@classytic/arc 2.22.0 → 2.23.0

package/dist/{BaseController-C6FlRWxF.mjs → BaseController-BQ8KNvWC.mjs}

@@ -2,9 +2,10 @@ import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { F as simpleEqualityMatcher, _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-FhJ88TJE.mjs";
-import { I as applyFieldWritePermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
+import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
+import { _ as ArcQueryParser, r as scheduleBackground, t as getUserId } from "./utils-CZyeRXTh.mjs";
 import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
 //#region src/core/AccessControl.ts
 const log = arcLog("access-control");

package/dist/{ResourceRegistry-7RnrEWNP.mjs → ResourceRegistry-y9Hnypus.mjs}

@@ -71,6 +71,7 @@ var ResourceRegistry = class {
 			disabledRoutes: resource.disabledRoutes ? [...resource.disabledRoutes] : void 0,
 			openApiSchemas: options.openApiSchemas,
 			fieldPermissions: extractFieldPermissions(resource.fields),
+			fields: resource.fields && Object.keys(resource.fields).length > 0 ? resource.fields : void 0,
 			pipelineSteps: extractPipelineSteps(resource.pipe),
 			rateLimit: resource.rateLimit,
 			audit: resource.audit,

package/dist/{actionPermissions-ze70xXJi.mjs → actionPermissions-lszoJle1.mjs}

@@ -1,5 +1,5 @@
 import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { F as applyFieldReadPermissions, R as resolveEffectiveRoles } from "./permissions-BJMuKMl7.mjs";
+import { i as applyFieldReadPermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";

package/dist/applyPermissionResult-Tw4iXtlf.mjs

@@ -0,0 +1,264 @@
+//#region src/permissions/fields.ts
+/**
+* Field-Level Permissions
+*
+* Control field visibility and writability per role.
+* Integrated into the response path (read) and sanitization path (write).
+*
+* @example
+* ```typescript
+* import { fields, defineResource } from '@classytic/arc';
+*
+* const userResource = defineResource({
+*   name: 'user',
+*   adapter: userAdapter,
+*   fields: {
+*     salary: fields.visibleTo(['admin', 'hr']),
+*     internalNotes: fields.writableBy(['admin']),
+*     email: fields.redactFor(['viewer']),
+*     password: fields.hidden(),
+*   },
+* });
+* ```
+*/
+/** Type guard for Mongoose-like documents with toObject() */
+function isMongooseDoc(obj) {
+	return !!obj && typeof obj === "object" && "toObject" in obj && typeof obj.toObject === "function";
+}
+const fields = {
+	/**
+	* Field is never included in responses. Not writable via API.
+	*
+	* @example
+	* ```typescript
+	* fields: { password: fields.hidden() }
+	* ```
+	*/
+	hidden() {
+		return { _type: "hidden" };
+	},
+	/**
+	* Field is only visible to users with specified roles.
+	* Other users don't see the field at all.
+	*
+	* @example
+	* ```typescript
+	* fields: { salary: fields.visibleTo(['admin', 'hr']) }
+	* ```
+	*/
+	visibleTo(roles) {
+		return {
+			_type: "visibleTo",
+			roles
+		};
+	},
+	/**
+	* Field is only writable by users with specified roles.
+	* All users can still read the field. Users without the role
+	* have the field silently stripped from write operations.
+	*
+	* @example
+	* ```typescript
+	* fields: { role: fields.writableBy(['admin']) }
+	* ```
+	*/
+	writableBy(roles) {
+		return {
+			_type: "writableBy",
+			roles
+		};
+	},
+	/**
+	* Field is redacted (replaced with a placeholder) for specified roles.
+	* Other users see the real value.
+	*
+	* @param roles - Roles that see the redacted value
+	* @param redactValue - Replacement value (default: '***')
+	*
+	* @example
+	* ```typescript
+	* fields: {
+	*   email: fields.redactFor(['viewer']),
+	*   ssn: fields.redactFor(['basic'], '***-**-****'),
+	* }
+	* ```
+	*/
+	redactFor(roles, redactValue = "***") {
+		return {
+			_type: "redactFor",
+			roles,
+			redactValue
+		};
+	}
+};
+/**
+* Apply field-level READ permissions to a response object.
+* Strips hidden fields, enforces visibility, and applies redaction.
+*
+* @param data - The response object (mutated in place for performance)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles (empty array for unauthenticated)
+* @returns The filtered object
+*/
+function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
+	if (!data || typeof data !== "object") return data;
+	const result = { ...isMongooseDoc(data) ? data.toObject() : data };
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			delete result[field];
+			break;
+		case "visibleTo":
+			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
+			break;
+		case "redactFor":
+			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
+			break;
+		case "writableBy": break;
+	}
+	return result;
+}
+/**
+* Apply field-level WRITE permissions to request body.
+*
+* Returns both the filtered body and the list of denied fields. Callers are
+* expected to reject the request when `deniedFields.length > 0` — silently
+* stripping fields hides misconfigurations and real attacks. See
+* `BodySanitizer` for the default policy.
+*
+* @param body - The request body (returns a new filtered copy)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles
+*/
+function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
+	const result = { ...body };
+	const deniedFields = [];
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			if (field in result) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+		case "writableBy":
+			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+	}
+	return {
+		body: result,
+		deniedFields
+	};
+}
+/**
+* Resolve effective roles by merging global user roles with org-level roles.
+*
+* Global roles come from `req.user.role` (normalized via getUserRoles()).
+* Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
+*
+* When no org context exists, returns global roles only — backward compatible.
+*/
+function resolveEffectiveRoles(userRoles, orgRoles) {
+	if (orgRoles.length === 0) return [...userRoles];
+	if (userRoles.length === 0) return [...orgRoles];
+	return [.../* @__PURE__ */ new Set([...userRoles, ...orgRoles])];
+}
+//#endregion
+//#region src/permissions/applyPermissionResult.ts
+/**
+* Normalize a permission check return value (`boolean | PermissionResult`)
+* into a concrete `PermissionResult`. This is the only place in Arc that
+* promotes booleans to results — keeps the type narrowing honest everywhere.
+*/
+function normalizePermissionResult(result) {
+	if (typeof result === "boolean") return { granted: result };
+	return result;
+}
+/**
+* Apply a granted `PermissionResult` to a Fastify request — merges row-level
+* filters into `_policyFilters` and conditionally installs the scope.
+*
+* **Scope install rule:** only writes `scope` when the current request scope
+* is absent or `public`. This prevents downgrading an already-authenticated
+* request (e.g. Better Auth set `member`, then a permission check returns a
+* narrower `service` scope — the original `member` wins because it came from
+* a more authoritative source).
+*
+* Safe to call with a non-granted result — it simply no-ops. Callers should
+* still check `result.granted` and send an error response before reaching here,
+* but this function tolerates the misuse defensively.
+*/
+function applyPermissionResult(result, request) {
+	if (!result.granted) return;
+	if (result.filters) request._policyFilters = {
+		...request._policyFilters ?? {},
+		...result.filters
+	};
+	if (result.scope) {
+		const current = request.scope;
+		if (!current || current.kind === "public") request.scope = result.scope;
+	}
+}
+/**
+* Max length of a `PermissionResult.reason` string before we fall back to the
+* generic default message. Upstream checks can return arbitrary strings; we
+* clamp to prevent accidental leakage of internal diagnostics or oversized
+* payloads via the 4xx response body.
+*/
+const MAX_DENIAL_REASON_LENGTH = 100;
+/**
+* End-to-end evaluator: runs the permission check, catches throws, normalizes
+* the result, sends a 401/403 response on denial, and applies side-effects on
+* grant. Returns `true` if the caller should continue, `false` if a response
+* has been sent and the caller should return.
+*
+* This is the single source of truth for the 5-step sequence shared by the
+* CRUD router, action router, and MCP tool handlers:
+*
+*   1. `try { await check(ctx) } catch { reply 403 }`
+*   2. `normalizePermissionResult(result)`
+*   3. If denied → 401 (no user) or 403 (user) with clamped reason
+*   4. If granted → `applyPermissionResult` (filters + scope)
+*   5. Return true/false so the caller knows whether to keep going
+*
+* Context construction, pre-check auth gating, and success-path handler
+* invocation stay at the callsite — those are genuinely different per router
+* and don't belong here.
+*
+* @returns `true` if authorized (caller continues), `false` if a response was sent
+*/
+async function evaluateAndApplyPermission(check, context, request, reply, opts) {
+	let result;
+	try {
+		result = await check(context);
+	} catch (err) {
+		request.log?.warn?.({
+			err,
+			resource: context.resource,
+			action: context.action
+		}, "Permission check threw");
+		reply.code(403).send({
+			code: "arc.forbidden",
+			message: "Permission denied",
+			status: 403
+		});
+		return false;
+	}
+	const permResult = normalizePermissionResult(result);
+	if (!permResult.granted) {
+		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
+		const reason = permResult.reason && permResult.reason.length <= MAX_DENIAL_REASON_LENGTH ? permResult.reason : defaultMsg;
+		const status = context.user ? 403 : 401;
+		reply.code(status).send({
+			code: context.user ? "arc.forbidden" : "arc.unauthorized",
+			message: reason,
+			status
+		});
+		return false;
+	}
+	applyPermissionResult(permResult, request);
+	return true;
+}
+//#endregion
+export { applyFieldWritePermissions as a, applyFieldReadPermissions as i, evaluateAndApplyPermission as n, fields as o, normalizePermissionResult as r, resolveEffectiveRoles as s, applyPermissionResult as t };

package/dist/audit/index.d.mts

@@ -1,4 +1,4 @@
-import "../index-DbtgCOCj.mjs";
+import "../index-BBsvQt7U.mjs";
 import { i as UserBase } from "../types-Csxga7d3.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";

package/dist/auth/index.d.mts

@@ -1,4 +1,4 @@
-import { Ht as AuthPluginOptions, Vt as AuthHelpers } from "../index-DbtgCOCj.mjs";
+import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-BBsvQt7U.mjs";
 import { t as PermissionCheck } from "../types-Csxga7d3.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";

package/dist/auth/index.mjs

@@ -1,7 +1,7 @@
 import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as ArcError } from "../errors-DkO8Nk6-.mjs";
-import { h as requireOrgRole, m as requireOrgMembership, v as requireTeamMembership } from "../permissions-BJMuKMl7.mjs";
 import { n as normalizeRoles, t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { o as toJsonSchema } from "../schemaConverter-Ds5reSGs.mjs";
+import { _ as requireOrgMembership, v as requireOrgRole, x as requireTeamMembership } from "../permissions-tbxFHxjZ.mjs";
+import { o as toJsonSchema } from "../schemaConverter-DJvodiHj.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DbtgCOCj.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-BBsvQt7U.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,5 +1,5 @@
 import { t as CRUD_OPERATIONS } from "../../constants-DNre0wRg.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-7RnrEWNP.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-y9Hnypus.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,5 @@
-import { t as buildOpenApiSpec } from "../../openapi-BRpMZD7C.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-OMCvIEE7.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-jSDx-VDv.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-DleK3p9f.mjs";
+import { t as init } from "../../init-CjO4p_q1.mjs";
 export { init };

package/dist/cli/commands/introspect.mjs

@@ -1,4 +1,4 @@
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-OMCvIEE7.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.mjs

@@ -2,6 +2,6 @@ import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
 import { t as generate } from "../generate-usRSdQmP.mjs";
-import { t as init } from "../init-DleK3p9f.mjs";
+import { t as init } from "../init-CjO4p_q1.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { B as defineResource, Bn as BodySanitizerConfig, Fn as BaseControllerOptions, In as ControllerConfigurableOptions, Ln as ControllerConstructionOptions, Rn as ListResult, V as ResourceDefinition, an as SlugExt, cn as BulkMixin, ct as AggMeasureShorthand, dn as QueryResolverConfig, dt as AggregationDateRangeRequirement, en as BaseController, fn as AccessControl, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as TreeMixin, ln as BaseCrudController, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as SoftDeleteMixin, on as SlugMixin, pn as AccessControlConfig, pt as AggregationMaterializedContext, rn as TreeExt, sn as BulkExt, st as AggMeasureInput, tn as SoftDeleteExt, un as QueryResolver, ut as AggregationConfig, zn as BodySanitizer } from "../index-DbtgCOCj.mjs";
-import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-D8MKYGDa.mjs";
+import { B as defineResource, Bn as BodySanitizer, In as BaseControllerOptions, Ln as ControllerConfigurableOptions, Rn as ControllerConstructionOptions, V as ResourceDefinition, Vn as BodySanitizerConfig, an as TreeMixin, cn as BulkExt, ct as AggMeasureShorthand, dn as QueryResolver, dt as AggregationDateRangeRequirement, fn as QueryResolverConfig, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as TreeExt, ln as BulkMixin, lt as AggregationCacheConfig, mn as AccessControlConfig, mt as AggregationMaterializedResult, nn as SoftDeleteExt, on as SlugExt, pn as AccessControl, pt as AggregationMaterializedContext, rn as SoftDeleteMixin, sn as SlugMixin, st as AggMeasureInput, tn as BaseController, un as BaseCrudController, ut as AggregationConfig, zn as ListResult } from "../index-BBsvQt7U.mjs";
+import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-CC5ruDGh.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/core/index.mjs

@@ -1,5 +1,5 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-C6FlRWxF.mjs";
-import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as mergeResourceConfig, t as getEntityId, u as createPermissionMiddleware } from "../core-b6fgFgnd.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-ze70xXJi.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-BQ8KNvWC.mjs";
+import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as mergeResourceConfig, t as getEntityId, u as createPermissionMiddleware } from "../core-DQ6rDTyH.mjs";
+import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-lszoJle1.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };

package/dist/{core-b6fgFgnd.mjs → core-DQ6rDTyH.mjs}

@@ -2,16 +2,17 @@ import { s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS } from "./constants-DN
 import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
-import { M as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-FhJ88TJE.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-C6FlRWxF.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
-import { I as applyFieldWritePermissions, R as resolveEffectiveRoles, w as requireAuth } from "./permissions-BJMuKMl7.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-BQ8KNvWC.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, l as resolveRoutePreHandlers, n as buildRateLimitConfig, p as buildArcDecorator, r as buildRouteConfig, s as buildCrudPermissionMw, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
+import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
 import { t as getUserRoles } from "./types-XTApa8b6.mjs";
-import { t as applyPresets } from "./presets-gw0ciIUD.mjs";
-import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-Ds5reSGs.mjs";
+import { t as applyPresets } from "./presets-BOe4Ugkl.mjs";
+import { D as requireAuth } from "./permissions-tbxFHxjZ.mjs";
+import { N as assertValidConfig, l as getDefaultCrudSchemas } from "./utils-CZyeRXTh.mjs";
+import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-DJvodiHj.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-ze70xXJi.mjs";
+import { a as createCrudHandlers, d as buildRequestScopeProjection, i as resolvePipelineSteps, o as createFastifyHandler, r as buildPipelineHandler, s as createRequestContext, t as resolveActionPermission } from "./actionPermissions-lszoJle1.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 //#region src/core/middlewares/fieldWrite.ts
 /**
@@ -1395,7 +1396,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-h1cEEaEX.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-BuOv-m4Y.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1410,7 +1411,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-B1C0kvTL.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-CgJv_BU_.mjs"), import("./validate-C2mGgSXg.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);

package/dist/{createActionRouter-h1cEEaEX.mjs → createActionRouter-BuOv-m4Y.mjs}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-ze70xXJi.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-B-6SPe7g.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
+import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-lszoJle1.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,

package/dist/{createAggregationRouter-B1C0kvTL.mjs → createAggregationRouter-CgJv_BU_.mjs}

@@ -1,5 +1,5 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-xHc42fwB.mjs";
+import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
 import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
 import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts

package/dist/{createApp-Ci7yG5gv.mjs → createApp-CjOeWJ9_.mjs}

@@ -456,11 +456,18 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules) {
 	}
 	if (config.arcPlugins?.sse) if (config.arcPlugins?.events === false) fastify.log.warn("SSE plugin requires events plugin (arcPlugins.events). SSE disabled.");
 	else {
-		const { default: ssePlugin } = await import("./sse-CfUjwjDk.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("./sse-0u4P4-OI.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.sse === true ? {} : config.arcPlugins.sse;
 		await fastify.register(ssePlugin, opts);
 		trackPlugin("arc-sse", opts);
 	}
+	if (config.arcPlugins?.realtime) if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
+	else {
+		const { default: realtimePlugin } = await import("./realtime-I8OrfnMR.mjs").then((n) => n.r);
+		const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
+		await fastify.register(realtimePlugin, opts);
+		trackPlugin("arc-realtime", opts);
+	}
 	if (config.arcPlugins?.metrics) {
 		const { default: metricsPlugin } = await import("./metrics-fdxI5mn_.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.metrics === true ? {} : config.arcPlugins.metrics;
@@ -552,7 +559,7 @@ async function registerElevation(fastify, config, trackPlugin) {
 */
 async function registerErrorHandler(fastify, config, trackPlugin, moduleErrorMappers) {
 	if (config.errorHandler === false) return;
-	const { errorHandlerPlugin } = await import("./errorHandler-BTzXSwIg.mjs").then((n) => n.r);
+	const { errorHandlerPlugin } = await import("./errorHandler-Bq2OeEQL.mjs").then((n) => n.r);
 	let errorOpts = typeof config.errorHandler === "object" ? config.errorHandler : { includeStack: config.preset !== "production" };
 	if (moduleErrorMappers && moduleErrorMappers.length > 0) errorOpts = {
 		...errorOpts,
@@ -1220,6 +1227,7 @@ async function createApp(options) {
 		...options.preset ? getPreset(options.preset) : {},
 		...options
 	};
+	const inheritedPermissiveTrustProxy = options.preset === "production" && options.trustProxy === void 0;
 	const resolvedModules = orderModules(await Promise.all((config.modules ?? []).map((m) => resolveModule(m))));
 	const moduleErrorMappers = resolvedModules.flatMap((m) => m.errorMappers ?? []);
 	const resolvedLogger = resolveLoggerConfig(config.logger);
@@ -1255,6 +1263,7 @@ async function createApp(options) {
 		writer: createPinoWriter(fastify.log)
 	});
 	for (const warning of deferredWarnings) fastify.log.warn(warning);
+	if (inheritedPermissiveTrustProxy) fastify.log.warn("[arc] preset: 'production' defaults to trustProxy: true (trust EVERY proxy). If this app is reachable without your load balancer, clients can spoof X-Forwarded-For/Proto (rate-limit bypass, wrong audit IPs, forged protocol). Silence this by setting trustProxy explicitly: a hop count (trustProxy: 1), a CIDR allow-list ('10.0.0.0/8'), a resolver function, or true if you accept the trade-off. v3 flips this preset default to false — set it now to be upgrade-proof.");
 	if (config.typeProvider === "typebox") try {
 		const { TypeBoxValidatorCompiler } = await import("@fastify/type-provider-typebox");
 		fastify.setValidatorCompiler(TypeBoxValidatorCompiler);

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-DbtgCOCj.mjs";
+import { p as RegistryEntry } from "../index-BBsvQt7U.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { t as getUserRoles } from "../types-XTApa8b6.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BRpMZD7C.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-jSDx-VDv.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{errorHandler-BTzXSwIg.mjs → errorHandler-Bq2OeEQL.mjs}

@@ -14,13 +14,16 @@ var errorHandler_exports = /* @__PURE__ */ __exportAll({
 * {@link ErrorHandlerOptions.isDuplicateKeyError}.
 */
 function defaultIsDuplicateKeyError(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (e.code === 11e3 || e.codeName === "DuplicateKey") return true;
-	if (e.code === "P2002") return true;
-	if (e.code === "23505") return true;
-	if (e.code === "ER_DUP_ENTRY" || e.errno === 1062) return true;
-	if (e.code === "SQLITE_CONSTRAINT_UNIQUE" || e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
+	let current = err;
+	for (let depth = 0; depth < 5 && current && typeof current === "object"; depth++) {
+		const e = current;
+		if (e.code === 11e3 || e.codeName === "DuplicateKey") return true;
+		if (e.code === "P2002") return true;
+		if (e.code === "23505") return true;
+		if (e.code === "ER_DUP_ENTRY" || e.errno === 1062) return true;
+		if (e.code === "SQLITE_CONSTRAINT_UNIQUE" || e.code === "SQLITE_CONSTRAINT_PRIMARYKEY") return true;
+		current = e.cause;
+	}
 	return false;
 }
 function extractDuplicateFields(err) {

package/dist/events/index.mjs

@@ -176,8 +176,11 @@ function validatePayload(payload, schema) {
 			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
 				const expectedType = propSchema.type;
 				if (expectedType) {
-					const actualType = Array.isArray(record[key]) ? "array" : typeof record[key];
-					if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
+					const value = record[key];
+					const actualType = Array.isArray(value) ? "array" : typeof value;
+					if (expectedType === "integer") {
+						if (actualType !== "number" || !Number.isInteger(value)) errors.push(`Field '${key}': expected integer, got ${actualType}`);
+					} else if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
 				}
 			}
 		}

package/dist/factory/index.d.mts

@@ -1,7 +1,7 @@
 import { a as getModuleExports, c as LoadResourcesOptions, d as loadResources, i as defineModule, l as ResourceLike, n as ArcModuleInput, o as orderModules, r as ArcModuleRegistry, s as resolveModule, t as ArcModule, u as ResourceModule } from "../module-B4u10iOJ.mjs";
-import "../fastify-augmentation-9_fuetB4.mjs";
-import { a as AuthOption, c as CustomPluginAuthOption, d as preloadResourcesAsync, i as UnderPressureOptions, l as JwtAuthOption, n as MultipartOptions, o as BetterAuthOption, r as RawBodyOptions, s as CustomAuthenticatorOption, t as CreateAppOptions, u as preloadResources } from "../index-BEu4wjbL.mjs";
-import { g as HealthCheck } from "../versioning-DLwklPlG.mjs";
+import "../fastify-augmentation-g_f9omSc.mjs";
+import { a as AuthOption, c as CustomPluginAuthOption, d as preloadResourcesAsync, i as UnderPressureOptions, l as JwtAuthOption, n as MultipartOptions, o as BetterAuthOption, r as RawBodyOptions, s as CustomAuthenticatorOption, t as CreateAppOptions, u as preloadResources } from "../index-Ba10fdKp.mjs";
+import { b as HealthCheck } from "../versioning-D6PvCwpq.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**
@@ -64,15 +64,31 @@ interface FetchHandlerOptions {
    * @default true
    */
   autoReady?: boolean;
+  /**
+   * Reject request bodies larger than this many bytes with 413
+   * `arc.payload_too_large`. Enforcement precision matters: bodies with a
+   * declared `Content-Length` are rejected BEFORE buffering; chunked or
+   * undeclared bodies are necessarily buffered first and checked AFTER
+   * (`arrayBuffer()` allocates the full body — a consequence of the
+   * buffered-adapter design, not a bug). Platform/gateway body limits
+   * remain the real pre-allocation protection for hostile senders.
+   * Fastify's own `bodyLimit` still applies after this gate. Set to `0`
+   * to disable the gate.
+   * @default 1_048_576 (1 MiB — matches Fastify's default bodyLimit)
+   */
+  maxRequestBytes?: number;
 }
 /**
  * Convert a Fastify app into a Web Standards fetch handler.
  *
  * The returned function accepts a Web Standard `Request` and returns
- * a Web Standard `Response` — the universal serverless/edge contract.
+ * a Web Standard `Response` — the universal serverless contract.
  *
  * Internally uses `app.inject()` which processes the request through
  * the full Fastify pipeline (hooks, plugins, routes) without TCP.
+ * Bodies are read as raw bytes (`arrayBuffer()`), so binary payloads
+ * (protobuf, images, non-UTF-8 charsets) survive intact — the
+ * content-type parser decides how to decode, same as a real socket.
  */
 declare function toFetchHandler(app: FastifyInstance, options?: FetchHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion