@classytic/arc 2.18.5 → 2.20.0

package/dist/{core-ZnQBa5rh.mjs → core-CWhyGkiM.mjs}

@@ -1,18 +1,57 @@
-import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-gaEeMlz-.mjs";
+import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DNre0wRg.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { p as assertValidConfig, x as getDefaultCrudSchemas } from "./utils-C6QQ9-hd.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-Dy6EQHjM.mjs";
-import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-BPB1xqGf.mjs";
+import { A as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-ChjYQpjn.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-D-MHZ27_.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-DGSREwPw.mjs";
+import { F as applyFieldWritePermissions, L as resolveEffectiveRoles } from "./permissions-CgbOLJZG.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { t as applyPresets } from "./presets-DWsYQdbV.mjs";
 import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
-import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-h7DYDNMg.mjs";
-import { c as resolveRoutePreHandlers, d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, o as buildCrudPermissionMw, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute } from "./registerRoute-CPmdkZGu.mjs";
-import { t as applyPresets } from "./presets-BtyFwTO4.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { t as pluralize } from "./pluralize-DccFV9R7.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-C9RMiIpc.mjs";
+import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
+//#region src/core/middlewares/fieldWrite.ts
+/**
+* Build a preHandler that enforces field-write permissions on the request body.
+*
+* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
+* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
+* never went through that path — so a host that declared
+* `fields: { role: fields.writableBy(['admin']) }` and a custom
+* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
+*
+* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
+* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
+* bodies don't necessarily mirror the resource's adapter shape, and we'd
+* generate surprising 403s by enforcing rules tied to that shape.
+*
+* Returns `null` when the resource has no field permissions configured — the
+* caller should then skip wiring it into the preHandler chain.
+*/
+function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
+	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
+	return async (request, _reply) => {
+		const body = request.body;
+		if (!body || typeof body !== "object" || Array.isArray(body)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
+		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
+		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
+		request.body = filtered;
+	};
+}
+/**
+* True for HTTP methods that carry a request body and should run the
+* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
+*/
+function methodCarriesBody(method) {
+	const m = method.toUpperCase();
+	return m === "POST" || m === "PUT" || m === "PATCH";
+}
+//#endregion
 //#region src/core/aggregation/defineAggregation.ts
 /**
 * Declare a single resource aggregation. Exported configs flow into
@@ -59,52 +98,13 @@ function defineAggregation(config) {
 	return config;
 }
 //#endregion
-//#region src/core/middlewares/fieldWrite.ts
-/**
-* Build a preHandler that enforces field-write permissions on the request body.
-*
-* Auto-CRUD's create/update routes get this for free via `BodySanitizer.sanitize()`
-* inside `BaseController`. Custom routes (`config.routes`, presets, action endpoints)
-* never went through that path — so a host that declared
-* `fields: { role: fields.writableBy(['admin']) }` and a custom
-* `POST /users/promote` happily accepted `{ role: 'admin' }` from any caller.
-*
-* This preHandler closes that gap. It applies ONLY the `applyFieldWritePermissions`
-* step — no `SYSTEM_FIELDS` strip, no `fieldRules` strip — because custom-route
-* bodies don't necessarily mirror the resource's adapter shape, and we'd
-* generate surprising 403s by enforcing rules tied to that shape.
-*
-* Returns `null` when the resource has no field permissions configured — the
-* caller should then skip wiring it into the preHandler chain.
-*/
-function buildFieldWritePreHandler(fieldPermissions, policy = DEFAULT_FIELD_WRITE_DENIAL_POLICY) {
-	if (!fieldPermissions || Object.keys(fieldPermissions).length === 0) return null;
-	return async (request, _reply) => {
-		const body = request.body;
-		if (!body || typeof body !== "object" || Array.isArray(body)) return;
-		const scope = request.scope ?? PUBLIC_SCOPE;
-		if (isElevated(scope)) return;
-		const { body: filtered, deniedFields } = applyFieldWritePermissions(body, fieldPermissions, resolveEffectiveRoles(getUserRoles(request.user), isMember(scope) ? scope.orgRoles : []));
-		if (deniedFields.length > 0 && policy === "reject") throw new ForbiddenError(`Not permitted to write field${deniedFields.length === 1 ? "" : "s"}: ${deniedFields.join(", ")}`);
-		request.body = filtered;
-	};
-}
-/**
-* True for HTTP methods that carry a request body and should run the
-* field-write preHandler. GET/DELETE/HEAD/OPTIONS skip enforcement.
-*/
-function methodCarriesBody(method) {
-	const m = method.toUpperCase();
-	return m === "POST" || m === "PUT" || m === "PATCH";
-}
-//#endregion
 //#region src/core/createCrudRouter.ts
 /**
 * Mount custom routes (from presets or user-defined `routes`) on Fastify.
 * `wrapHandler` is derived inline from `!route.raw`.
 */
 function createCustomRoutes(fastify, routes, controller, options) {
-	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied } = options;
+	const { tag, resourceName, arcDecorator, rateLimitConfig, pluginMw, pipeline, routeGuards, tenantScopeMw, fieldPermissions, onFieldWriteDenied, extensions } = options;
 	for (const route of routes) {
 		const routeWithRefs = route;
 		const hasHandler = route.handler !== void 0;
@@ -177,7 +177,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 				}
 				return result;
 			} : handler,
-			...rateLimitConfig ? { config: rateLimitConfig } : {}
+			...buildRouteConfig(route.rateLimit !== void 0 ? buildRateLimitConfig(route.rateLimit) : rateLimitConfig, extensions)
 		}, {
 			resourceName,
 			op: opName
@@ -194,7 +194,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 * @param options    - Router configuration
 */
 function createCrudRouter(fastify, controller, options = {}) {
-	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField } = options;
+	const { tag = "Resource", schemas = {}, permissions = {}, middlewares = {}, routeGuards = [], routes: customRoutes = [], disableDefaultRoutes = false, disabledRoutes = [], resourceName = "unknown", schemaOptions, rateLimit, pipe: pipeline, fields: fieldPermissions, onFieldWriteDenied, updateMethod = DEFAULT_UPDATE_METHOD, idField, extensions } = options;
 	const rateLimitConfig = buildRateLimitConfig(rateLimit);
 	const resourceHasQueryCache = fastify.hasDecorator("queryCache") && controller && typeof controller._cacheConfig !== "undefined" && controller._cacheConfig !== void 0;
 	const pluginMw = resolveRouterPluginMw(fastify, Boolean(resourceHasQueryCache));
@@ -295,7 +295,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 					}, defaultSchemas[spec.op], schemas[spec.op]),
 					preHandler: preHandler.length > 0 ? preHandler : void 0,
 					handler: handlers[spec.op],
-					...rateLimitConfig ? { config: rateLimitConfig } : {}
+					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
 					resourceName,
 					op: spec.op
@@ -313,7 +313,8 @@ function createCrudRouter(fastify, controller, options = {}) {
 		routeGuards,
 		tenantScopeMw,
 		fieldPermissions,
-		onFieldWriteDenied
+		onFieldWriteDenied,
+		extensions
 	});
 }
 function buildCrudHandlers(ctrl, pipeline, resourceName) {
@@ -948,6 +949,42 @@ function computeHasCrudRoutes(config) {
 	const disabled = new Set(config.disabledRoutes ?? []);
 	return !config.disableDefaultRoutes && CRUD_OPERATIONS.some((op) => !disabled.has(op));
 }
+const WRITE_OPERATIONS = /* @__PURE__ */ new Set([
+	"create",
+	"update",
+	"delete"
+]);
+/**
+* Public-by-omission CRUD diagnostic (post-preset).
+*
+* An omitted CRUD permission mounts the route with NO permission
+* middleware at all — unlike custom routes and actions, which fail boot
+* without one. That asymmetry silently shipped unauthenticated writes
+* (`permissions: readOnly()` pre-2.20 being the canonical victim).
+*
+* Runs against `resolvedConfig` — never the raw user config — so
+* permissions injected by presets (ownedByUser, multiTenant policy
+* wiring, ...) count as gates and don't false-positive.
+*
+* Severity ladder:
+*   - `warn` when any enabled WRITE op (create/update/delete) is ungated —
+*     this is real exposure the host must acknowledge.
+*   - `info` when only reads are ungated — public catalogs
+*     (`referenceData: true`) are a legitimate shape, but the host should
+*     still state intent with `permissions.fullPublic()` / `allowPublic()`.
+*/
+function collectUngatedCrudDiagnostics(config) {
+	if (config.disableDefaultRoutes) return [];
+	const disabled = new Set(config.disabledRoutes ?? []);
+	const permissions = config.permissions ?? {};
+	const ungated = CRUD_OPERATIONS.filter((op) => !disabled.has(op) && typeof permissions[op] !== "function");
+	if (ungated.length === 0) return [];
+	return [{
+		severity: ungated.some((op) => WRITE_OPERATIONS.has(op)) ? "warn" : "info",
+		code: "crud-public-by-omission",
+		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\nAn omitted permission mounts the route WITHOUT auth. State intent explicitly:\n  permissions: permissions.fullPublic()     // intentionally public\n  permissions: permissions.authenticated()  // require auth on every op\n  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
+	}];
+}
 //#endregion
 //#region src/registry/resolveTenantPurge.ts
 const DEFAULT_PRIORITY = 100;
@@ -1101,7 +1138,7 @@ function deepMergeSchemas(base, override) {
 	if (!override) return base;
 	if (!base) return override;
 	const result = { ...base };
-	for (const [key, value] of Object.entries(override)) if (Array.isArray(value) && Array.isArray(result[key])) result[key] = [...new Set([...result[key], ...value])];
+	for (const [key, value] of Object.entries(override)) if (Array.isArray(value) && Array.isArray(result[key])) result[key] = [.../* @__PURE__ */ new Set([...result[key], ...value])];
 	else if (value && typeof value === "object" && !Array.isArray(value)) result[key] = deepMergeSchemas(result[key], value);
 	else result[key] = value;
 	return result;
@@ -1242,10 +1279,11 @@ function buildResourcePlugin(resource) {
 				pipe: resource.pipe,
 				fields: resource.fields,
 				onFieldWriteDenied: resource.onFieldWriteDenied,
-				idField: resource.idField
+				idField: resource.idField,
+				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-CagItpxI.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-HlQso0jO.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1255,11 +1293,12 @@ function buildResourcePlugin(resource) {
 					permissions: resource.permissions,
 					routeGuards: resource.routeGuards,
 					pipeline: resource.pipe,
-					rateLimit: resource.rateLimit
+					rateLimit: resource.rateLimit,
+					extensions: resource.extensions
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-DVKroXhC.mjs"), import("./validate-CRcaWzp2.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-5LzPzgw1.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1332,6 +1371,7 @@ var ResourceDefinition = class {
 	*/
 	onFieldWriteDenied;
 	cache;
+	extensions;
 	referenceData;
 	/**
 	* Per-resource MCP opt-out. `false` keeps the resource out of every
@@ -1429,6 +1469,7 @@ var ResourceDefinition = class {
 		this.fields = config.fields;
 		this.onFieldWriteDenied = config.onFieldWriteDenied;
 		this.cache = config.cache;
+		this.extensions = config.extensions ? Object.freeze({ ...config.extensions }) : void 0;
 		this.mcp = config.mcp !== false;
 		this.referenceData = config.referenceData === true;
 		this.tenantField = config.tenantField;
@@ -1713,7 +1754,7 @@ function mergeUserOpenApiOverrides(openApiSchemas, userOverrides) {
 * call) since the set is fixed and the cost of re-allocating is a
 * pointless boot tax for hosts with hundreds of resources.
 */
-const CRUD_OP_NAMES = new Set([
+const CRUD_OP_NAMES = /* @__PURE__ */ new Set([
 	"create",
 	"update",
 	"delete",
@@ -1733,7 +1774,42 @@ function validateDefineResourceConfig(config) {
 	validatePermissionsShape(config);
 	validateCustomRoutePermissions(config);
 	validateActionsShape(config);
-	return collectRedundantFieldRuleDiagnostics(config);
+	return [...collectRedundantFieldRuleDiagnostics(config), ...collectReservedFilterNameDiagnostics(config)];
+}
+/**
+* Query-string param names arc's `QueryParser` reserves for
+* pagination/projection (`q.after ?? q.cursor` is the keyset cursor). A
+* document field with one of these names can never be filtered via the query
+* string — the parser consumes the name before it reaches the filter map — and
+* the same reservation flows into the MCP list-tool schema. Silent pre-2.20;
+* now surfaced.
+*/
+const RESERVED_QUERY_PARAMS = /* @__PURE__ */ new Set([
+	"page",
+	"limit",
+	"cursor",
+	"after",
+	"sort",
+	"search",
+	"select",
+	"populate"
+]);
+/**
+* Warn when a declared filterable field's NAME collides with a reserved query
+* param. Verified empirically (tests/e2e/reserved-field-name-collision.test.ts):
+* a field named `cursor`/`page` is silently unfilterable. Boot diagnostic, not
+* a hard error — the resource still works, the field just isn't query-filterable.
+*/
+function collectReservedFilterNameDiagnostics(config) {
+	const filterable = config.schemaOptions?.filterableFields;
+	if (!filterable) return [];
+	const collisions = filterable.filter((f) => RESERVED_QUERY_PARAMS.has(f));
+	if (collisions.length === 0) return [];
+	return [{
+		severity: "warn",
+		code: "filter-field-reserved-name",
+		message: `[Arc] Resource '${config.name}': filterable field(s) [${collisions.join(", ")}] collide with reserved query params (page, limit, cursor, after, sort, search, select, populate). The query parser consumes these names for pagination/projection, so filtering by them via the query string — and via the MCP list tool — will NOT work. Rename the field(s), or drop them from \`filterableFields\` if the collision is intended.`
+	}];
 }
 /** Permissions must be `PermissionCheck` functions, not arbitrary values. */
 function validatePermissionsShape(config) {
@@ -1815,6 +1891,7 @@ function defineResource(config) {
 	const configWithId = resolveIdField(normalisedConfig, repository);
 	const resolvedConfig = applyPresetsAndAutoInject(configWithId);
 	const hasCrudRoutes = computeHasCrudRoutes(resolvedConfig);
+	if (!normalisedConfig.skipValidation) diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig));
 	const narrowedConfig = resolvedConfig;
 	const narrowedAdapter = configWithId.adapter;
 	const controller = resolveOrAutoCreateController(narrowedConfig, narrowedAdapter, repository, hasCrudRoutes);

package/dist/{createActionRouter-CagItpxI.mjs → createActionRouter-HlQso0jO.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import "./constants-gaEeMlz-.mjs";
+import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-h7DYDNMg.mjs";
-import { a as buildActionPermissionMw, d as buildArcDecorator, i as selectPluginMw, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain, t as tryRegisterRoute, u as buildAuthMiddlewareForPermissions } from "./registerRoute-CPmdkZGu.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-D1MJwqmp.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-DGSREwPw.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-C9RMiIpc.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-ajetw3Fv.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -18,7 +18,7 @@ var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 * (keyed by `body.action` at request time).
 */
 function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [] } = config;
+	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [], extensions } = config;
 	const allActionNames = Object.keys(actions);
 	if (allActionNames.length === 0) {
 		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
@@ -121,7 +121,7 @@ function createActionRouter(fastify, config) {
 			schema: routeSchema,
 			attachValidation: true,
 			preHandler: preHandler.length > 0 ? preHandler : void 0,
-			...rateLimitConfig ? { config: rateLimitConfig } : {},
+			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;
 				const id = hasId ? req.params.id : "";
@@ -135,7 +135,8 @@ function createActionRouter(fastify, config) {
 				const handler = wrappedHandlers.get(action);
 				if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionSubset.join(", ")}`, { validActions: actionSubset });
 				try {
-					return sendControllerResponse(reply, await handler(id, data, req), req);
+					sendControllerResponse(reply, await handler(id, data, req), req);
+					return reply;
 				} catch (error) {
 					if (onError) {
 						const { statusCode, error: errorMsg, code } = onError(error, action, id);

package/dist/{createAggregationRouter-DVKroXhC.mjs → createAggregationRouter-5LzPzgw1.mjs}

@@ -1,7 +1,7 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { d as buildArcDecorator, i as selectPluginMw, l as buildAuthMiddleware, n as buildRateLimitConfig, r as resolveRouterPluginMw, s as buildPreHandlerChain } from "./registerRoute-CPmdkZGu.mjs";
-import { n as validateAggregations } from "./validate-CRcaWzp2.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-B0qvAguf.mjs";
+import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-DGSREwPw.mjs";
+import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is
@@ -39,7 +39,8 @@ function registerOne(fastify, normalized, ctx) {
 	const authMw = buildAuthMiddleware(fastify, config.permissions);
 	const permissionFn = config.permissions;
 	const permissionMw = async (req, _reply) => {
-		const raw = await permissionFn(buildPermissionContextLite(req, normalized.name));
+		const ctx = buildPermissionContextLite(req, normalized.name);
+		const raw = await permissionFn(ctx);
 		if (!normalizePermissionGranted(raw)) {
 			const status = req.user ? 403 : 401;
 			const reason = normalizePermissionReason(raw);