@classytic/arc 2.18.5 → 2.19.0

package/dist/{actionPermissions-h7DYDNMg.mjs → actionPermissions-D7NGwcAR.mjs}

@@ -247,6 +247,7 @@ function sendControllerResponse(reply, response, request) {
 function createFastifyHandler(controllerMethod) {
 	return async (req, reply) => {
 		sendControllerResponse(reply, await controllerMethod(createRequestContext(req)), req);
+		return reply;
 	};
 }
 /**

package/dist/auth/index.d.mts

@@ -1,4 +1,4 @@
-import { Bt as AuthHelpers, Vt as AuthPluginOptions } from "../index-CHNQIhcb.mjs";
+import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-CUTG2Cuo.mjs";
 import { c as PermissionCheck } from "../fields-C7ahdGYf.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BXG-HGwG.mjs";

package/dist/auth/index.mjs

@@ -317,11 +317,20 @@ function toFetchRequest(request) {
 		else if (contentType.includes("application/json") || contentType.includes("text/") || !contentType) body = JSON.stringify(request.body);
 		else request.log?.warn?.("toFetchRequest: cannot reconstruct %s body without rawBody plugin", contentType);
 	}
-	return new Request(url, {
+	const init = {
 		method: request.method,
 		headers,
 		body
+	};
+	const fetchRequest = new Request(url, init);
+	Object.defineProperty(fetchRequest, "clone", {
+		configurable: true,
+		writable: true,
+		value() {
+			return new Request(url, init);
+		}
 	});
+	return fetchRequest;
 }
 /**
 * Pipe a Fetch API Response back into Fastify's reply.

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { V as ResourceDefinition, it as RateLimitConfig, mt as RouteSchemaOptions } from "../../index-CHNQIhcb.mjs";
+import { V as ResourceDefinition, ht as RouteSchemaOptions, it as RateLimitConfig } from "../../index-CUTG2Cuo.mjs";
 
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-xVJibapr.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-DZ-5a5Op.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BTlFEx05.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { $t as BaseController, At as AggregationRateLimit, B as defineResource, Ct as AggMeasureShorthand, Dt as AggregationIndexHint, Et as AggregationDateRangeRequirement, Fn as ControllerConfigurableOptions, In as ControllerConstructionOptions, Ln as ListResult, Ot as AggregationMaterializedContext, Pn as BaseControllerOptions, Rn as BodySanitizer, St as AggMeasureInput, Tt as AggregationConfig, V as ResourceDefinition, an as SlugMixin, cn as BaseCrudController, dn as AccessControl, en as SoftDeleteExt, fn as AccessControlConfig, in as SlugExt, jt as AggregationsMap, kt as AggregationMaterializedResult, ln as QueryResolver, nn as TreeExt, on as BulkExt, rn as TreeMixin, sn as BulkMixin, tn as SoftDeleteMixin, un as QueryResolverConfig, wt as AggregationCacheConfig, zn as BodySanitizerConfig } from "../index-CHNQIhcb.mjs";
-import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-Dh0_RSTd.mjs";
+import { At as AggregationMaterializedResult, B as defineResource, Bn as BodySanitizerConfig, Ct as AggMeasureInput, Dt as AggregationDateRangeRequirement, Et as AggregationConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Mt as AggregationsMap, Ot as AggregationIndexHint, Rn as ListResult, Tt as AggregationCacheConfig, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, dn as QueryResolverConfig, en as BaseController, fn as AccessControl, in as TreeMixin, jt as AggregationRateLimit, kt as AggregationMaterializedContext, ln as BaseCrudController, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, rn as TreeExt, sn as BulkExt, tn as SoftDeleteExt, un as QueryResolver, wt as AggMeasureShorthand, zn as BodySanitizer } from "../index-CUTG2Cuo.mjs";
+import { A as MAX_FILTER_DEPTH, C as DEFAULT_SORT, D as HOOK_PHASES, E as HOOK_OPERATIONS, F as RESERVED_QUERY_PARAMS, I as SYSTEM_FIELDS, M as MAX_SEARCH_LENGTH, N as MUTATION_OPERATIONS, O as HookOperation, P as MutationOperation, S as DEFAULT_MAX_LIMIT, T as DEFAULT_UPDATE_METHOD, _ as defineAggregation, a as createRequestContext, b as DEFAULT_ID_FIELD, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as createPermissionMiddleware, h as createCrudRouter, i as createFastifyHandler, j as MAX_REGEX_LENGTH, k as HookPhase, l as getEntityId, m as defineAction, n as isFieldReadable, o as getControllerContext, p as DefineActionConfig, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as CRUD_OPERATIONS, w as DEFAULT_TENANT_FIELD, x as DEFAULT_LIMIT, y as CrudOperation } from "../index-CP6A1Ffj.mjs";
 export { AccessControl, type AccessControlConfig, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-gaEeMlz-.mjs";
 import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-Dy6EQHjM.mjs";
-import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-ZnQBa5rh.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-h7DYDNMg.mjs";
+import { a as defineResource, c as createCrudRouter, i as defineResourceVariants, l as createPermissionMiddleware, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as defineAction, t as getEntityId, u as defineAggregation } from "../core-Ba-6Sue6.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-D7NGwcAR.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, sendControllerResponse };

package/dist/{core-ZnQBa5rh.mjs → core-Ba-6Sue6.mjs}

@@ -8,8 +8,8 @@ import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./p
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
-import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
-import { c as resolveRoutePreHandlers, d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, o as buildCrudPermissionMw, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute } from "./registerRoute-CPmdkZGu.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-D7NGwcAR.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-BdV8DDwU.mjs";
 import { t as applyPresets } from "./presets-BtyFwTO4.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
 import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
@@ -104,7 +104,7 @@ function methodCarriesBody(method) {
 * `wrapHandler` is derived inline from `!route.raw`.
 */
 function createCustomRoutes(fastify, routes, controller, options) {
-	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied } = options;
+	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied, extensions } = options;
 	for (const route of routes) {
 		const routeWithRefs = route;
 		const hasHandler = route.handler !== void 0;
@@ -177,7 +177,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 				}
 				return result;
 			} : handler,
-			...rateLimitConfig ? { config: rateLimitConfig } : {}
+			...buildRouteConfig(rateLimitConfig, extensions)
 		}, {
 			resourceName,
 			op: opName
@@ -194,7 +194,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 * @param options    - Router configuration
 */
 function createCrudRouter(fastify, controller, options = {}) {
-	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField } = options;
+	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField, extensions } = options;
 	const rateLimitConfig = buildRateLimitConfig(rateLimit);
 	const resourceHasQueryCache = fastify.hasDecorator("queryCache") && controller && typeof controller._cacheConfig !== "undefined" && controller._cacheConfig !== void 0;
 	const pluginMw = resolveRouterPluginMw(fastify, Boolean(resourceHasQueryCache));
@@ -295,7 +295,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 					}, defaultSchemas[spec.op], schemas[spec.op]),
 					preHandler: preHandler.length > 0 ? preHandler : void 0,
 					handler: handlers[spec.op],
-					...rateLimitConfig ? { config: rateLimitConfig } : {}
+					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
 					resourceName,
 					op: spec.op
@@ -313,7 +313,8 @@ function createCrudRouter(fastify, controller, options = {}) {
 		routeGuards,
 		tenantScopeMw,
 		fieldPermissions,
-		onFieldWriteDenied
+		onFieldWriteDenied,
+		extensions
 	});
 }
 function buildCrudHandlers(ctrl, pipeline, resourceName) {
@@ -1242,10 +1243,11 @@ function buildResourcePlugin(resource) {
 				pipe: resource.pipe,
 				fields: resource.fields,
 				onFieldWriteDenied: resource.onFieldWriteDenied,
-				idField: resource.idField
+				idField: resource.idField,
+				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-CagItpxI.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-B_WzBFyf.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1255,11 +1257,12 @@ function buildResourcePlugin(resource) {
 					permissions: resource.permissions,
 					routeGuards: resource.routeGuards,
 					pipeline: resource.pipe,
-					rateLimit: resource.rateLimit
+					rateLimit: resource.rateLimit,
+					extensions: resource.extensions
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-DVKroXhC.mjs"), import("./validate-CRcaWzp2.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B_G_nIjm.mjs"), import("./validate-CRcaWzp2.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1332,6 +1335,7 @@ var ResourceDefinition = class {
 	*/
 	onFieldWriteDenied;
 	cache;
+	extensions;
 	referenceData;
 	/**
 	* Per-resource MCP opt-out. `false` keeps the resource out of every
@@ -1429,6 +1433,7 @@ var ResourceDefinition = class {
 		this.fields = config.fields;
 		this.onFieldWriteDenied = config.onFieldWriteDenied;
 		this.cache = config.cache;
+		this.extensions = config.extensions ? Object.freeze({ ...config.extensions }) : void 0;
 		this.mcp = config.mcp !== false;
 		this.referenceData = config.referenceData === true;
 		this.tenantField = config.tenantField;

package/dist/{createActionRouter-CagItpxI.mjs → createActionRouter-B_WzBFyf.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-gaEeMlz-.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-h7DYDNMg.mjs";
-import { a as buildActionPermissionMw, d as buildArcDecorator, i as selectPluginMw, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute, u as buildAuthMiddlewareForPermissions } from "./registerRoute-CPmdkZGu.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-D7NGwcAR.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-BdV8DDwU.mjs";
 import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
@@ -18,7 +18,7 @@ var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 * (keyed by `body.action` at request time).
 */
 function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [] } = config;
+	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [], extensions } = config;
 	const allActionNames = Object.keys(actions);
 	if (allActionNames.length === 0) {
 		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
@@ -121,7 +121,7 @@ function createActionRouter(fastify, config) {
 			schema: routeSchema,
 			attachValidation: true,
 			preHandler: preHandler.length > 0 ? preHandler : void 0,
-			...rateLimitConfig ? { config: rateLimitConfig } : {},
+			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;
 				const id = hasId ? req.params.id : "";
@@ -135,7 +135,8 @@ function createActionRouter(fastify, config) {
 				const handler = wrappedHandlers.get(action);
 				if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionSubset.join(", ")}`, { validActions: actionSubset });
 				try {
-					return sendControllerResponse(reply, await handler(id, data, req), req);
+					sendControllerResponse(reply, await handler(id, data, req), req);
+					return reply;
 				} catch (error) {
 					if (onError) {
 						const { statusCode, error: errorMsg, code } = onError(error, action, id);

package/dist/{createAggregationRouter-DVKroXhC.mjs → createAggregationRouter-B_G_nIjm.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain } from "./registerRoute-CPmdkZGu.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-BdV8DDwU.mjs";
 import { n as validateAggregations } from "./validate-CRcaWzp2.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-B0qvAguf.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-CHNQIhcb.mjs";
+import { p as RegistryEntry } from "../index-CUTG2Cuo.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-xVJibapr.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-DZ-5a5Op.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/encryption/index.d.mts

@@ -0,0 +1,222 @@
+import { FastifyPluginAsync, FastifyRequest } from "fastify";
+
+//#region src/encryption/types.d.ts
+/** JWE key-management algorithm — the protected-header `alg`. */
+type JweAlg = "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512" | "ECDH-ES" | "ECDH-ES+A256KW" | "A256GCMKW" | "dir";
+/** JWE content-encryption algorithm — the protected-header `enc`. AEAD only. */
+type JweEnc = "A128GCM" | "A192GCM" | "A256GCM";
+/** Encryption strategy for a route's response. */
+type EncryptionMode = "jwe" | "fields";
+/**
+ * Opaque key material. For `jwe` mode this is a `jose` `KeyLike` /
+ * `CryptoKey` / `Uint8Array`; for `fields` mode a 32-byte secret
+ * (`Buffer` / `Uint8Array`). Kept `unknown` at the contract layer so the
+ * `KeyProvider` interface carries no hard `jose` type dependency — hosts
+ * without `jose` installed can still implement field-mode providers.
+ */
+type KeyMaterial = unknown;
+/** A key paired with its identifier — what encrypt operations consume. */
+interface ActiveKey {
+  /** Key id, stamped into the JWE `kid` header / field envelope for rotation. */
+  readonly kid: string;
+  /** The key material (public key for JWE, 32-byte secret for fields). */
+  readonly key: KeyMaterial;
+  /** Optional per-key `alg` override (else the plugin default applies). */
+  readonly alg?: JweAlg;
+}
+/** Context handed to the key provider so resolution can be request-scoped. */
+interface KeyContext {
+  readonly request: FastifyRequest;
+}
+type MaybePromise<T> = T | Promise<T>;
+/**
+ * Pluggable key resolution. Arc owns the request-time plumbing — `kid` →
+ * key, algorithm allowlist enforcement; the host owns the trust store —
+ * which keys are valid and where they live (file / env / AWS KMS / GCP KMS
+ * / Vault). Encryption and decryption are deliberately separate operations
+ * because they often use DIFFERENT keys (JWE: a public key encrypts the
+ * outbound response, a private key by `kid` decrypts the inbound request —
+ * exactly Visa's two-key-pair model).
+ *
+ * Rotation mirrors `@fastify/secure-session`: the active key encrypts; any
+ * key resolvable by `kid` can decrypt, so you can roll keys without dropping
+ * in-flight traffic.
+ */
+interface KeyProvider {
+  /** Active key for encrypting OUTBOUND responses. */
+  encryptionKey(ctx: KeyContext): MaybePromise<ActiveKey>;
+  /** Resolve a DECRYPTION key by the inbound message's `kid`. */
+  decryptionKey(kid: string, ctx: KeyContext): MaybePromise<KeyMaterial | undefined>;
+}
+/**
+ * Per-resource encryption directive — the typed slice plugins register on
+ * `ResourceExtensions`. Declared on a resource via
+ * `defineResource({ extensions: { encryption: { … } } })`; arc threads it
+ * to request time on `request.routeOptions.config.arcExtensions.encryption`.
+ */
+interface EncryptionDirective {
+  /** Strategy. Defaults to the plugin-level `mode` (default `'jwe'`). */
+  readonly mode?: EncryptionMode;
+  /**
+   * For `mode: 'fields'` — dot-paths of fields to encrypt, resolved against
+   * the serialized response body (e.g. `'cardNumber'`, `'account.iban'`).
+   * Ignored for `mode: 'jwe'` (the whole body is encrypted).
+   */
+  readonly fields?: readonly string[];
+  /**
+   * Explicit opt-out — set `false` to disable encryption for this resource
+   * even when a plugin-level default (`routes`) would otherwise apply.
+   */
+  readonly enabled?: boolean;
+}
+/**
+ * Plugin-level options. `keyProvider` is the only required field; everything
+ * else has a secure default.
+ */
+interface EncryptionOptions {
+  /**
+   * Master on/off. Default `true`. Set `false` to register the plugin as a
+   * typed no-op (config-gated environments) — same pattern as
+   * `idempotencyPlugin`.
+   */
+  readonly enabled?: boolean;
+  /** Key provider — resolves `kid` → key for encrypt/decrypt. Required. */
+  readonly keyProvider: KeyProvider;
+  /** Default mode when a route opts in without naming one. Default `'jwe'`. */
+  readonly mode?: EncryptionMode;
+  /** JWE key-management algorithm. Default `'RSA-OAEP-256'`. */
+  readonly alg?: JweAlg;
+  /** JWE content-encryption algorithm. Default `'A256GCM'`. */
+  readonly enc?: JweEnc;
+  /**
+   * Inbound-decryption algorithm allowlists — block algorithm-substitution
+   * downgrade attacks. Default `[alg]` / `[enc]`. Set explicitly only when a
+   * client legitimately uses more than one algorithm.
+   */
+  readonly allowedAlgs?: readonly JweAlg[];
+  readonly allowedEncs?: readonly JweEnc[];
+  /**
+   * Fallback opt-in for routes that don't declare
+   * `extensions.encryption`. Return a directive (or `true` for the default
+   * mode) to encrypt, `false`/`undefined` to skip. The per-resource
+   * `extensions.encryption` ALWAYS wins when present. Use this to scope ALE
+   * to sensitive prefixes without touching every resource.
+   *
+   * @example confine ALE to `/payments` and `/accounts`
+   * ```ts
+   * routes: (req) => /^\/(payments|accounts)\b/.test(req.url)
+   * ```
+   */
+  readonly routes?: (request: FastifyRequest) => EncryptionDirective | boolean | undefined;
+  /** Decrypt inbound `application/jose` request bodies. Default `true`. */
+  readonly decryptRequests?: boolean;
+  /** Media type that signals an encrypted REQUEST body. Default `'application/jose'`. */
+  readonly contentType?: string;
+  /** Content-Type set on full-body JWE RESPONSES. Default `'application/jose'`. */
+  readonly responseContentType?: string;
+  /**
+   * Response header advertising that the body is encrypted, so generic
+   * client SDKs know to decrypt. Default `'x-encrypted'`; set `false` to omit.
+   */
+  readonly flagHeader?: string | false;
+}
+/** Request decorations added by the plugin. */
+declare module "fastify" {
+  interface FastifyRequest {
+    /** `true` when the inbound body was decrypted from a JWE by this plugin. */
+    requestDecrypted?: boolean;
+    /** `true` when the outbound body was encrypted by this plugin. */
+    responseEncrypted?: boolean;
+  }
+}
+//#endregion
+//#region src/encryption/encryptionPlugin.d.ts
+declare const encryptionPlugin: FastifyPluginAsync<EncryptionOptions>;
+declare const _default: FastifyPluginAsync<EncryptionOptions>;
+//#endregion
+//#region src/encryption/fieldCipher.d.ts
+/**
+ * Field-level cipher — `node:crypto` AES-256-GCM, zero external deps.
+ *
+ * Used by `mode: 'fields'` to encrypt individual field values in place while
+ * leaving the JSON structure intact. The envelope is an authenticated,
+ * versioned, `kid`-tagged token:
+ *
+ *   arc.v1.<b64url(kid)>.<b64url(iv)>.<b64url(ciphertext)>.<b64url(tag)>
+ *
+ * This is NOT a hand-rolled cipher — it's the correct use of a vetted AEAD
+ * primitive (AES-256-GCM): a fresh random 96-bit IV per operation (never
+ * caller-supplied — IV reuse under GCM is catastrophic), authentication via
+ * the GCM tag, and a version prefix so the format can evolve. Same shape, in
+ * spirit, as MongoDB CSFLE's BSON-binary subtype-6 envelope. For
+ * cross-vendor interop or asymmetric keys use `mode: 'jwe'` (RFC 7516)
+ * instead.
+ */
+/** Encrypt a UTF-8 string into the `arc.v1` field envelope. */
+declare function encryptField(plaintext: string, kid: string, key: unknown): string;
+/** Parsed envelope header — exposes `kid` for key resolution before decrypt. */
+interface ParsedFieldEnvelope {
+  readonly kid: string;
+  readonly iv: Buffer;
+  readonly ciphertext: Buffer;
+  readonly tag: Buffer;
+}
+/** Returns the parsed envelope, or `null` when the token isn't `arc.v1`. */
+declare function parseFieldEnvelope(token: string): ParsedFieldEnvelope | null;
+/** Decrypt a parsed `arc.v1` envelope with the resolved key. Throws on tamper. */
+declare function decryptField(envelope: ParsedFieldEnvelope, key: unknown): string;
+//#endregion
+//#region src/encryption/keyProvider.d.ts
+interface StaticKeyProviderOptions {
+  /**
+   * Active key used to ENCRYPT outbound responses. For `jwe` mode this is the
+   * recipient's PUBLIC key; for `fields` mode a 32-byte symmetric secret.
+   */
+  readonly encryptionKey: ActiveKey;
+  /**
+   * Keys used to DECRYPT inbound requests, indexed by `kid`. For `jwe` mode
+   * these are PRIVATE keys; for `fields` mode the same symmetric secrets.
+   *
+   * Defaults to `{ [encryptionKey.kid]: encryptionKey.key }` — correct for
+   * symmetric field mode where one key both encrypts and decrypts. For
+   * asymmetric JWE you MUST pass the private key(s) here; the public
+   * `encryptionKey` cannot decrypt. Keep 2–3 entries during a rotation so
+   * in-flight messages signed with the previous `kid` still decrypt.
+   */
+  readonly decryptionKeys?: Readonly<Record<string, KeyMaterial>>;
+}
+/**
+ * A static, in-memory key provider with `kid`-based rotation. Keys are held
+ * for the process lifetime — resolve them from env / a secrets file at boot
+ * and pass the imported key material in (don't re-parse PEM per request).
+ *
+ * @example symmetric field mode
+ * ```ts
+ * const provider = createStaticKeyProvider({
+ *   encryptionKey: { kid: "2026-06", key: Buffer.from(process.env.FIELD_KEY!, "base64") },
+ * });
+ * ```
+ *
+ * @example asymmetric JWE (jose key material)
+ * ```ts
+ * const provider = createStaticKeyProvider({
+ *   encryptionKey: { kid: "client-1", key: await importSPKI(clientPubPem, "RSA-OAEP-256") },
+ *   decryptionKeys: { "server-1": await importPKCS8(serverPrivPem, "RSA-OAEP-256") },
+ * });
+ * ```
+ */
+declare function createStaticKeyProvider(options: StaticKeyProviderOptions): KeyProvider;
+//#endregion
+//#region src/encryption/index.d.ts
+declare module "../types/resource.js" {
+  interface ResourceExtensions {
+    /**
+     * Encrypt this resource's responses — full-body JWE or specific fields.
+     * Threaded to request time on
+     * `request.routeOptions.config.arcExtensions.encryption`.
+     */
+    encryption?: EncryptionDirective;
+  }
+}
+//#endregion
+export { type ActiveKey, type EncryptionDirective, type EncryptionMode, type EncryptionOptions, type JweAlg, type JweEnc, type KeyContext, type KeyMaterial, type KeyProvider, type ParsedFieldEnvelope, type StaticKeyProviderOptions, createStaticKeyProvider, decryptField, _default as default, encryptField, encryptionPlugin, parseFieldEnvelope };