@classytic/arc 2.22.0 → 2.25.0

package/dist/{registerRoute-xHc42fwB.mjs → rateLimit-DrED-C4v.mjs}

@@ -1,6 +1,4 @@
-import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { n as requestContext } from "./requestContext-BZKOr13H.mjs";
-import { N as evaluateAndApplyPermission } from "./permissions-BJMuKMl7.mjs";
+import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.
@@ -179,76 +177,6 @@ function describeValue(v) {
 	return `${typeof v} (${JSON.stringify(v).slice(0, 80)})`;
 }
 //#endregion
-//#region src/core/middlewares/permissions.ts
-/**
-* Build a PermissionContext from a Fastify request. Extracted so the CRUD
-* permission middleware and the dynamic action-permission check use the same
-* field layout — divergence here silently broke policy filters for actions.
-*/
-function buildPermissionContext(req, opts) {
-	const reqWithExtras = req;
-	const params = req.params;
-	return {
-		user: reqWithExtras.user ?? null,
-		request: req,
-		resource: opts.resource,
-		action: opts.action,
-		resourceId: opts.resourceId ?? params?.id,
-		params,
-		data: opts.data ?? req.body
-	};
-}
-/**
-* Static per-route CRUD permission gate. The permission and action are known
-* at route-registration time, so the gate is a plain preHandler.
-*
-* Actions use the dynamic counterpart `buildActionPermissionMw` — their
-* permission is resolved from `body.action` at request time.
-*/
-function buildCrudPermissionMw(permissionCheck, resourceName, action) {
-	if (!permissionCheck) return null;
-	return async (req, reply) => {
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action
-		}), req, reply);
-	};
-}
-/**
-* Dynamic per-action permission gate for the action router.
-*
-* Resolves the permission from `body.action` at request time and runs
-* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
-* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
-* (idempotency) and `routeGuards` run. Previously this check lived inside
-* the main action handler, which meant idempotency recorded unauthorized
-* requests and route guards saw unfiltered scope — the very divergence
-* routerShared exists to prevent.
-*
-* Also acts as a defensive fallback for invalid action names — the
-* `oneOf` body schema normally rejects these at AJV validation, but
-* hosts that disable schema validation still get a 400 here.
-*/
-function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
-	const enumSet = new Set(actionEnum);
-	const validActions = [...actionEnum];
-	return async (req, reply) => {
-		const body = req.body ?? {};
-		const action = body.action;
-		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
-		const permissionCheck = actionPermissions[action] ?? globalAuth;
-		if (!permissionCheck) return;
-		const { action: _discard, ...data } = body;
-		const params = req.params;
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
-			resource: resourceName,
-			action,
-			resourceId: params?.id,
-			data
-		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
-	};
-}
-//#endregion
 //#region src/core/middlewares/pluginMw.ts
 /**
 * Pick the request-lifecycle plugin middleware for an HTTP method:
@@ -314,39 +242,4 @@ function buildRateLimitConfig(rateLimit) {
 	} };
 }
 //#endregion
-//#region src/core/middlewares/registerRoute.ts
-/**
-* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
-*
-* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
-* overlaps before Fastify ever runs, but a few cases still slip through to
-* Fastify itself: two presets contributing the same `routes` entry, hosts
-* mounting two resources at the same prefix, custom routes that share a
-* URL with another plugin. Fastify's default message ("Method 'GET'
-* already declared for route '/'") gives no hint at the resource-shaped
-* fix — `disabledRoutes: ['list']` — so wrap it with one.
-*/
-function tryRegisterRoute(fastify, opts, context) {
-	try {
-		fastify.route(opts);
-	} catch (err) {
-		const fastifyErr = err;
-		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
-		const method = opts.method;
-		const url = opts.url;
-		const opHint = context.op ? ` (op: ${context.op})` : "";
-		const fixHint = context.op && [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
-		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
-		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
-		enhanced.cause = err;
-		throw enhanced;
-	}
-}
-//#endregion
-export { selectPluginMw as a, buildRouteHooks as c, buildAuthMiddleware as d, buildAuthMiddlewareForPermissions as f, resolveRouterPluginMw as i, resolveRoutePreHandlers as l, buildRateLimitConfig as n, buildActionPermissionMw as o, buildArcDecorator as p, buildRouteConfig as r, buildCrudPermissionMw as s, tryRegisterRoute as t, routeHookOptions as u };
+export { buildRouteHooks as a, buildAuthMiddleware as c, selectPluginMw as i, buildAuthMiddlewareForPermissions as l, buildRouteConfig as n, resolveRoutePreHandlers as o, resolveRouterPluginMw as r, routeHookOptions as s, buildRateLimitConfig as t, buildArcDecorator as u };

package/dist/realtime-Cuw_deA-.mjs

@@ -0,0 +1,375 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { arcLog } from "./logger/index.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { c as getOrgId } from "./types-CSyCxl2V.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
+import { i as applyFieldReadPermissions, n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-BQcW6_Kq.mjs";
+import { t as openSseStream } from "./sseStream-BQ7Qaynp.mjs";
+import fp from "fastify-plugin";
+//#region src/plugins/realtime.ts
+var realtime_exports = /* @__PURE__ */ __exportAll({
+	buildChangeFrame: () => buildChangeFrame,
+	connectionDeadlineMs: () => connectionDeadlineMs,
+	default: () => realtime_default,
+	realtimePlugin: () => realtimePlugin,
+	resolveDelivery: () => resolveDelivery,
+	resolveRowMatcher: () => resolveRowMatcher
+});
+const log = arcLog("realtime");
+const CHANGE_OPERATIONS = [
+	"created",
+	"updated",
+	"deleted"
+];
+/**
+* SSE `retry:` reconnection hint (ms). Deliberate: the feed has no replay,
+* so a reconnecting client refetches the list anyway — a short retry keeps
+* the gap small without hammering the server.
+*/
+const DEFAULT_RETRY_MS = 3e3;
+/**
+* Cap on resources per multiplexed connection. Generous for real
+* dashboards (Supabase caps channels-per-client similarly); prevents a
+* single socket from fanning out unbounded subscription work.
+*/
+const MAX_MULTIPLEX_RESOURCES = 20;
+/** Node's `setTimeout` ceiling (~24.8 days); larger delays fire immediately. */
+const MAX_TIMER_MS = 2147483647;
+/**
+* Milliseconds from `now` until the feed should force-close to bound
+* permission staleness — `min(auth-token exp, maxConnectionMs)`. Returns
+* `undefined` when neither bound applies (no `exp` claim, no cap → the feed
+* lives until client disconnect), `0` when already expired, else the
+* (setTimeout-ceiling-clamped) delay. Pure; exported for tests.
+*/
+function connectionDeadlineMs(user, maxConnectionMs, now = Date.now()) {
+	let deadline;
+	const exp = user?.exp;
+	if (typeof exp === "number" && Number.isFinite(exp)) deadline = exp * 1e3 - now;
+	if (maxConnectionMs !== void 0 && maxConnectionMs > 0) deadline = deadline === void 0 ? maxConnectionMs : Math.min(deadline, maxConnectionMs);
+	if (deadline === void 0) return void 0;
+	if (deadline <= 0) return 0;
+	return Math.min(deadline, MAX_TIMER_MS);
+}
+/**
+* Are these filters flat equality (every value a scalar, no `$` operators)?
+* That is the shape `simpleEqualityMatcher` is safe for — anything richer
+* needs the adapter's own matcher.
+*/
+function isFlatEquality(filters) {
+	for (const [key, value] of Object.entries(filters)) {
+		if (key.startsWith("$")) return false;
+		if (value !== null && typeof value === "object" && !(value instanceof Date)) return false;
+	}
+	return true;
+}
+/**
+* Decide how (or whether) this subscription's row filters can be enforced
+* in process: adapter matcher when supplied, `simpleEqualityMatcher` for
+* flat-equality shapes, UNENFORCEABLE (fail-closed → 501) for
+* operator-shaped filters with no adapter matcher. No filters → nothing
+* to enforce.
+*/
+function resolveRowMatcher(filters, adapter) {
+	const hasFilters = !!filters && Object.keys(filters).length > 0;
+	if (adapter?.matchesFilter) {
+		const matcher = adapter.matchesFilter.bind(adapter);
+		if (hasFilters && filters) try {
+			matcher({}, filters);
+		} catch {
+			return { enforceable: false };
+		}
+		return {
+			enforceable: true,
+			matcher
+		};
+	}
+	if (!hasFilters) return { enforceable: true };
+	if (isFlatEquality(filters)) return {
+		enforceable: true,
+		matcher: simpleEqualityMatcher
+	};
+	return { enforceable: false };
+}
+/**
+* Decide this event's fate for one subscriber. Pure — the whole
+* authorization + membership-transition story lives here:
+*
+*   1. tenant guard: org-carrying events only reach matching-org subscribers
+*      (a cross-org record was never visible → drop, never a leave).
+*   2. row filters (connect-time snapshot):
+*      - matches (or no filters)                     → deliver.
+*      - no match + operation is `updated`           → LEAVE (membership
+*        transition out; the record may have been in the subscriber's view).
+*      - no match + operation is `created`/`deleted` → drop (never entered
+*        the view — a created record that doesn't match was never shown; a
+*        deleted record that doesn't match was already filtered out).
+*
+* The ENTER transition (a record updated so it now DOES match) needs no
+* special signal: the matching `updated` frame carries the full record, so
+* the client adds it if absent.
+*/
+function resolveDelivery(event, policy, operation) {
+	if (policy.tenantScoped) {
+		const eventOrgId = event.meta?.organizationId;
+		if (eventOrgId && eventOrgId !== policy.subscriberOrgId) return { kind: "drop" };
+	}
+	const doc = event.payload?.data;
+	if (!(!!policy.filters && Object.keys(policy.filters).length > 0)) return {
+		kind: "deliver",
+		doc
+	};
+	if (!!doc && typeof doc === "object" && !!policy.matcher?.(doc, policy.filters)) return {
+		kind: "deliver",
+		doc
+	};
+	return operation === "updated" ? { kind: "leave" } : { kind: "drop" };
+}
+/**
+* Build the wire frame for one delivered change. Envelope note: this is
+* deliberately DOCUMENT-CHANGE-shaped (`data` = the masked document),
+* unlike the sse plugin's raw event mirror (`payload` = whatever was
+* published) — the two streams serve different consumers and the
+* divergence is intentional, not drift.
+*/
+function buildChangeFrame(event, resourceName, data) {
+	return JSON.stringify({
+		type: event.type,
+		resource: resourceName,
+		id: event.meta?.resourceId,
+		data,
+		meta: {
+			timestamp: event.meta?.timestamp,
+			correlationId: event.meta?.correlationId
+		}
+	});
+}
+const realtimePlugin = async (fastify, opts = {}) => {
+	const { path = "/realtime/:resource", heartbeat = 3e4, resources: allowlist, operations = CHANGE_OPERATIONS, tokenQueryParam = "token", maxConnectionMs } = opts;
+	if (!fastify.hasDecorator("events")) {
+		log.warn("Events plugin (arc-events) not registered. Realtime plugin will not function. Register eventPlugin before realtimePlugin.");
+		return;
+	}
+	if (!path.includes(":resource")) throw new Error(`[arc-realtime] path must contain ':resource' (got '${path}')`);
+	const activeConnections = /* @__PURE__ */ new Set();
+	const isProtected = (entry) => {
+		const listCheck = entry.permissions?.list;
+		return typeof listCheck === "function" && listCheck._isPublic !== true;
+	};
+	/**
+	* Run auth once for a set of requested resources: `authenticate` when ANY
+	* is protected (401 on missing/invalid token), `optionalAuthenticate`
+	* otherwise so tokens still parse. Returns false when a reply was sent.
+	*/
+	const runAuth = async (request, reply, entries) => {
+		const needsAuth = entries.some(isProtected);
+		if (tokenQueryParam) promoteStreamTokenToHeader(request, tokenQueryParam);
+		const authenticate = needsAuth ? fastify.authenticate : fastify.optionalAuthenticate;
+		if (needsAuth && typeof authenticate !== "function") {
+			await reply.code(401).send({
+				code: "arc.unauthorized",
+				message: "Authentication required",
+				status: 401
+			});
+			return false;
+		}
+		if (typeof authenticate === "function") {
+			await authenticate(request, reply);
+			if (reply.sent) return false;
+		}
+		return true;
+	};
+	/**
+	* Authorize ONE resource for this connection: run its list permission,
+	* snapshot its row filters IN ISOLATION (evaluateAndApplyPermission
+	* accumulates onto request._policyFilters — on a multiplexed connection
+	* resource B must never inherit resource A's filters, so the field is
+	* saved/reset/restored around each evaluation), and resolve the row
+	* matcher fail-closed. Sends the denial/501 reply itself; returns null
+	* when the caller should stop.
+	*/
+	const authorizeResource = async (resourceName, entry, request, reply) => {
+		const holder = request;
+		const saved = holder._policyFilters;
+		holder._policyFilters = void 0;
+		try {
+			const listCheck = entry.permissions?.list;
+			if (typeof listCheck === "function") {
+				if (!await evaluateAndApplyPermission(listCheck, {
+					user: request.user ?? null,
+					request,
+					resource: resourceName,
+					action: "list"
+				}, request, reply)) return null;
+			}
+			const filters = holder._policyFilters;
+			const resolution = resolveRowMatcher(filters, fastify.arc?.registry?.getAdapter(resourceName));
+			if (!resolution.enforceable) {
+				await reply.code(501).send({
+					code: "arc.realtime.unfilterable",
+					message: `The '${resourceName}' list permission returned operator-shaped row filters, which this feed cannot enforce in-process. Supply \`matchesFilter\` on the resource's DataAdapter to enable realtime for filter-scoped subscribers.`,
+					status: 501
+				});
+				return null;
+			}
+			const scope = request.scope;
+			return {
+				name: resourceName,
+				policy: {
+					tenantScoped: entry.tenantField !== false,
+					subscriberOrgId: scope ? getOrgId(scope) : void 0,
+					filters,
+					matcher: resolution.matcher
+				},
+				fields: entry.fields
+			};
+		} finally {
+			holder._policyFilters = saved;
+		}
+	};
+	/** Open the stream and wire every authorized subscription onto it. */
+	const sharedFrames = /* @__PURE__ */ new WeakMap();
+	const streamSubscriptions = async (request, reply, subscriptions) => {
+		const userRoles = getUserRoles(request.user ?? {});
+		const stream = openSseStream(request, reply, {
+			heartbeatMs: heartbeat,
+			retryMs: DEFAULT_RETRY_MS
+		});
+		stream.onCleanup(() => activeConnections.delete(stream.close));
+		activeConnections.add(stream.close);
+		const closeAt = connectionDeadlineMs(request.user, maxConnectionMs);
+		if (closeAt !== void 0) {
+			if (closeAt <= 0) {
+				stream.close();
+				return;
+			}
+			const timer = setTimeout(stream.close, closeAt);
+			timer.unref?.();
+			stream.onCleanup(() => clearTimeout(timer));
+		}
+		for (const sub of subscriptions) {
+			const deliver = (event, operation) => {
+				const decision = resolveDelivery(event, sub.policy, operation);
+				if (decision.kind === "drop") return;
+				if (decision.kind === "leave") {
+					stream.write(`${sub.name}.left`, JSON.stringify({
+						type: `${sub.name}.left`,
+						resource: sub.name,
+						id: event.meta?.resourceId
+					}), event.meta?.id);
+					return;
+				}
+				const { doc } = decision;
+				const needsMask = !!sub.fields && !!doc && typeof doc === "object";
+				let frame;
+				if (needsMask) {
+					const masked = applyFieldReadPermissions(doc, sub.fields, userRoles);
+					frame = buildChangeFrame(event, sub.name, masked);
+				} else {
+					const cached = sharedFrames.get(event);
+					frame = cached ?? buildChangeFrame(event, sub.name, doc);
+					if (!cached) sharedFrames.set(event, frame);
+				}
+				stream.write(event.type, frame, event.meta?.id);
+			};
+			for (const operation of operations) {
+				const unsub = await fastify.events.subscribe(`${sub.name}.${operation}`, (event) => deliver(event, operation));
+				stream.onCleanup(unsub);
+			}
+		}
+		stream.write("ready", JSON.stringify({
+			resources: subscriptions.map((s) => s.name),
+			operations: [...operations]
+		}));
+	};
+	const lookupEntry = (name) => {
+		if (allowlist && !allowlist.includes(name)) return void 0;
+		return fastify.arc?.registry?.get(name);
+	};
+	const notFound = (reply, name) => reply.code(404).send({
+		code: "arc.not_found",
+		message: `Resource '${name}' has no realtime feed`,
+		status: 404
+	});
+	fastify.route({
+		method: "GET",
+		url: path,
+		schema: {
+			tags: ["Events"],
+			summary: "Realtime resource change feed",
+			description: "SSE stream of created/updated/deleted events for one resource, gated by its list permission — row filters and field-level read permissions apply per event.",
+			response: { 200: {
+				type: "string",
+				description: "text/event-stream"
+			} }
+		},
+		handler: async (request, reply) => {
+			const resourceName = request.params.resource;
+			const entry = lookupEntry(resourceName);
+			if (!entry) return notFound(reply, resourceName);
+			if (!await runAuth(request, reply, [entry])) return;
+			const sub = await authorizeResource(resourceName, entry, request, reply);
+			if (!sub) return;
+			await streamSubscriptions(request, reply, [sub]);
+		}
+	});
+	const multiplexPath = path.replace(/\/:resource$/, "");
+	fastify.route({
+		method: "GET",
+		url: multiplexPath,
+		schema: {
+			tags: ["Events"],
+			summary: "Realtime multi-resource change feed",
+			description: "Multiplexed SSE stream for several resources over one connection (?resources=a,b,c). Every resource is gated by its own list permission; any denial rejects the subscription.",
+			querystring: {
+				type: "object",
+				properties: { resources: { type: "string" } },
+				required: ["resources"]
+			},
+			response: { 200: {
+				type: "string",
+				description: "text/event-stream"
+			} }
+		},
+		handler: async (request, reply) => {
+			const raw = request.query.resources;
+			const names = [...new Set(raw.split(",").map((s) => s.trim()).filter(Boolean))];
+			if (names.length === 0 || names.length > MAX_MULTIPLEX_RESOURCES) return reply.code(400).send({
+				code: "arc.bad_request",
+				message: `resources must name 1–${MAX_MULTIPLEX_RESOURCES} registered resources`,
+				status: 400
+			});
+			const entries = [];
+			for (const name of names) {
+				const entry = lookupEntry(name);
+				if (!entry) return notFound(reply, name);
+				entries.push(entry);
+			}
+			if (!await runAuth(request, reply, entries)) return;
+			const subscriptions = [];
+			for (let i = 0; i < names.length; i++) {
+				const sub = await authorizeResource(names[i], entries[i], request, reply);
+				if (!sub) return;
+				subscriptions.push(sub);
+			}
+			await streamSubscriptions(request, reply, subscriptions);
+		}
+	});
+	fastify.addHook("onClose", async () => {
+		for (const close of activeConnections) close();
+		activeConnections.clear();
+	});
+	log.debug("Plugin registered", {
+		path,
+		operations,
+		allowlist
+	});
+};
+var realtime_default = fp(realtimePlugin, {
+	name: "arc-realtime",
+	fastify: "5.x",
+	dependencies: ["arc-events"]
+});
+//#endregion
+export { realtime_default as n, realtime_exports as r, realtimePlugin as t };

package/dist/{redis-stream-iVR2l7aS.d.mts → redis-stream-uIaauNpZ.d.mts}

@@ -59,6 +59,20 @@ interface RedisStreamTransportOptions {
    * @default 10
    */
   batchSize?: number;
+  /**
+   * Bounded concurrency for processing a batch's ENTRIES (default: 1 —
+   * strict stream order, the safe default). With one slow handler,
+   * throughput per consumer is ~`1 / total handler latency`; raising this
+   * processes up to N entries of a batch concurrently.
+   *
+   * Trade-off: entries within a batch may complete OUT OF ORDER — only
+   * raise it when handlers are order-independent (idempotent, keyed
+   * upserts). Handlers on this transport should be short and I/O-bound
+   * regardless; heavy work belongs in jobs. Matching handlers for a single
+   * event always run sequentially.
+   * @default 1
+   */
+  processingConcurrency?: number;
   /**
    * Max delivery attempts before moving to dead letter stream.
    * @default 5
@@ -133,6 +147,7 @@ declare class RedisStreamTransport implements EventTransport {
   private consumer;
   private blockTimeMs;
   private batchSize;
+  private processingConcurrency;
   private maxRetries;
   private claimTimeoutMs;
   private deadLetterStream;
@@ -207,6 +222,13 @@ declare class RedisStreamTransport implements EventTransport {
   private ensureGroup;
   private pollLoop;
   private readNewMessages;
+  /**
+   * Process a batch's entries with bounded concurrency
+   * (`processingConcurrency`, default 1 = strict order). Worker-pool over a
+   * shared index — at most N entries in flight, each entry's own handlers
+   * still sequential inside `processEntry`.
+   */
+  private processEntries;
   private claimPending;
   private processEntry;
   private getMatchingHandlers;

package/dist/registerRoute-v0Wb6Plt.mjs

@@ -0,0 +1,108 @@
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { n as evaluateAndApplyPermission } from "./applyPermissionResult-Tw4iXtlf.mjs";
+//#region src/core/middlewares/permissions.ts
+/**
+* Build a PermissionContext from a Fastify request. Extracted so the CRUD
+* permission middleware and the dynamic action-permission check use the same
+* field layout — divergence here silently broke policy filters for actions.
+*/
+function buildPermissionContext(req, opts) {
+	const reqWithExtras = req;
+	const params = req.params;
+	return {
+		user: reqWithExtras.user ?? null,
+		request: req,
+		resource: opts.resource,
+		action: opts.action,
+		resourceId: opts.resourceId ?? params?.id,
+		params,
+		data: opts.data ?? req.body
+	};
+}
+/**
+* Static per-route CRUD permission gate. The permission and action are known
+* at route-registration time, so the gate is a plain preHandler.
+*
+* Actions use the dynamic counterpart `buildActionPermissionMw` — their
+* permission is resolved from `body.action` at request time.
+*/
+function buildCrudPermissionMw(permissionCheck, resourceName, action) {
+	if (!permissionCheck) return null;
+	return async (req, reply) => {
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action
+		}), req, reply);
+	};
+}
+/**
+* Dynamic per-action permission gate for the action router.
+*
+* Resolves the permission from `body.action` at request time and runs
+* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
+* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
+* (idempotency) and `routeGuards` run. Previously this check lived inside
+* the main action handler, which meant idempotency recorded unauthorized
+* requests and route guards saw unfiltered scope — the very divergence
+* routerShared exists to prevent.
+*
+* Also acts as a defensive fallback for invalid action names — the
+* `oneOf` body schema normally rejects these at AJV validation, but
+* hosts that disable schema validation still get a 400 here.
+*/
+function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
+	const enumSet = new Set(actionEnum);
+	const validActions = [...actionEnum];
+	return async (req, reply) => {
+		const body = req.body ?? {};
+		const action = body.action;
+		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
+		const permissionCheck = actionPermissions[action] ?? globalAuth;
+		if (!permissionCheck) return;
+		const { action: _discard, ...data } = body;
+		const params = req.params;
+		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+			resource: resourceName,
+			action,
+			resourceId: params?.id,
+			data
+		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+	};
+}
+//#endregion
+//#region src/core/middlewares/registerRoute.ts
+/**
+* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
+*
+* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
+* overlaps before Fastify ever runs, but a few cases still slip through to
+* Fastify itself: two presets contributing the same `routes` entry, hosts
+* mounting two resources at the same prefix, custom routes that share a
+* URL with another plugin. Fastify's default message ("Method 'GET'
+* already declared for route '/'") gives no hint at the resource-shaped
+* fix — `disabledRoutes: ['list']` — so wrap it with one.
+*/
+function tryRegisterRoute(fastify, opts, context) {
+	try {
+		fastify.route(opts);
+	} catch (err) {
+		const fastifyErr = err;
+		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
+		const method = opts.method;
+		const url = opts.url;
+		const opHint = context.op ? ` (op: ${context.op})` : "";
+		const fixHint = context.op && [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete"
+		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
+		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
+		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
+		enhanced.cause = err;
+		throw enhanced;
+	}
+}
+//#endregion
+export { buildActionPermissionMw as n, buildCrudPermissionMw as r, tryRegisterRoute as t };

package/dist/registry/index.d.mts

@@ -1,5 +1,5 @@
-import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DbtgCOCj.mjs";
-import "../fastify-augmentation-9_fuetB4.mjs";
+import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-DPRH0Cme.mjs";
+import "../fastify-augmentation-dPNBVeIj.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,3 +1,3 @@
 import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-vcOCtPij.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-7RnrEWNP.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-y9Hnypus.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };