@classytic/arc 2.21.0 → 2.23.0

package/dist/{core-DZ6Xe1jR.mjs → core-DQ6rDTyH.mjs}

@@ -2,16 +2,17 @@ import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DN
 import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { M as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-CO8a3B_1.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-BnLYgE9A.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as buildAuthMiddleware } from "./registerRoute-oGAl0oA8.mjs";
-import { I as applyFieldWritePermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-BQ8KNvWC.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
+import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
-import { t as applyPresets } from "./presets-gw0ciIUD.mjs";
-import { n as convertRouteSchema, t as convertOpenApiSchemas } from "./schemaConverter-U0MnO9vd.mjs";
+import { t as applyPresets } from "./presets-BOe4Ugkl.mjs";
+import { D as requireAuth } from "./permissions-tbxFHxjZ.mjs";
+import { N as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-CZyeRXTh.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-DJvodiHj.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-lszoJle1.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 //#region src/core/middlewares/fieldWrite.ts
 /**
@@ -151,7 +152,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			const fieldWriteMw = buildFieldWritePreHandler(fieldPermissions, onFieldWriteDenied);
 			if (fieldWriteMw) customPreHandlers.push(fieldWriteMw);
 		}
-		const preHandler = buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			preAuth: route.preAuth ?? [],
 			arcDecorator,
 			authMw: buildAuthMiddleware(fastify, route.permissions),
@@ -165,7 +166,7 @@ function createCustomRoutes(fastify, routes, controller, options) {
 			method: route.method,
 			url: route.path,
 			schema,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions(hooks),
 			handler: isStream ? async (request, reply) => {
 				reply.raw.setHeader("Content-Type", "text/event-stream");
 				reply.raw.setHeader("Cache-Control", "no-cache");
@@ -274,7 +275,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 		for (const spec of crudTable) {
 			if (disabledRoutes.includes(spec.op)) continue;
 			const permission = permissions[spec.op];
-			const preHandler = buildPreHandlerChain({
+			const hooks = buildRouteHooks({
 				arcDecorator,
 				authMw: buildAuthMiddleware(fastify, permission),
 				permissionMw: buildCrudPermissionMw(permission, resourceName, spec.op),
@@ -293,7 +294,7 @@ function createCrudRouter(fastify, controller, options = {}) {
 						summary,
 						...spec.hasIdParams ? { params: idParamsSchema } : {}
 					}, defaultSchemas[spec.op], schemas[spec.op]),
-					preHandler: preHandler.length > 0 ? preHandler : void 0,
+					...routeHookOptions(hooks),
 					handler: handlers[spec.op],
 					...buildRouteConfig(rateLimitConfig, extensions)
 				}, {
@@ -359,6 +360,58 @@ function defineAction(config) {
 	};
 }
 //#endregion
+//#region src/core/defineResource/seams.ts
+/** Plain object test — literals only; class instances must replace, not merge. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
+function mergePlain(base, next) {
+	const out = { ...base };
+	for (const [key, value] of Object.entries(next)) {
+		if (value === void 0) continue;
+		const existing = out[key];
+		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
+	}
+	return out;
+}
+/**
+* Canonical slot-aware merge of a base resource config with host seams.
+* Later seams win over earlier ones; `undefined` values never clobber.
+*
+* Merge semantics (value-driven — no per-slot registry to drift):
+*
+*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+*     `routeGuards`, `disabledRoutes`: additive collections, base first.
+*   - **Plain objects merge recursively** — `permissions`, `actions`,
+*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+*     them replace (they're value lists — enums, sort specs), not concat.
+*   - **Everything else last-wins** — class instances (`adapter`,
+*     `controller`, `queryParser`), functions, scalars.
+*
+* The single `as` at the return is the one documented erasure for the
+* {@link AdapterLike}-widened seam slots — inside the helper so no module
+* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+*/
+function mergeResourceConfig(base, ...seams) {
+	const out = { ...base };
+	for (const seam of seams) {
+		if (!seam) continue;
+		for (const [key, value] of Object.entries(seam)) {
+			if (value === void 0) continue;
+			const existing = out[key];
+			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
+			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
+			else if (Array.isArray(value)) out[key] = [...value];
+			else out[key] = value;
+		}
+	}
+	return out;
+}
+//#endregion
 //#region src/core/defineResource/controller.ts
 /**
 * Phase 4 — pick (or auto-create) the resource's controller.
@@ -652,7 +705,7 @@ function resolveIdField(config, repository) {
 * enabled but no adapter" (a confusing false-positive error).
 */
 function normalizeResourceConfig(config) {
-	return resolveCrudAllowList(expandCustomRoutesOnly(expandReferenceData(config)));
+	return resolveCrudAllowList(expandHistory(expandCustomRoutesOnly(expandReferenceData(config))));
 }
 /**
 * Expand the `referenceData: true` shorthand. Reference data is the
@@ -706,6 +759,61 @@ function expandCustomRoutesOnly(config) {
 	};
 }
 /**
+* Expand the 2.22 `history: true` shorthand — the per-record change
+* timeline. Injects `GET /:id/history` (audit-entry page for one
+* document, newest-first per the audit store's contract) and implies
+* `audit: true` so the rows the route reads actually get written.
+*
+* The gate defaults STRICTER than reads (history exposes before/after
+* snapshots): resource `update` permission → `get` → route auth.
+* `history: { permissions }` overrides. The flag is CONSUMED here
+* (set to undefined) — later phases and the registry see only its
+* expansion, same contract as `customRoutesOnly`.
+*/
+function expandHistory(config) {
+	if (!config.history) return config;
+	const opts = config.history === true ? {} : config.history;
+	const permissions = opts.permissions ?? config.permissions?.update ?? config.permissions?.get ?? requireAuth();
+	const defaultLimit = opts.limit ?? 50;
+	const resourceName = config.name;
+	const historyRoute = {
+		method: "GET",
+		path: "/:id/history",
+		summary: `Change history for a ${resourceName} record (audit-backed timeline)`,
+		raw: true,
+		handler: async (request, reply) => {
+			const audit = request.server.audit;
+			if (!audit?.query || audit._noop === true) return reply.code(503).send({
+				code: "history.audit_unavailable",
+				message: `history for '${resourceName}' requires auditPlugin to be registered (and enabled)`,
+				status: 503
+			});
+			const { id } = request.params;
+			const q = request.query;
+			const limit = Math.min(Number(q.limit) > 0 ? Number(q.limit) : defaultLimit, 200);
+			const offset = Number(q.offset) > 0 ? Number(q.offset) : 0;
+			const entries = await audit.query({
+				resource: resourceName,
+				documentId: id,
+				limit,
+				offset
+			});
+			return reply.send({
+				data: entries,
+				limit,
+				offset
+			});
+		},
+		permissions
+	};
+	return {
+		...config,
+		history: void 0,
+		audit: config.audit ?? true,
+		routes: [...config.routes ?? [], historyRoute]
+	};
+}
+/**
 * Normalise the 2.16 `crud:` positive-form allow-list into the canonical
 * `{ disabledRoutes, disableDefaultRoutes }` pair the rest of arc reads.
 *
@@ -1221,7 +1329,8 @@ function normalizeActionsToRouterConfig(actions, resourceActionPermissions, tag,
 * Fastify instance via `resource._sharedStateRegisteredOn`.
 */
 function buildResourcePlugin(resource) {
-	return async function resourcePlugin(fastify, _opts) {
+	return async function resourcePlugin(fastify, opts) {
+		await ensureSchemaConverter();
 		const sharedRoot = fastify.server;
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
@@ -1257,6 +1366,7 @@ function buildResourcePlugin(resource) {
 				fastify.log?.warn?.(`[Arc] Resource '${resource.name}' declares events (${eventNames}) but \`eventPlugin\` is not registered. The events will silently NOT be emitted on CRUD mutations. Either register the plugin (\`await fastify.register(eventPlugin, { transport: ... })\`) or remove the \`events\` declaration from the resource.`);
 			}
 		}
+		if (opts?.arcMountRoutes === false) return;
 		await fastify.register(async (instance) => {
 			const typedInstance = instance;
 			let schemas = buildGeneratedCrudSchemas(resource._registryMeta?.openApiSchemas, resource.customSchemas);
@@ -1286,7 +1396,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-BWMDW-dL.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-BuOv-m4Y.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1301,7 +1411,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-l5mNdYrZ.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-CgJv_BU_.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -1913,58 +2023,6 @@ function defineResource(config) {
 	return resource;
 }
 //#endregion
-//#region src/core/defineResource/seams.ts
-/** Plain object test — literals only; class instances must replace, not merge. */
-function isPlainObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
-function mergePlain(base, next) {
-	const out = { ...base };
-	for (const [key, value] of Object.entries(next)) {
-		if (value === void 0) continue;
-		const existing = out[key];
-		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
-	}
-	return out;
-}
-/**
-* Canonical slot-aware merge of a base resource config with host seams.
-* Later seams win over earlier ones; `undefined` values never clobber.
-*
-* Merge semantics (value-driven — no per-slot registry to drift):
-*
-*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
-*     `routeGuards`, `disabledRoutes`: additive collections, base first.
-*   - **Plain objects merge recursively** — `permissions`, `actions`,
-*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
-*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
-*     them replace (they're value lists — enums, sort specs), not concat.
-*   - **Everything else last-wins** — class instances (`adapter`,
-*     `controller`, `queryParser`), functions, scalars.
-*
-* The single `as` at the return is the one documented erasure for the
-* {@link AdapterLike}-widened seam slots — inside the helper so no module
-* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
-*/
-function mergeResourceConfig(base, ...seams) {
-	const out = { ...base };
-	for (const seam of seams) {
-		if (!seam) continue;
-		for (const [key, value] of Object.entries(seam)) {
-			if (value === void 0) continue;
-			const existing = out[key];
-			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
-			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
-			else if (Array.isArray(value)) out[key] = [...value];
-			else out[key] = value;
-		}
-	}
-	return out;
-}
-//#endregion
 //#region src/core/defineResourceVariants.ts
 /**
 * Define multiple resources from a shared base config and per-variant overrides.
@@ -2063,4 +2121,4 @@ function getEntityQuery(req) {
 	return { [getEntityIdField(req)]: id };
 }
 //#endregion
-export { mergeResourceConfig as a, defineAction as c, defineAggregation as d, defineResourceVariants as i, createCrudRouter as l, getEntityIdField as n, defineResource as o, getEntityQuery as r, ResourceDefinition as s, getEntityId as t, createPermissionMiddleware as u };
+export { defineResource as a, defineAction as c, defineAggregation as d, defineResourceVariants as i, createCrudRouter as l, getEntityIdField as n, ResourceDefinition as o, getEntityQuery as r, mergeResourceConfig as s, getEntityId as t, createPermissionMiddleware as u };

package/dist/{createActionRouter-BWMDW-dL.mjs → createActionRouter-BuOv-m4Y.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, d as buildAuthMiddlewareForPermissions, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, r as buildRouteConfig, t as tryRegisterRoute } from "./registerRoute-oGAl0oA8.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-ze70xXJi.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-ajetw3Fv.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-lszoJle1.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
@@ -108,19 +108,23 @@ function createActionRouter(fastify, config) {
 			scopedError.meta = { action: submitted };
 			throw scopedError;
 		};
-		const preHandler = [actionValidationFormatter, ...buildPreHandlerChain({
+		const hooks = buildRouteHooks({
 			arcDecorator,
 			authMw,
 			permissionMw,
 			pluginMw: selectPluginMw("POST", pluginMw),
 			routeGuards
-		})];
+		});
+		const preHandler = [actionValidationFormatter, ...hooks.preHandler];
 		tryRegisterRoute(fastify, {
 			method: "POST",
 			url: urlPath,
 			schema: routeSchema,
 			attachValidation: true,
-			preHandler: preHandler.length > 0 ? preHandler : void 0,
+			...routeHookOptions({
+				onRequest: hooks.onRequest,
+				preHandler
+			}),
 			...buildRouteConfig(rateLimitConfig, extensions),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;

package/dist/{createAggregationRouter-l5mNdYrZ.mjs → createAggregationRouter-CgJv_BU_.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildPreHandlerChain, f as buildArcDecorator, i as resolveRouterPluginMw, n as buildRateLimitConfig, u as buildAuthMiddleware } from "./registerRoute-oGAl0oA8.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
@@ -48,7 +48,7 @@ function registerOne(fastify, normalized, ctx) {
 			throw new ForbiddenError(reason ?? "You do not have permission to access this aggregation.");
 		}
 	};
-	const preHandler = buildPreHandlerChain({
+	const hooks = buildRouteHooks({
 		arcDecorator,
 		authMw,
 		permissionMw,
@@ -73,7 +73,7 @@ function registerOne(fastify, normalized, ctx) {
 		method: "GET",
 		url: `/aggregations/${name}`,
 		schema: routeSchema,
-		preHandler: preHandler.length > 0 ? preHandler : void 0,
+		...routeHookOptions(hooks),
 		...rateLimitConfig ? { config: rateLimitConfig } : {},
 		handler: async (req, reply) => {
 			try {