@classytic/arc 2.20.0 → 2.22.0

package/dist/{sessionManager-BXG-HGwG.d.mts → sessionManager-BHOM3N_0.d.mts}

@@ -1,5 +1,4 @@
 import { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
-
 //#region src/auth/sessionManager.d.ts
 /**
  * Session data stored in the session store.
@@ -81,13 +80,18 @@ declare module "fastify" {
     authenticate: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
     /** Session management helpers */
     sessionManager: {
-      /** Create a new session for a user */createSession: (userId: string, metadata?: Record<string, unknown>) => Promise<{
+      /** Create a new session for a user */
+      createSession: (userId: string, metadata?: Record<string, unknown>) => Promise<{
         sessionId: string;
         cookie: string;
-      }>; /** Revoke a specific session */
-      revokeSession: (sessionId: string) => Promise<void>; /** Revoke all sessions for a user */
-      revokeAllSessions: (userId: string) => Promise<void>; /** Revoke all sessions except the current one */
-      revokeOtherSessions: (userId: string, currentSessionId: string) => Promise<void>; /** Refresh a session (reset updatedAt, extend expiry if needed) */
+      }>;
+      /** Revoke a specific session */
+      revokeSession: (sessionId: string) => Promise<void>;
+      /** Revoke all sessions for a user */
+      revokeAllSessions: (userId: string) => Promise<void>;
+      /** Revoke all sessions except the current one */
+      revokeOtherSessions: (userId: string, currentSessionId: string) => Promise<void>;
+      /** Refresh a session (reset updatedAt, extend expiry if needed) */
       refreshSession: (sessionId: string) => Promise<SessionData | null>;
     };
   }

package/dist/{storage-Co_PQpeQ.d.mts → storage-DLUZ04kK.d.mts}

@@ -98,14 +98,18 @@ interface StorageReadRange {
 type StorageReadResult = {
   kind: "stream";
   stream: NodeJS.ReadableStream;
-  contentType: string; /** Total size of the full object (NOT the ranged slice). Required for `Content-Range`. */
-  bytes?: number; /** Actual byte range returned when the caller passed `range`. */
+  contentType: string;
+  /** Total size of the full object (NOT the ranged slice). Required for `Content-Range`. */
+  bytes?: number;
+  /** Actual byte range returned when the caller passed `range`. */
   range?: StorageReadRange;
 } | {
   kind: "buffer";
   buffer: Buffer;
-  contentType: string; /** Total size of the full object. Used for `Content-Range` on partial reads. */
-  totalBytes?: number; /** Actual byte range returned when the caller passed `range`. */
+  contentType: string;
+  /** Total size of the full object. Used for `Content-Range` on partial reads. */
+  totalBytes?: number;
+  /** Actual byte range returned when the caller passed `range`. */
   range?: StorageReadRange;
 };
 /**

package/dist/testing/index.d.mts

@@ -1,10 +1,10 @@
-import { V as ResourceDefinition, qt as AnyRecord } from "../index-_--GyzcO.mjs";
-import { d as preloadResourcesAsync, r as CreateAppOptions, u as preloadResources } from "../types-BHMKlMBU.mjs";
+import { V as ResourceDefinition, qt as AnyRecord } from "../index-DbtgCOCj.mjs";
+import { n as ArcModuleInput } from "../module-B4u10iOJ.mjs";
+import { d as preloadResourcesAsync, t as CreateAppOptions, u as preloadResources } from "../index-BEu4wjbL.mjs";
 import { StorageContractSetup, StorageContractSetupResult, runStorageContract } from "./storageContract.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Mock } from "vitest";
 import { StandardRepo } from "@classytic/repo-core/repository";
-
 //#region src/testing/assertions.d.ts
 /**
  * expectArc — Arc-specific response assertions
@@ -297,6 +297,85 @@ declare function createBetterAuthTestHelpers(options?: BetterAuthTestHelpersOpti
  */
 declare function setupBetterAuthTestApp(input: SetupBetterAuthTestAppInput): Promise<SetupBetterAuthTestAppResult>;
 //#endregion
+//#region src/testing/bootModuleApp.d.ts
+/** Handed to a modules factory — the in-memory DB is live at call time. */
+/**
+ * A provisioned test database — what the `database` seam yields. Arc
+ * core never names a driver: kits ship factories (`mongoMemoryDatabase`
+ * is the built-in default; a sqlitekit/pgkit testkit ships its own) and
+ * the connection flows through as an opaque generic.
+ */
+interface TestDatabase<TConn = unknown> {
+  /** Connection string, when the backend has one (informational). */
+  uri: string;
+  /** Driver connection handle passed to the modules factory. */
+  connection: TConn;
+  /** Stop/disconnect everything this factory started. MUST be idempotent-safe to call once. */
+  teardown(): Promise<void>;
+}
+/** The DB-provisioning seam — `bootModuleApp({ database })`. */
+type TestDatabaseFactory<TConn = unknown> = (opts: {
+  replset?: boolean;
+}) => Promise<TestDatabase<TConn>>;
+interface TestkitContext<TConn = unknown> {
+  /** The provisioned database's connection string. */
+  uri: string;
+  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
+  mongoUri: string;
+  /**
+   * Driver connection handle (the default factory yields mongoose's
+   * DEFAULT connection). Generic so DB-typed wrappers assert the driver
+   * type ONCE: `bootModuleApp<Connection>(...)`. Arc core stays DB-agnostic.
+   */
+  connection: TConn;
+}
+type BootModulesInput<TConn = unknown> = ArcModuleInput | readonly ArcModuleInput[] | ((ctx: TestkitContext<TConn>) => ArcModuleInput | readonly ArcModuleInput[] | Promise<ArcModuleInput | readonly ArcModuleInput[]>);
+interface BootModuleAppOptions<TConn = unknown> {
+  /**
+   * DB provisioner. Default: `mongoMemoryDatabase` (in-memory MongoDB —
+   * lazy devDep imports, nothing Mongo touches arc's runtime). Kits for
+   * other stores inject their own factory here; the rest of the harness
+   * (module resolution, app boot, teardown ordering) is DB-agnostic.
+   */
+  database?: TestDatabaseFactory<TConn>;
+  /** Single-node replica set (transactions). Default: standalone. Passed to the database factory. */
+  replset?: boolean;
+  /**
+   * Extra `createApp` options merged over the testing defaults
+   * (`preset: 'testing'`, `auth: false`, `sensible: false` — utility
+   * plugins stay off so the testkit is dependency-light; re-enable per
+   * boot when a module genuinely exercises one).
+   */
+  app?: Partial<CreateAppOptions>;
+}
+interface ModuleTestApp<TConn = unknown> {
+  app: FastifyInstance;
+  /** The provisioned database's connection string. */
+  uri: string;
+  /** @deprecated Alias of `uri` from the Mongo-default era — prefer `uri`. */
+  mongoUri: string;
+  /** The mongoose `Connection` handed to the modules factory. */
+  connection: TConn;
+  /**
+   * Typed module-export accessor — `t.exports<CatalogEngine>('catalog')`
+   * instead of reaching through `(t.app as ...).arc.modules.catalog`.
+   * Delegates to `getModuleExports` (throws with the registered-module
+   * list when the name is unknown — same contract hosts get).
+   */
+  exports<TExports = unknown>(name: string): TExports;
+  /** Close app → disconnect mongoose → stop the in-memory server. Idempotent. */
+  close(): Promise<void>;
+}
+/**
+ * The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+ * Everything Mongo-specific about the harness lives HERE — the harness
+ * itself is driver-blind and any kit can replace this via `database`.
+ */
+declare function mongoMemoryDatabase(opts: {
+  replset?: boolean;
+}): Promise<TestDatabase<unknown>>;
+declare function bootModuleApp<TConn = unknown>(modules: BootModulesInput<TConn>, options?: BootModuleAppOptions<TConn>): Promise<ModuleTestApp<TConn>>;
+//#endregion
 //#region src/testing/fixtures.d.ts
 type FixtureFactory<T extends AnyRecord = AnyRecord> = (data: Partial<T>) => Promise<T>;
 /** Delete hook invoked by `clear()` for records that were created through a factory. */
@@ -541,4 +620,4 @@ declare function createTestApp(options?: CreateTestAppOptions): Promise<TestAppC
  */
 declare function createMinimalTestApp(options?: FastifyServerOptions): FastifyInstance;
 //#endregion
-export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestFixtures, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { type ArcAssertion, type ArcResponseLike, type AuthMode, type AuthResponse, type BetterAuthTestHelpers, type BetterAuthTestHelpersOptions, type BetterAuthTestUser, type BootModuleAppOptions, type BootModulesInput, type CreateOrgInput, type CreateTestAppOptions, type DbMode, type FixtureDestroyer, type FixtureFactory, type FixtureRegistration, HttpTestHarness, type HttpTestHarnessOptions, type MockRepository, type ModuleTestApp, type OrgResponse, type RoleConfig, type SetupBetterAuthTestAppInput, type SetupBetterAuthTestAppResult, type SignInInput, type SignUpInput, type StorageContractSetup, type StorageContractSetupResult, type TestAppContext, type TestAuthProvider, type TestAuthSession, type TestDatabase, type TestDatabaseFactory, type TestFixtures, type TestkitContext, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
 import { t as CRUD_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-CHw3_oA_.mjs";
+import { d as getModuleExports, h as preloadResourcesAsync, m as preloadResources, n as createApp } from "../createApp-Ci7yG5gv.mjs";
 import { runStorageContract } from "./storageContract.mjs";
 import Fastify from "fastify";
 import { afterAll, describe, expect, it, vi } from "vitest";
@@ -210,7 +210,10 @@ function createJwtAuthProvider(app, opts = {}) {
 			if (!config.user) throw new Error(`[jwt] role '${role}' has neither 'user' nor 'token'`);
 			const jwt = app.jwt;
 			if (!jwt?.sign) throw new Error(`[jwt] app.jwt.sign() is unavailable — register @fastify/jwt before calling createJwtAuthProvider.`);
-			return jwt.sign(config.user);
+			return jwt.sign({
+				type: "access",
+				...config.user
+			});
 		}
 	});
 }
@@ -459,6 +462,73 @@ async function setupBetterAuthTestApp(input) {
 	};
 }
 //#endregion
+//#region src/testing/bootModuleApp.ts
+/**
+* The built-in DB factory: in-memory MongoDB via lazy devDep imports.
+* Everything Mongo-specific about the harness lives HERE — the harness
+* itself is driver-blind and any kit can replace this via `database`.
+*/
+async function mongoMemoryDatabase(opts) {
+	let mms;
+	try {
+		mms = await import("mongodb-memory-server");
+	} catch {
+		throw new Error("[arc-testing] bootModuleApp's default database is in-memory MongoDB — install 'mongodb-memory-server' + 'mongoose' as devDependencies, or inject your own `database` factory for a different store");
+	}
+	const server = opts.replset ? await mms.MongoMemoryReplSet.create({ replSet: { count: 1 } }) : await mms.MongoMemoryServer.create();
+	const uri = server.getUri();
+	const mongoose = (await import("mongoose")).default;
+	if (mongoose.connection.readyState !== 0) await mongoose.disconnect();
+	await mongoose.connect(uri);
+	mongoose.connection.deleteModel(/.*/);
+	return {
+		uri,
+		connection: mongoose.connection,
+		teardown: async () => {
+			if (mongoose.connection.readyState !== 0) await mongoose.disconnect().catch(() => void 0);
+			await server.stop().catch(() => void 0);
+		}
+	};
+}
+async function bootModuleApp(modules, options = {}) {
+	const db = await (options.database ?? mongoMemoryDatabase)({ replset: options.replset ?? false });
+	const ctx = {
+		uri: db.uri,
+		mongoUri: db.uri,
+		connection: db.connection
+	};
+	const resolved = typeof modules === "function" ? await modules(ctx) : modules;
+	const list = Array.isArray(resolved) ? resolved : [resolved];
+	let app;
+	try {
+		app = await createApp({
+			preset: "testing",
+			auth: false,
+			sensible: false,
+			...options.app,
+			modules: list
+		});
+		await app.ready();
+	} catch (err) {
+		await db.teardown().catch(() => void 0);
+		throw err;
+	}
+	let closed = false;
+	return {
+		app,
+		uri: db.uri,
+		mongoUri: db.uri,
+		connection: db.connection,
+		exports: (name) => getModuleExports(app, name),
+		close: async () => {
+			if (closed) return;
+			closed = true;
+			await app.close().catch(() => void 0);
+			await db.teardown().catch(() => void 0);
+		}
+	};
+}
+//#endregion
 //#region src/testing/fixtures.ts
 function createTestFixtures() {
 	const registry = /* @__PURE__ */ new Map();
@@ -1046,7 +1116,7 @@ function pickDefaultAuth(authMode, callerAuth) {
 	};
 }
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-D6uwzCKu.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-Ci7yG5gv.mjs").then((n) => n.r);
 	const { resources = [], db = "in-memory", connectMongoose = false, authMode = "jwt", defaultOrgId, plugins, auth: callerAuth, ...appOptions } = options;
 	let dbHandle;
 	let dbUri;
@@ -1116,4 +1186,4 @@ function createMinimalTestApp(options = {}) {
 	});
 }
 //#endregion
-export { HttpTestHarness, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };
+export { HttpTestHarness, bootModuleApp, createBetterAuthProvider, createBetterAuthTestHelpers, createCustomAuthProvider, createDataFactory, createHttpTestHarness, createJwtAuthProvider, createMinimalTestApp, createMockController, createMockReply, createMockRepository, createMockRequest, createMockUser, createSpy, createTestApp, createTestFixtures, createTestTimer, expectArc, mongoMemoryDatabase, preloadResources, preloadResourcesAsync, runStorageContract, safeParseBody, setupBetterAuthTestApp, waitFor };

package/dist/testing/storageContract.d.mts

@@ -1,5 +1,4 @@
-import { t as Storage } from "../storage-Co_PQpeQ.mjs";
-
+import { t as Storage } from "../storage-DLUZ04kK.mjs";
 //#region src/testing/storageContract.d.ts
 interface StorageContractSetupResult {
   storage: Storage;

package/dist/{tracing-D8jlGXP7.d.mts → tracing-CsGKQJGg.d.mts}

@@ -1,6 +1,5 @@
 import { FastifyInstance, FastifyRequest } from "fastify";
 import { Span, Tracer } from "@opentelemetry/api";
-
 //#region src/plugins/tracing.d.ts
 interface TracingOptions {
   /**

package/dist/types/index.d.mts

@@ -1,5 +1,5 @@
-import { $ as OnTenantDeleteConfig, $t as UserOrganization, A as RequestIdOptions, C as RequestContext, D as HealthCheck, E as GracefulShutdownOptions, F as FastifyWithDecorators, Fn as BaseControllerOptions, G as ActionsMap, Gt as JwtContext, H as ActionDefinition, Ht as AuthPluginOptions, I as MiddlewareHandler, J as CrudRouteKey, Jt as ApiResponse, K as ArcFieldRule, Kt as TokenPair, L as RequestWithExtras, M as EventsDecorator, N as FastifyRequestExtras, O as HealthOptions, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as UserLike, S as QueryParserInterface, St as RouteHandler, T as CrudRouterOptions, U as ActionEntry, Ut as Authenticator, Vt as AuthHelpers, W as ActionHandlerFn, Wt as AuthenticatorContext, X as EventDefinition, Xt as JWTPayload, Y as CrudSchemas, Yt as ArcRequest, Z as FieldRule, Zt as ObjectId, _ as ControllerQueryOptions, _t as ControllerLike, a as InferAdapterDoc, at as ResolvedTenantPurge, b as ParsedQuery, bt as IControllerResponse, c as TypedController, ct as ResourceExtensions, d as PaginationResult, dt as ResourcePermissions, et as OpenApiSchemas, f as IntrospectionData, ft as RouteDefinition, g as ArcInternalMetadata, gt as ControllerHandler, h as ResourceMetadata, ht as RouteSchemaOptions, i as ValidationResult, it as RateLimitConfig, j as ArcDecorator, k as IntrospectionPluginOptions, l as TypedRepository, lt as ResourceHookContext, m as RegistryStats, mt as RouteMethod, n as ConfigError, nt as PresetHook, o as InferDocType, ot as ResourceCacheConfig, p as RegistryEntry, pt as RouteMcpConfig, q as CrudController, qt as AnyRecord, r as ValidateOptions, rt as PresetResult, s as InferResourceDoc, st as ResourceConfig, t as RouteHandlerMethod, tt as PresetFunction, u as TypedResourceConfig, ut as ResourceHooks, v as LookupOption, vt as FastifyHandler, w as ServiceContext, x as PopulateOption, xt as IRequestContext, y as OwnershipCheck, yt as IController } from "../index-_--GyzcO.mjs";
-import { i as RequestScope } from "../types-LNebCoJx.mjs";
-import { c as PermissionCheck, d as UserBase, l as PermissionContext, u as PermissionResult } from "../fields-C7ahdGYf.mjs";
-import { n as ElevationOptions, t as ElevationEvent } from "../elevation-xGUBq6p_.mjs";
+import { $ as OpenApiSchemas, $t as UserOrganization, A as RequestIdOptions, At as RouteDefinition, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dt as ActionEntry, E as GracefulShutdownOptions, Et as ActionDefinition, F as FastifyWithDecorators, Fn as BaseControllerOptions, Ft as ControllerLike, G as OnTenantDeleteConfig, Gt as JwtContext, H as CrudController, Ht as AuthPluginOptions, I as MiddlewareHandler, It as FastifyHandler, J as PresetHook, Jt as ApiResponse, K as ResolvedTenantPurge, Kt as TokenPair, L as RequestWithExtras, Lt as IController, M as EventsDecorator, Mt as RouteMethod, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, Ot as ActionHandlerFn, P as FastifyWithAuth, Pt as ControllerHandler, Q as MiddlewareConfig, Qt as UserLike, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tt as ResourceCacheConfig, U as ResourceConfig, Ut as Authenticator, Vt as AuthHelpers, W as ResourcePermissions, Wt as AuthenticatorContext, X as CrudRouteKey, Xt as JWTPayload, Y as PresetResult, Yt as ArcRequest, Z as CrudSchemas, Zt as ObjectId, _ as ControllerQueryOptions, a as InferAdapterDoc, at as ResourceExtensions, b as ParsedQuery, c as TypedController, d as PaginationResult, et as RouteSchemaOptions, f as IntrospectionData, g as ArcInternalMetadata, h as ResourceMetadata, i as ValidationResult, it as ResourceHooks, j as ArcDecorator, jt as RouteMcpConfig, k as IntrospectionPluginOptions, kt as ActionsMap, l as TypedRepository, m as RegistryStats, n as ConfigError, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, q as PresetFunction, qt as AnyRecord, r as ValidateOptions, rt as ResourceHookContext, s as InferResourceDoc, t as RouteHandlerMethod, tt as ArcFieldRule, u as TypedResourceConfig, v as LookupOption, w as ServiceContext, x as PopulateOption, y as OwnershipCheck, zt as IRequestContext } from "../index-DbtgCOCj.mjs";
+import { i as RequestScope } from "../types-DH0GupI7.mjs";
+import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "../types-Csxga7d3.mjs";
+import { n as ElevationOptions, t as ElevationEvent } from "../elevation-C9s5hFP_.mjs";
 export type { ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AnyRecord, ApiResponse, ArcDecorator, ArcFieldRule, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OnTenantDeleteConfig, OpenApiSchemas, OwnershipCheck, PaginationResult, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResolvedTenantPurge, ResourceCacheConfig, ResourceConfig, ResourceExtensions, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult };

package/dist/types/storage.d.mts

@@ -1,2 +1,2 @@
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-Co_PQpeQ.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-DLUZ04kK.mjs";
 export { Storage, StorageContext, StorageFile, StorageReadRange, StorageReadResult, StorageUploadInput };

package/dist/{types-C9b2HR5W.d.mts → types-Bc42CUyk.d.mts}

@@ -1,6 +1,5 @@
-import { V as ResourceDefinition } from "./index-_--GyzcO.mjs";
+import { V as ResourceDefinition } from "./index-DbtgCOCj.mjs";
 import { z } from "zod";
-
 //#region src/integrations/mcp/types.d.ts
 /** Behavioral hints for MCP clients (tool annotations per MCP spec) */
 interface ToolAnnotations {

package/dist/types-Cc91nXuA.d.mts

@@ -0,0 +1,132 @@
+import { FastifyRequest } from "fastify";
+//#region src/encryption/types.d.ts
+/** JWE key-management algorithm — the protected-header `alg`. */
+type JweAlg = "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512" | "ECDH-ES" | "ECDH-ES+A256KW" | "A256GCMKW" | "dir";
+/** JWE content-encryption algorithm — the protected-header `enc`. AEAD only. */
+type JweEnc = "A128GCM" | "A192GCM" | "A256GCM";
+/** Encryption strategy for a route's response. */
+type EncryptionMode = "jwe" | "fields";
+/**
+ * Opaque key material. For `jwe` mode this is a `jose` `KeyLike` /
+ * `CryptoKey` / `Uint8Array`; for `fields` mode a 32-byte secret
+ * (`Buffer` / `Uint8Array`). Kept `unknown` at the contract layer so the
+ * `KeyProvider` interface carries no hard `jose` type dependency — hosts
+ * without `jose` installed can still implement field-mode providers.
+ */
+type KeyMaterial = unknown;
+/** A key paired with its identifier — what encrypt operations consume. */
+interface ActiveKey {
+  /** Key id, stamped into the JWE `kid` header / field envelope for rotation. */
+  readonly kid: string;
+  /** The key material (public key for JWE, 32-byte secret for fields). */
+  readonly key: KeyMaterial;
+  /** Optional per-key `alg` override (else the plugin default applies). */
+  readonly alg?: JweAlg;
+}
+/** Context handed to the key provider so resolution can be request-scoped. */
+interface KeyContext {
+  readonly request: FastifyRequest;
+}
+type MaybePromise<T> = T | Promise<T>;
+/**
+ * Pluggable key resolution. Arc owns the request-time plumbing — `kid` →
+ * key, algorithm allowlist enforcement; the host owns the trust store —
+ * which keys are valid and where they live (file / env / AWS KMS / GCP KMS
+ * / Vault). Encryption and decryption are deliberately separate operations
+ * because they often use DIFFERENT keys (JWE: a public key encrypts the
+ * outbound response, a private key by `kid` decrypts the inbound request —
+ * exactly Visa's two-key-pair model).
+ *
+ * Rotation mirrors `@fastify/secure-session`: the active key encrypts; any
+ * key resolvable by `kid` can decrypt, so you can roll keys without dropping
+ * in-flight traffic.
+ */
+interface KeyProvider {
+  /** Active key for encrypting OUTBOUND responses. */
+  encryptionKey(ctx: KeyContext): MaybePromise<ActiveKey>;
+  /** Resolve a DECRYPTION key by the inbound message's `kid`. */
+  decryptionKey(kid: string, ctx: KeyContext): MaybePromise<KeyMaterial | undefined>;
+}
+/**
+ * Per-resource encryption directive — the typed slice plugins register on
+ * `ResourceExtensions`. Declared on a resource via
+ * `defineResource({ extensions: { encryption: { … } } })`; arc threads it
+ * to request time on `request.routeOptions.config.arcExtensions.encryption`.
+ */
+interface EncryptionDirective {
+  /** Strategy. Defaults to the plugin-level `mode` (default `'jwe'`). */
+  readonly mode?: EncryptionMode;
+  /**
+   * For `mode: 'fields'` — dot-paths of fields to encrypt, resolved against
+   * the serialized response body (e.g. `'cardNumber'`, `'account.iban'`).
+   * Ignored for `mode: 'jwe'` (the whole body is encrypted).
+   */
+  readonly fields?: readonly string[];
+  /**
+   * Explicit opt-out — set `false` to disable encryption for this resource
+   * even when a plugin-level default (`routes`) would otherwise apply.
+   */
+  readonly enabled?: boolean;
+}
+/**
+ * Plugin-level options. `keyProvider` is the only required field; everything
+ * else has a secure default.
+ */
+interface EncryptionOptions {
+  /**
+   * Master on/off. Default `true`. Set `false` to register the plugin as a
+   * typed no-op (config-gated environments) — same pattern as
+   * `idempotencyPlugin`.
+   */
+  readonly enabled?: boolean;
+  /** Key provider — resolves `kid` → key for encrypt/decrypt. Required. */
+  readonly keyProvider: KeyProvider;
+  /** Default mode when a route opts in without naming one. Default `'jwe'`. */
+  readonly mode?: EncryptionMode;
+  /** JWE key-management algorithm. Default `'RSA-OAEP-256'`. */
+  readonly alg?: JweAlg;
+  /** JWE content-encryption algorithm. Default `'A256GCM'`. */
+  readonly enc?: JweEnc;
+  /**
+   * Inbound-decryption algorithm allowlists — block algorithm-substitution
+   * downgrade attacks. Default `[alg]` / `[enc]`. Set explicitly only when a
+   * client legitimately uses more than one algorithm.
+   */
+  readonly allowedAlgs?: readonly JweAlg[];
+  readonly allowedEncs?: readonly JweEnc[];
+  /**
+   * Fallback opt-in for routes that don't declare
+   * `extensions.encryption`. Return a directive (or `true` for the default
+   * mode) to encrypt, `false`/`undefined` to skip. The per-resource
+   * `extensions.encryption` ALWAYS wins when present. Use this to scope ALE
+   * to sensitive prefixes without touching every resource.
+   *
+   * @example confine ALE to `/payments` and `/accounts`
+   * ```ts
+   * routes: (req) => /^\/(payments|accounts)\b/.test(req.url)
+   * ```
+   */
+  readonly routes?: (request: FastifyRequest) => EncryptionDirective | boolean | undefined;
+  /** Decrypt inbound `application/jose` request bodies. Default `true`. */
+  readonly decryptRequests?: boolean;
+  /** Media type that signals an encrypted REQUEST body. Default `'application/jose'`. */
+  readonly contentType?: string;
+  /** Content-Type set on full-body JWE RESPONSES. Default `'application/jose'`. */
+  readonly responseContentType?: string;
+  /**
+   * Response header advertising that the body is encrypted, so generic
+   * client SDKs know to decrypt. Default `'x-encrypted'`; set `false` to omit.
+   */
+  readonly flagHeader?: string | false;
+}
+/** Request decorations added by the plugin. */
+declare module "fastify" {
+  interface FastifyRequest {
+    /** `true` when the inbound body was decrypted from a JWE by this plugin. */
+    requestDecrypted?: boolean;
+    /** `true` when the outbound body was encrypted by this plugin. */
+    responseEncrypted?: boolean;
+  }
+}
+//#endregion
+export { JweAlg as a, KeyMaterial as c, EncryptionOptions as i, KeyProvider as l, EncryptionDirective as n, JweEnc as o, EncryptionMode as r, KeyContext as s, ActiveKey as t };

package/dist/{fields-C7ahdGYf.d.mts → types-Csxga7d3.d.mts}

@@ -1,6 +1,5 @@
-import { i as RequestScope } from "./types-LNebCoJx.mjs";
+import { i as RequestScope } from "./types-DH0GupI7.mjs";
 import { FastifyRequest } from "fastify";
-
 //#region src/permissions/types.d.ts
 /**
  * User base interface - minimal shape Arc expects
@@ -196,124 +195,4 @@ interface PermissionCheckMeta {
   };
 }
 //#endregion
-//#region src/permissions/fields.d.ts
-/**
- * Field-Level Permissions
- *
- * Control field visibility and writability per role.
- * Integrated into the response path (read) and sanitization path (write).
- *
- * @example
- * ```typescript
- * import { fields, defineResource } from '@classytic/arc';
- *
- * const userResource = defineResource({
- *   name: 'user',
- *   adapter: userAdapter,
- *   fields: {
- *     salary: fields.visibleTo(['admin', 'hr']),
- *     internalNotes: fields.writableBy(['admin']),
- *     email: fields.redactFor(['viewer']),
- *     password: fields.hidden(),
- *   },
- * });
- * ```
- */
-type FieldPermissionType = "hidden" | "visibleTo" | "writableBy" | "redactFor";
-interface FieldPermission {
-  readonly _type: FieldPermissionType;
-  readonly roles?: readonly string[];
-  readonly redactValue?: unknown;
-}
-type FieldPermissionMap = Record<string, FieldPermission>;
-declare const fields: {
-  /**
-   * Field is never included in responses. Not writable via API.
-   *
-   * @example
-   * ```typescript
-   * fields: { password: fields.hidden() }
-   * ```
-   */
-  hidden(): FieldPermission;
-  /**
-   * Field is only visible to users with specified roles.
-   * Other users don't see the field at all.
-   *
-   * @example
-   * ```typescript
-   * fields: { salary: fields.visibleTo(['admin', 'hr']) }
-   * ```
-   */
-  visibleTo(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is only writable by users with specified roles.
-   * All users can still read the field. Users without the role
-   * have the field silently stripped from write operations.
-   *
-   * @example
-   * ```typescript
-   * fields: { role: fields.writableBy(['admin']) }
-   * ```
-   */
-  writableBy(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is redacted (replaced with a placeholder) for specified roles.
-   * Other users see the real value.
-   *
-   * @param roles - Roles that see the redacted value
-   * @param redactValue - Replacement value (default: '***')
-   *
-   * @example
-   * ```typescript
-   * fields: {
-   *   email: fields.redactFor(['viewer']),
-   *   ssn: fields.redactFor(['basic'], '***-**-****'),
-   * }
-   * ```
-   */
-  redactFor(roles: readonly string[], redactValue?: unknown): FieldPermission;
-};
-/**
- * Apply field-level READ permissions to a response object.
- * Strips hidden fields, enforces visibility, and applies redaction.
- *
- * @param data - The response object (mutated in place for performance)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles (empty array for unauthenticated)
- * @returns The filtered object
- */
-declare function applyFieldReadPermissions<T extends Record<string, unknown>>(data: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): T;
-/**
- * Result of applying write permissions — includes both the filtered body
- * and the list of fields that were stripped so callers can decide whether
- * to reject the request (secure default) or silently strip (legacy).
- */
-interface FieldWritePermissionResult<T extends Record<string, unknown>> {
-  readonly body: T;
-  readonly deniedFields: readonly string[];
-}
-/**
- * Apply field-level WRITE permissions to request body.
- *
- * Returns both the filtered body and the list of denied fields. Callers are
- * expected to reject the request when `deniedFields.length > 0` — silently
- * stripping fields hides misconfigurations and real attacks. See
- * `BodySanitizer` for the default policy.
- *
- * @param body - The request body (returns a new filtered copy)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles
- */
-declare function applyFieldWritePermissions<T extends Record<string, unknown>>(body: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): FieldWritePermissionResult<T>;
-/**
- * Resolve effective roles by merging global user roles with org-level roles.
- *
- * Global roles come from `req.user.role` (normalized via getUserRoles()).
- * Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
- *
- * When no org context exists, returns global roles only — backward compatible.
- */
-declare function resolveEffectiveRoles(userRoles: readonly string[], orgRoles: readonly string[]): string[];
-//#endregion
-export { applyFieldWritePermissions as a, PermissionCheck as c, UserBase as d, getUserRoles as f, applyFieldReadPermissions as i, PermissionContext as l, FieldPermissionMap as n, fields as o, normalizeRoles as p, FieldPermissionType as r, resolveEffectiveRoles as s, FieldPermission as t, PermissionResult as u };
+export { getUserRoles as a, UserBase as i, PermissionContext as n, normalizeRoles as o, PermissionResult as r, PermissionCheck as t };

package/dist/{types-LNebCoJx.d.mts → types-DH0GupI7.d.mts}

@@ -168,8 +168,10 @@ type RequestScope = {
   kind: "service";
   clientId: string;
   organizationId: string;
-  scopes?: readonly string[]; /** App-defined scope dimensions — see `member.context` for details. */
-  context?: Readonly<Record<string, string>>; /** Parent organizations — see `member.ancestorOrgIds` for details. */
+  scopes?: readonly string[];
+  /** App-defined scope dimensions — see `member.context` for details. */
+  context?: Readonly<Record<string, string>>;
+  /** Parent organizations — see `member.ancestorOrgIds` for details. */
   ancestorOrgIds?: readonly string[];
   /**
    * Capability mandate — narrows what the caller may do beyond OAuth `scopes`.
@@ -207,8 +209,10 @@ type RequestScope = {
   kind: "elevated";
   userId?: string;
   organizationId?: string;
-  elevatedBy: string; /** App-defined scope dimensions — see `member.context` for details. */
-  context?: Readonly<Record<string, string>>; /** Parent organizations — see `member.ancestorOrgIds` for details. */
+  elevatedBy: string;
+  /** App-defined scope dimensions — see `member.context` for details. */
+  context?: Readonly<Record<string, string>>;
+  /** Parent organizations — see `member.ancestorOrgIds` for details. */
   ancestorOrgIds?: readonly string[];
 };
 /** Check if scope is `member` kind */