ships
 * `aggregate`; `false` when missing.
@@ -83,14 +126,33 @@ function adapterSupportsAggregate(repo) {
 	if (!repo || typeof repo !== "object") return false;
 	return typeof repo.aggregate === "function";
 }
+/**
+* Resolve the effective per-request `limit` — three cases:
+*
+*   1. Host declared static `limit` → URL `?limit` ignored, static wins.
+*   2. Host declared `defaultLimit` → parse `?limit=N`, cap at
+*      `maxLimit`, fall back to default on absent / invalid input.
+*   3. Host declared neither → returns `undefined` (no limit applied,
+*      preserves pre-2.16.1 behavior).
+*/
+function resolveAggRequestLimit(normalized, query) {
+	const policy = normalized.compiled.limitPolicy;
+	if (!policy) return normalized.compiled.limit;
+	const raw = query["limit"];
+	if (raw === void 0 || raw === "") return policy.defaultLimit;
+	const parsed = typeof raw === "number" ? raw : Number.parseInt(String(raw), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return policy.defaultLimit;
+	return Math.min(Math.floor(parsed), policy.maxLimit);
+}
 /** Compile to canonical `AggRequest` for `repo.aggregate()` at request time. */
-function compileAggRequest(normalized, callerFilter, tenantOptions) {
+function compileAggRequest(normalized, callerFilter, tenantOptions, query) {
 	const filter = {
 		...normalized.compiled.filter ?? {},
 		...callerFilter
 	};
 	const executionHints = buildExecutionHints(normalized.base);
 	const cache = buildCacheOptions(normalized.base);
+	const limit = query ? resolveAggRequestLimit(normalized, query) : normalized.compiled.limit;
 	return {
 		measures: normalized.compiled.measures,
 		...Object.keys(filter).length > 0 ? { filter } : {},
@@ -99,7 +161,7 @@ function compileAggRequest(normalized, callerFilter, tenantOptions) {
 		...normalized.compiled.dateBuckets ? { dateBuckets: normalized.compiled.dateBuckets } : {},
 		...normalized.compiled.having ? { having: normalized.compiled.having } : {},
 		...normalized.compiled.sort ? { sort: normalized.compiled.sort } : {},
-		...normalized.compiled.limit !== void 0 ? { limit: normalized.compiled.limit } : {},
+		...limit !== void 0 ? { limit } : {},
 		...normalized.compiled.topN ? { topN: normalized.compiled.topN } : {},
 		...executionHints ? { executionHints } : {},
 		...cache ? { cache } : {}

package/dist/{versioning-ZwX9tmbS.d.mts → versioning-5H4930tj.d.mts}

@@ -1,4 +1,4 @@
-import { n as DomainEvent } from "./EventTransport-C-2oAHtw.mjs";
+import { n as DomainEvent } from "./EventTransport-B1GFiYUy.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/plugins/health.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.16.0",
+  "version": "2.16.1",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -231,7 +231,7 @@
     "push": "classytic-push",
     "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
     "release": "npm run push -- main && npm run release:tag && npm publish",
-    "prepublishOnly": "npm run typecheck && npm run lint && npm run build && npm run test:ci && npm run smoke"
+    "prepublishOnly": "npm run typecheck && npm run lint && npm run build && npm run test:main && npm run smoke"
   },
   "engines": {
     "node": ">=22"
@@ -352,7 +352,7 @@
     "@classytic/mongokit": "^3.14.0",
     "@classytic/primitives": "^0.6.0",
     "@classytic/repo-core": "^0.5.0",
-    "@classytic/sqlitekit": "^0.4.0",
+    "@classytic/sqlitekit": "^0.5.0",
     "@classytic/streamline": "^2.3.3",
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",