@classytic/arc 2.18.4 → 2.18.5

package/dist/defineEvent-DC981g-o.mjs

@@ -1,188 +0,0 @@
-import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
-import { n as createEvent } from "./EventTransport-7LPXLEUX.mjs";
-//#region src/events/defineEvent.ts
-/**
-* defineEvent — Typed Event Definitions with Optional Schema Validation
-*
-* Provides:
-* 1. defineEvent() — declare an event with name, schema, version, description
-* 2. EventRegistry — catalog of all known events + payload validation
-* 3. .create() helper — build DomainEvent with auto-generated metadata
-*
-* The built-in validator checks: object type, required fields, and top-level
-* property types. It does NOT recurse into nested objects, validate arrays,
-* enums, patterns, formats, or $ref. This is intentional — it's a lightweight
-* guard, not a full JSON Schema engine.
-*
-* For full validation, pass a custom `validate` function to `createEventRegistry()`:
-*
-* @example
-* ```typescript
-* import Ajv from 'ajv';
-* const ajv = new Ajv();
-*
-* const registry = createEventRegistry({
-*   validate: (schema, payload) => {
-*     const valid = ajv.validate(schema, payload);
-*     return valid
-*       ? { valid: true }
-*       : { valid: false, errors: ajv.errorsText().split(', ') };
-*   },
-* });
-* ```
-*
-* @example
-* ```typescript
-* import { defineEvent, createEventRegistry } from '@classytic/arc/events';
-*
-* const OrderCreated = defineEvent({
-*   name: 'order.created',
-*   version: 1,
-*   schema: {
-*     type: 'object',
-*     properties: {
-*       orderId: { type: 'string' },
-*       total: { type: 'number' },
-*     },
-*     required: ['orderId', 'total'],
-*   },
-* });
-*
-* // Type-safe event creation
-* const event = OrderCreated.create({ orderId: 'o-1', total: 100 });
-* await fastify.events.publish(event.type, event.payload, event.meta);
-*
-* // Registry for introspection + validation
-* const registry = createEventRegistry();
-* registry.register(OrderCreated);
-* const result = registry.validate('order.created', payload);
-* ```
-*/
-var defineEvent_exports = /* @__PURE__ */ __exportAll({
-	createEventRegistry: () => createEventRegistry,
-	defineEvent: () => defineEvent
-});
-/**
-* Define a typed event with optional schema validation.
-*
-* @example
-* const OrderCreated = defineEvent({
-*   name: 'order.created',
-*   schema: { type: 'object', properties: { orderId: { type: 'string' } }, required: ['orderId'] },
-* });
-*
-* const event = OrderCreated.create({ orderId: '123' });
-*/
-function defineEvent(input) {
-	const { name, schema, version = 1, description } = input;
-	return {
-		name,
-		schema,
-		version,
-		description,
-		create(payload, meta) {
-			return createEvent(name, payload, {
-				schemaVersion: version,
-				...meta
-			});
-		}
-	};
-}
-/**
-* Create an event registry for cataloging and validating events.
-*
-* The registry is opt-in — unregistered events pass validation.
-* This allows gradual adoption without breaking existing code.
-*
-* @param options.validate - Custom validator replacing the built-in minimal validator.
-*   The built-in validator only checks top-level object structure (type, required, property types).
-*   For nested objects, arrays, enums, patterns, or $ref, provide AJV or similar.
-*/
-function createEventRegistry(options) {
-	const customValidator = options?.validate;
-	const definitions = /* @__PURE__ */ new Map();
-	function registryKey(name, version) {
-		return `${name}:v${version}`;
-	}
-	return {
-		register(definition) {
-			const key = registryKey(definition.name, definition.version);
-			if (definitions.has(key)) throw new Error(`Event '${definition.name}' v${definition.version} is already registered. Use a different version number for schema evolution.`);
-			definitions.set(key, definition);
-		},
-		get(name, version) {
-			if (version !== void 0) return definitions.get(registryKey(name, version));
-			let latest;
-			let latestVersion = -1;
-			for (const def of definitions.values()) if (def.name === name && def.version > latestVersion) {
-				latest = def;
-				latestVersion = def.version;
-			}
-			return latest;
-		},
-		catalog() {
-			return Array.from(definitions.values()).map((def) => ({
-				name: def.name,
-				version: def.version,
-				description: def.description,
-				schema: def.schema
-			}));
-		},
-		validate(name, payload, version) {
-			let target = version !== void 0 ? definitions.get(registryKey(name, version)) : void 0;
-			if (!target && version === void 0) {
-				let latestVersion = -1;
-				for (const candidate of definitions.values()) if (candidate.name === name && candidate.version > latestVersion) {
-					target = candidate;
-					latestVersion = candidate.version;
-				}
-			}
-			if (!target) return { valid: true };
-			if (!target.schema) return { valid: true };
-			return customValidator ? customValidator(target.schema, payload) : validatePayload(payload, target.schema);
-		}
-	};
-}
-/**
-* Built-in minimal validator — lightweight guard, NOT a full JSON Schema engine.
-*
-* Checks:
-* - payload is an object (not null, not array)
-* - required fields are present
-* - top-level property types match (string, number, boolean, array, object)
-*
-* Does NOT check:
-* - nested object properties
-* - array item types
-* - enum, pattern, format, minLength, minimum, $ref
-*
-* For full validation, pass a custom `validate` function to `createEventRegistry()`.
-*/
-function validatePayload(payload, schema) {
-	const errors = [];
-	if (schema.type === "object") {
-		if (payload === null || payload === void 0 || typeof payload !== "object" || Array.isArray(payload)) return {
-			valid: false,
-			errors: ["Payload must be an object"]
-		};
-		const record = payload;
-		if (schema.required) {
-			for (const field of schema.required) if (!(field in record) || record[field] === void 0) errors.push(`Missing required field: '${field}'`);
-		}
-		if (schema.properties) {
-			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
-				const expectedType = propSchema.type;
-				if (expectedType) {
-					const actualType = Array.isArray(record[key]) ? "array" : typeof record[key];
-					if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
-				}
-			}
-		}
-	}
-	return errors.length === 0 ? { valid: true } : {
-		valid: false,
-		errors
-	};
-}
-//#endregion
-export { defineEvent as n, defineEvent_exports as r, createEventRegistry as t };

package/dist/registerRoute-BEYn0ylk.mjs

@@ -1,108 +0,0 @@
-import { f as createError } from "./errors-j4aJm1Wg.mjs";
-import { M as evaluateAndApplyPermission } from "./permissions-3uzwkbQt.mjs";
-//#region src/core/middlewares/permissions.ts
-/**
-* Build a PermissionContext from a Fastify request. Extracted so the CRUD
-* permission middleware and the dynamic action-permission check use the same
-* field layout — divergence here silently broke policy filters for actions.
-*/
-function buildPermissionContext(req, opts) {
-	const reqWithExtras = req;
-	const params = req.params;
-	return {
-		user: reqWithExtras.user ?? null,
-		request: req,
-		resource: opts.resource,
-		action: opts.action,
-		resourceId: opts.resourceId ?? params?.id,
-		params,
-		data: opts.data ?? req.body
-	};
-}
-/**
-* Static per-route CRUD permission gate. The permission and action are known
-* at route-registration time, so the gate is a plain preHandler.
-*
-* Actions use the dynamic counterpart `buildActionPermissionMw` — their
-* permission is resolved from `body.action` at request time.
-*/
-function buildCrudPermissionMw(permissionCheck, resourceName, action) {
-	if (!permissionCheck) return null;
-	return async (req, reply) => {
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action
-		}), req, reply);
-	};
-}
-/**
-* Dynamic per-action permission gate for the action router.
-*
-* Resolves the permission from `body.action` at request time and runs
-* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
-* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
-* (idempotency) and `routeGuards` run. Previously this check lived inside
-* the main action handler, which meant idempotency recorded unauthorized
-* requests and route guards saw unfiltered scope — the very divergence
-* routerShared exists to prevent.
-*
-* Also acts as a defensive fallback for invalid action names — the
-* `oneOf` body schema normally rejects these at AJV validation, but
-* hosts that disable schema validation still get a 400 here.
-*/
-function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
-	const enumSet = new Set(actionEnum);
-	const validActions = [...actionEnum];
-	return async (req, reply) => {
-		const body = req.body ?? {};
-		const action = body.action;
-		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
-		const permissionCheck = actionPermissions[action] ?? globalAuth;
-		if (!permissionCheck) return;
-		const { action: _discard, ...data } = body;
-		const params = req.params;
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action,
-			resourceId: params?.id,
-			data
-		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
-	};
-}
-//#endregion
-//#region src/core/middlewares/registerRoute.ts
-/**
-* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
-*
-* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
-* overlaps before Fastify ever runs, but a few cases still slip through to
-* Fastify itself: two presets contributing the same `routes` entry, hosts
-* mounting two resources at the same prefix, custom routes that share a
-* URL with another plugin. Fastify's default message ("Method 'GET'
-* already declared for route '/'") gives no hint at the resource-shaped
-* fix — `disabledRoutes: ['list']` — so wrap it with one.
-*/
-function tryRegisterRoute(fastify, opts, context) {
-	try {
-		fastify.route(opts);
-	} catch (err) {
-		const fastifyErr = err;
-		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
-		const method = opts.method;
-		const url = opts.url;
-		const opHint = context.op ? ` (op: ${context.op})` : "";
-		const fixHint = context.op && [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
-		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
-		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
-		enhanced.cause = err;
-		throw enhanced;
-	}
-}
-//#endregion
-export { buildActionPermissionMw as n, buildCrudPermissionMw as r, tryRegisterRoute as t };