@classytic/arc 2.23.0 → 2.25.0

package/dist/{permissions-tbxFHxjZ.mjs → permissions-BrtiBKGs.mjs}

@@ -1,233 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-bHblZ9YN.mjs";
-import { t as getUserRoles } from "./types-XTApa8b6.mjs";
-import { t as MemoryCacheStore } from "./memory-CLXA2VeJ.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-CSyCxl2V.mjs";
+import { t as MemoryCacheStore } from "./memory-CmnzXE5Z.mjs";
 import { randomUUID } from "node:crypto";
-//#region src/permissions/agent.ts
-/**
-* Agent-Auth Permission Helpers — DPoP + capability mandates for AI-agent flows
-*
-* Three checks for the 2025 agent-authorization stack (AP2 / Stripe x402 /
-* MCP authorization / RFC 9700 / RFC 9449 / RFC 9728):
-*
-* - `requireDPoP()`           — token must be sender-constrained (RFC 9449)
-* - `requireMandate(cap, …)`  — capability mandate must authorize this action
-* - `requireAgentScope(opts)` — composite gate: service identity + mandate + DPoP
-*
-* Arc reads `request.scope.mandate` and `request.scope.dpopJkt` populated by
-* your `authenticate` callback. Arc does **not** parse mandate JWTs/VCs or
-* verify DPoP proofs — that's a 1-2 line `jose` call in your authenticator.
-* Arc validates *what's already proved* against the action being attempted.
-*
-* @example
-* ```typescript
-* import { requireDPoP, requireMandate, requireAgentScope } from '@classytic/arc/permissions';
-*
-* defineResource({
-*   name: 'invoice',
-*   permissions: {
-*     pay: requireAgentScope({
-*       capability: 'payment.charge',
-*       requireDPoP: true,
-*       validateAmount: (ctx, mandate) =>
-*         typeof ctx.data?.amount === 'number' && ctx.data.amount <= (mandate.cap ?? 0),
-*       audience: (ctx) => `invoice:${ctx.params?.id}`,
-*     }),
-*   },
-* });
-* ```
-*/
-/** Default grace window for mandate `expiresAt` — accommodates clock skew. */
-const DEFAULT_TTL_GRACE_MS = 3e4;
-/**
-* Require a sender-constrained credential — the inbound token MUST carry a
-* DPoP proof (RFC 9449) bound to a known key. Arc reads `scope.dpopJkt` (the
-* JWK SHA-256 thumbprint per RFC 7638); your `authenticate` function performs
-* the cryptographic `jose.dpop.verify(...)` and sets the field on success.
-*
-* **Pass behavior:**
-* - `service` scope where `dpopJkt` is set → grant
-* - `elevated` scope → grant (platform admin bypass)
-* - Anything else → deny with a clear reason
-*
-* Use for high-value endpoints where bearer-token replay must be impossible:
-* payment charges, data exports, account-takeover-class admin actions.
-*
-* @example
-* ```typescript
-* permissions: { charge: allOf(requireServiceScope('payment.write'), requireDPoP()) }
-* ```
-*/
-function requireDPoP() {
-	const check = (ctx) => {
-		const scope = getRequestScope(ctx.request);
-		if (isElevated(scope)) return true;
-		if (!isService(scope)) return {
-			granted: false,
-			reason: "DPoP-bound service identity required. Configure your authenticate callback to set scope.dpopJkt after verifying the DPoP proof header (RFC 9449)."
-		};
-		if (!getDPoPJkt(scope)) return {
-			granted: false,
-			reason: "Sender-constrained credential required (DPoP). Inbound token is bearer; replay-resistance is mandatory on this endpoint."
-		};
-		return true;
-	};
-	check._dpopRequired = true;
-	return check;
-}
-/**
-* Require a capability mandate (AP2 / x402 / MCP authorization) that
-* authorizes the action being attempted.
-*
-* The mandate is set on `request.scope.mandate` by your authenticate function
-* after verifying the inbound mandate JWT/VC. This check validates that the
-* presented mandate covers the requested capability, hasn't expired, is bound
-* to the right resource (when `audience` opt is set), and respects the
-* mandate's numeric ceiling (when `validateAmount` opt is set).
-*
-* **Pass behavior:**
-* - `elevated` scope → grant unless `noElevatedBypass: true`
-* - `service` scope with mandate matching `capability`, not expired, and
-*   passing `validateAmount` + `audience` checks → grant
-* - Anything else → deny with a precise reason
-*
-* Pair with `requireDPoP()` for replay-resistance, or use the bundled
-* `requireAgentScope(...)` to declare both at once.
-*
-* @example
-* ```typescript
-* // Single payment charge — amount must fit the mandate's cap
-* permissions: {
-*   pay: requireMandate('payment.charge', {
-*     validateAmount: (ctx, m) => (ctx.data as { amount: number }).amount <= (m.cap ?? 0),
-*     audience: (ctx) => `invoice:${ctx.params?.id}`,
-*   }),
-* }
-*
-* // Boolean capability — presence of mandate is the gate
-* permissions: {
-*   exportData: requireMandate('data.export'),
-* }
-* ```
-*/
-function requireMandate(capability, opts = {}) {
-	if (!capability || typeof capability !== "string") throw new Error("requireMandate(capability) requires a non-empty capability string (e.g. 'payment.charge')");
-	const ttlGrace = opts.ttlGraceMs ?? DEFAULT_TTL_GRACE_MS;
-	const noElevatedBypass = opts.noElevatedBypass === true;
-	const check = (ctx) => {
-		const scope = getRequestScope(ctx.request);
-		if (isElevated(scope) && !noElevatedBypass) return true;
-		const mandate = getMandate(scope);
-		if (!mandate) return {
-			granted: false,
-			reason: `Capability mandate required (${capability}). Configure your authenticate callback to populate request.scope.mandate after verifying the mandate JWT/VC.`
-		};
-		if (mandate.capability !== capability) return {
-			granted: false,
-			reason: `Mandate authorizes "${mandate.capability}", not "${capability}"`
-		};
-		if (mandate.expiresAt !== void 0 && Date.now() > mandate.expiresAt + ttlGrace) return {
-			granted: false,
-			reason: `Mandate expired at ${new Date(mandate.expiresAt).toISOString()}`
-		};
-		if (opts.audience) {
-			const required = typeof opts.audience === "function" ? opts.audience(ctx) : opts.audience;
-			if (required && mandate.audience && mandate.audience !== required) return {
-				granted: false,
-				reason: `Mandate is bound to "${mandate.audience}", not "${required}"`
-			};
-			if (required && !mandate.audience) return {
-				granted: false,
-				reason: `Mandate must be bound to "${required}" (no audience claim)`
-			};
-		}
-		if (opts.validateAmount) {
-			const result = opts.validateAmount(ctx, mandate);
-			if (result !== true) return {
-				granted: false,
-				reason: typeof result === "string" ? result : `Action exceeds mandate cap ${mandate.cap}${mandate.currency ? ` ${mandate.currency}` : ""}`
-			};
-		}
-		return true;
-	};
-	check._mandateCapability = capability;
-	return check;
-}
-/**
-* Composite gate for AI-agent / M2M flows on protected resources.
-*
-* Bundles the three things every high-value agent endpoint needs:
-* 1. **Service identity** — `scope.kind === 'service'` with `clientId`
-* 2. **Capability mandate** — narrows what *this request* may do
-* 3. **DPoP binding** — credential cannot be replayed from a different key
-*
-* Use this instead of hand-composing `allOf(requireServiceScope(...),
-* requireMandate(...), requireDPoP())` — fewer ways to misconfigure, one
-* meta-tag downstream tools (audit, MCP, OpenAPI) can read.
-*
-* @example
-* ```typescript
-* import { requireAgentScope } from '@classytic/arc/permissions';
-*
-* defineResource({
-*   name: 'invoice',
-*   actions: {
-*     pay: {
-*       handler: payInvoice,
-*       permissions: requireAgentScope({
-*         capability: 'payment.charge',
-*         scopes: ['payment.write'],
-*         requireDPoP: true,
-*         audience: (ctx) => `invoice:${ctx.params?.id}`,
-*         validateAmount: (ctx, m) => (ctx.data as { amount: number }).amount <= (m.cap ?? 0),
-*       }),
-*     },
-*   },
-* });
-* ```
-*/
-function requireAgentScope(opts) {
-	const { capability, scopes, requireDPoP: needsDPoP = true, ...mandateOpts } = opts;
-	if (!capability) throw new Error("requireAgentScope({ capability }) is required");
-	const mandateCheck = requireMandate(capability, mandateOpts);
-	const dpopCheck = needsDPoP ? requireDPoP() : null;
-	const requiredScopes = scopes && scopes.length > 0 ? [...scopes] : null;
-	const check = async (ctx) => {
-		const scope = getRequestScope(ctx.request);
-		if (isElevated(scope) && !mandateOpts.noElevatedBypass) return true;
-		if (!isService(scope)) return {
-			granted: false,
-			reason: "Service identity required (machine principal). Agent flows must authenticate as a service, not a logged-in user."
-		};
-		if (requiredScopes) {
-			const granted = scope.scopes ?? [];
-			if (!requiredScopes.some((s) => granted.includes(s))) return {
-				granted: false,
-				reason: `Service identity is missing required OAuth scope(s): ${requiredScopes.join(", ")}`
-			};
-		}
-		const mandateResult = await mandateCheck(ctx);
-		if (mandateResult !== true) return typeof mandateResult === "object" ? mandateResult : {
-			granted: false,
-			reason: "Mandate check failed"
-		};
-		if (dpopCheck) {
-			const dpopResult = await dpopCheck(ctx);
-			if (dpopResult !== true) return typeof dpopResult === "object" ? dpopResult : {
-				granted: false,
-				reason: "DPoP binding required"
-			};
-		}
-		return true;
-	};
-	check._agentScope = {
-		capability,
-		scopes: requiredScopes ?? void 0,
-		dpop: needsDPoP
-	};
-	return check;
-}
-//#endregion
 //#region src/permissions/core.ts
 /**
 * Normalize a `string | [readonly string[]]` rest-args tuple into a single
@@ -517,6 +292,231 @@ function when(condition) {
 	};
 }
 //#endregion
+//#region src/permissions/agent.ts
+/**
+* Agent-Auth Permission Helpers — DPoP + capability mandates for AI-agent flows
+*
+* Three checks for the 2025 agent-authorization stack (AP2 / Stripe x402 /
+* MCP authorization / RFC 9700 / RFC 9449 / RFC 9728):
+*
+* - `requireDPoP()`           — token must be sender-constrained (RFC 9449)
+* - `requireMandate(cap, …)`  — capability mandate must authorize this action
+* - `requireAgentScope(opts)` — composite gate: service identity + mandate + DPoP
+*
+* Arc reads `request.scope.mandate` and `request.scope.dpopJkt` populated by
+* your `authenticate` callback. Arc does **not** parse mandate JWTs/VCs or
+* verify DPoP proofs — that's a 1-2 line `jose` call in your authenticator.
+* Arc validates *what's already proved* against the action being attempted.
+*
+* @example
+* ```typescript
+* import { requireDPoP, requireMandate, requireAgentScope } from '@classytic/arc/permissions';
+*
+* defineResource({
+*   name: 'invoice',
+*   permissions: {
+*     pay: requireAgentScope({
+*       capability: 'payment.charge',
+*       requireDPoP: true,
+*       validateAmount: (ctx, mandate) =>
+*         typeof ctx.data?.amount === 'number' && ctx.data.amount <= (mandate.cap ?? 0),
+*       audience: (ctx) => `invoice:${ctx.params?.id}`,
+*     }),
+*   },
+* });
+* ```
+*/
+/** Default grace window for mandate `expiresAt` — accommodates clock skew. */
+const DEFAULT_TTL_GRACE_MS = 3e4;
+/**
+* Require a sender-constrained credential — the inbound token MUST carry a
+* DPoP proof (RFC 9449) bound to a known key. Arc reads `scope.dpopJkt` (the
+* JWK SHA-256 thumbprint per RFC 7638); your `authenticate` function performs
+* the cryptographic `jose.dpop.verify(...)` and sets the field on success.
+*
+* **Pass behavior:**
+* - `service` scope where `dpopJkt` is set → grant
+* - `elevated` scope → grant (platform admin bypass)
+* - Anything else → deny with a clear reason
+*
+* Use for high-value endpoints where bearer-token replay must be impossible:
+* payment charges, data exports, account-takeover-class admin actions.
+*
+* @example
+* ```typescript
+* permissions: { charge: allOf(requireServiceScope('payment.write'), requireDPoP()) }
+* ```
+*/
+function requireDPoP() {
+	const check = (ctx) => {
+		const scope = getRequestScope(ctx.request);
+		if (isElevated(scope)) return true;
+		if (!isService(scope)) return {
+			granted: false,
+			reason: "DPoP-bound service identity required. Configure your authenticate callback to set scope.dpopJkt after verifying the DPoP proof header (RFC 9449)."
+		};
+		if (!getDPoPJkt(scope)) return {
+			granted: false,
+			reason: "Sender-constrained credential required (DPoP). Inbound token is bearer; replay-resistance is mandatory on this endpoint."
+		};
+		return true;
+	};
+	check._dpopRequired = true;
+	return check;
+}
+/**
+* Require a capability mandate (AP2 / x402 / MCP authorization) that
+* authorizes the action being attempted.
+*
+* The mandate is set on `request.scope.mandate` by your authenticate function
+* after verifying the inbound mandate JWT/VC. This check validates that the
+* presented mandate covers the requested capability, hasn't expired, is bound
+* to the right resource (when `audience` opt is set), and respects the
+* mandate's numeric ceiling (when `validateAmount` opt is set).
+*
+* **Pass behavior:**
+* - `elevated` scope → grant unless `noElevatedBypass: true`
+* - `service` scope with mandate matching `capability`, not expired, and
+*   passing `validateAmount` + `audience` checks → grant
+* - Anything else → deny with a precise reason
+*
+* Pair with `requireDPoP()` for replay-resistance, or use the bundled
+* `requireAgentScope(...)` to declare both at once.
+*
+* @example
+* ```typescript
+* // Single payment charge — amount must fit the mandate's cap
+* permissions: {
+*   pay: requireMandate('payment.charge', {
+*     validateAmount: (ctx, m) => (ctx.data as { amount: number }).amount <= (m.cap ?? 0),
+*     audience: (ctx) => `invoice:${ctx.params?.id}`,
+*   }),
+* }
+*
+* // Boolean capability — presence of mandate is the gate
+* permissions: {
+*   exportData: requireMandate('data.export'),
+* }
+* ```
+*/
+function requireMandate(capability, opts = {}) {
+	if (!capability || typeof capability !== "string") throw new Error("requireMandate(capability) requires a non-empty capability string (e.g. 'payment.charge')");
+	const ttlGrace = opts.ttlGraceMs ?? DEFAULT_TTL_GRACE_MS;
+	const noElevatedBypass = opts.noElevatedBypass === true;
+	const check = (ctx) => {
+		const scope = getRequestScope(ctx.request);
+		if (isElevated(scope) && !noElevatedBypass) return true;
+		const mandate = getMandate(scope);
+		if (!mandate) return {
+			granted: false,
+			reason: `Capability mandate required (${capability}). Configure your authenticate callback to populate request.scope.mandate after verifying the mandate JWT/VC.`
+		};
+		if (mandate.capability !== capability) return {
+			granted: false,
+			reason: `Mandate authorizes "${mandate.capability}", not "${capability}"`
+		};
+		if (mandate.expiresAt !== void 0 && Date.now() > mandate.expiresAt + ttlGrace) return {
+			granted: false,
+			reason: `Mandate expired at ${new Date(mandate.expiresAt).toISOString()}`
+		};
+		if (opts.audience) {
+			const required = typeof opts.audience === "function" ? opts.audience(ctx) : opts.audience;
+			if (required && mandate.audience && mandate.audience !== required) return {
+				granted: false,
+				reason: `Mandate is bound to "${mandate.audience}", not "${required}"`
+			};
+			if (required && !mandate.audience) return {
+				granted: false,
+				reason: `Mandate must be bound to "${required}" (no audience claim)`
+			};
+		}
+		if (opts.validateAmount) {
+			const result = opts.validateAmount(ctx, mandate);
+			if (result !== true) return {
+				granted: false,
+				reason: typeof result === "string" ? result : `Action exceeds mandate cap ${mandate.cap}${mandate.currency ? ` ${mandate.currency}` : ""}`
+			};
+		}
+		return true;
+	};
+	check._mandateCapability = capability;
+	return check;
+}
+/**
+* Composite gate for AI-agent / M2M flows on protected resources.
+*
+* Bundles the three things every high-value agent endpoint needs:
+* 1. **Service identity** — `scope.kind === 'service'` with `clientId`
+* 2. **Capability mandate** — narrows what *this request* may do
+* 3. **DPoP binding** — credential cannot be replayed from a different key
+*
+* Use this instead of hand-composing `allOf(requireServiceScope(...),
+* requireMandate(...), requireDPoP())` — fewer ways to misconfigure, one
+* meta-tag downstream tools (audit, MCP, OpenAPI) can read.
+*
+* @example
+* ```typescript
+* import { requireAgentScope } from '@classytic/arc/permissions';
+*
+* defineResource({
+*   name: 'invoice',
+*   actions: {
+*     pay: {
+*       handler: payInvoice,
+*       permissions: requireAgentScope({
+*         capability: 'payment.charge',
+*         scopes: ['payment.write'],
+*         requireDPoP: true,
+*         audience: (ctx) => `invoice:${ctx.params?.id}`,
+*         validateAmount: (ctx, m) => (ctx.data as { amount: number }).amount <= (m.cap ?? 0),
+*       }),
+*     },
+*   },
+* });
+* ```
+*/
+function requireAgentScope(opts) {
+	const { capability, scopes, requireDPoP: needsDPoP = true, ...mandateOpts } = opts;
+	if (!capability) throw new Error("requireAgentScope({ capability }) is required");
+	const mandateCheck = requireMandate(capability, mandateOpts);
+	const dpopCheck = needsDPoP ? requireDPoP() : null;
+	const requiredScopes = scopes && scopes.length > 0 ? [...scopes] : null;
+	const check = async (ctx) => {
+		const scope = getRequestScope(ctx.request);
+		if (isElevated(scope) && !mandateOpts.noElevatedBypass) return true;
+		if (!isService(scope)) return {
+			granted: false,
+			reason: "Service identity required (machine principal). Agent flows must authenticate as a service, not a logged-in user."
+		};
+		if (requiredScopes) {
+			const granted = scope.scopes ?? [];
+			if (!requiredScopes.some((s) => granted.includes(s))) return {
+				granted: false,
+				reason: `Service identity is missing required OAuth scope(s): ${requiredScopes.join(", ")}`
+			};
+		}
+		const mandateResult = await mandateCheck(ctx);
+		if (mandateResult !== true) return typeof mandateResult === "object" ? mandateResult : {
+			granted: false,
+			reason: "Mandate check failed"
+		};
+		if (dpopCheck) {
+			const dpopResult = await dpopCheck(ctx);
+			if (dpopResult !== true) return typeof dpopResult === "object" ? dpopResult : {
+				granted: false,
+				reason: "DPoP binding required"
+			};
+		}
+		return true;
+	};
+	check._agentScope = {
+		capability,
+		scopes: requiredScopes ?? void 0,
+		dpop: needsDPoP
+	};
+	return check;
+}
+//#endregion
 //#region src/permissions/scope.ts
 /**
 * Permission Scope — checks bound to RequestScope.
@@ -1343,4 +1343,4 @@ function readOnly(overrides) {
 	}, overrides);
 }
 //#endregion
-export { roles as A, allowPublic as C, requireAuth as D, not as E, requireAgentScope as M, requireDPoP as N, requireOwnership as O, requireMandate as P, allOf as S, denyAll as T, requireOrgMembership as _, permissionMatrix as a, requireServiceScope as b, publicReadAdminWrite as c, GRANT_MODES as d, modeSatisfies as f, requireOrgInScope as g, createOrgPermissions as h, ownerWithAdminBypass as i, when as j, requireRoles as k, readOnly as l, createDynamicPermissionMatrix as m, authenticated as n, presets_exports as o, requireGrant as p, fullPublic as r, publicRead as s, adminOnly as t, createRoleHierarchy as u, requireOrgRole as v, anyOf as w, requireTeamMembership as x, requireScopeContext as y };
+export { requireAuth as A, requireDPoP as C, anyOf as D, allowPublic as E, requireRoles as M, roles as N, denyAll as O, when as P, requireAgentScope as S, allOf as T, requireOrgMembership as _, permissionMatrix as a, requireServiceScope as b, publicReadAdminWrite as c, GRANT_MODES as d, modeSatisfies as f, requireOrgInScope as g, createOrgPermissions as h, ownerWithAdminBypass as i, requireOwnership as j, not as k, readOnly as l, createDynamicPermissionMatrix as m, authenticated as n, presets_exports as o, requireGrant as p, fullPublic as r, publicRead as s, adminOnly as t, createRoleHierarchy as u, requireOrgRole as v, requireMandate as w, requireTeamMembership as x, requireScopeContext as y };

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-BBsvQt7U.mjs";
+import { Ct as PipelineStep, Rt as IControllerResponse, St as PipelineContext, _t as Guard, bt as OperationFilter, vt as Interceptor, wt as Transform, xt as PipelineConfig, yt as NextFunction } from "../index-DPRH0Cme.mjs";
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {
   operations?: OperationFilter;

package/dist/{actionPermissions-lszoJle1.mjs → pipeline-BN5G05rd.mjs}

@@ -1,6 +1,6 @@
-import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-bHblZ9YN.mjs";
+import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
 import { i as applyFieldReadPermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
-import { t as getUserRoles } from "./types-XTApa8b6.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/scope/projection.ts
@@ -334,27 +334,4 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 	};
 }
 //#endregion
-//#region src/core/actionPermissions.ts
-/**
-* Return the effective `PermissionCheck` for a single action, or `undefined`
-* when the resource declares no gate at any level.
-*
-* Callers decide what "no gate" means:
-*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
-*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
-*     two surfaces fail closed identically so MCP can't expose an
-*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
-*     run).
-*   - OpenAPI: docs advertise the endpoint as unauthenticated.
-*/
-function resolveActionPermission(input) {
-	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
-	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
-	if (explicit) return explicit;
-	if (resourceActionPermissions) return resourceActionPermissions;
-	if (globalAuth) return globalAuth;
-	const updateFallback = resourcePermissions?.update;
-	if (updateFallback) return updateFallback;
-}
-//#endregion
-export { createCrudHandlers as a, getControllerContext as c, buildRequestScopeProjection as d, resolvePipelineSteps as i, getControllerScope as l, buildActionPipelineHandler as n, createFastifyHandler as o, buildPipelineHandler as r, createRequestContext as s, resolveActionPermission as t, sendControllerResponse as u };
+export { createFastifyHandler as a, getControllerScope as c, createCrudHandlers as i, sendControllerResponse as l, buildPipelineHandler as n, createRequestContext as o, resolvePipelineSteps as r, getControllerContext as s, buildActionPipelineHandler as t, buildRequestScopeProjection as u };

package/dist/plugins/index.d.mts

@@ -1,7 +1,9 @@
-import { At as RouteDefinition, J as PresetHook, Jt as AnyRecord, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-BBsvQt7U.mjs";
+import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-DPRH0Cme.mjs";
+import { c as AnyRecord } from "../types-Dmw-6Qeo.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-C6yv4ZTW.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-g_f9omSc.mjs";
-import { C as healthPlugin, S as _default$3, _ as CachingRule, a as MetricsCollector, b as HealthCheck, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, x as HealthOptions, y as cachingPlugin } from "../versioning-D6PvCwpq.mjs";
+import { C as schedulesPlugin, D as healthPlugin, E as _default$3, S as _default$7, T as HealthOptions, b as ScheduleStats, w as HealthCheck, x as SchedulesPluginOptions, y as ScheduleDefinition } from "../index-KUoxjIq1.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-dPNBVeIj.mjs";
+import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-DXgY5BUm.mjs";
 import { t as TracingOptions } from "../tracing-CsGKQJGg.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
@@ -165,77 +167,4 @@ declare function createRequestIdGenerator(opts?: Pick<RequestIdOptions, "header"
 declare const requestIdPlugin: FastifyPluginAsync<RequestIdOptions>;
 declare const _default$6: FastifyPluginAsync<RequestIdOptions>;
 //#endregion
-//#region src/plugins/schedules.d.ts
-/**
- * Structural view of the ecosystem lock contract — matches
- * `LockAdapter` from `@classytic/repo-core/lock` (and every kit
- * implementation) WITHOUT importing the subpath, so arc's emitted
- * declarations carry no repo-core@>=0.8 subpath reference and the
- * peer floor stays honest. Any conforming adapter assigns.
- */
-interface ScheduleLockLike {
-  tryAcquire(name: string, holderId: string, leaseMs: number): Promise<boolean> | boolean;
-  release(name: string, holderId: string): Promise<boolean> | boolean;
-}
-interface ScheduleDefinition {
-  /** Unique name — also the lock key (`arc:schedule:<name>`). */
-  name: string;
-  /** Interval in milliseconds between the END of one run and the next tick. */
-  every: number;
-  /** The work. Receives the Fastify instance; errors are logged, never fatal. */
-  handler: (fastify: FastifyInstance) => void | Promise<void>;
-  /** Fire once immediately when the app becomes ready (default: false). */
-  runOnStart?: boolean;
-  /**
-   * Random extra delay in `[0, jitterMs)` added to the FIRST tick only.
-   * Spreads boot-aligned jobs so multiple same-cadence schedules don't all
-   * fire at exactly `boot + every` after every restart (and, with a lock,
-   * de-synchronizes replicas competing for the same lease). Ignored when
-   * `runOnStart` is true.
-   */
-  jitterMs?: number;
-  /**
-   * Lease duration when a `lock` is configured. Default: `every * 0.9`
-   * (capped at 5 minutes) — long enough that other replicas skip the same
-   * tick, short enough that a crashed leader fails over within one cycle.
-   */
-  leaseMs?: number;
-  /** Per-schedule kill switch (default: true). */
-  enabled?: boolean;
-}
-interface SchedulesPluginOptions {
-  schedules: ScheduleDefinition[];
-  /**
-   * Ecosystem lock adapter for multi-replica deployments. Omit for
-   * single-instance apps — every tick runs locally.
-   */
-  lock?: ScheduleLockLike;
-  /**
-   * Identity of this replica for lease ownership. Default: a random id per
-   * process (repo-core's `getInstanceId()` is a good explicit value).
-   */
-  holderId?: string;
-  /**
-   * Master switch — `false` registers a typed no-op (config-gated
-   * environments), same pattern as `idempotencyPlugin`.
-   */
-  enabled?: boolean;
-}
-/** Per-schedule runtime counters, readable via `fastify.getScheduleStats()`. */
-interface ScheduleStats {
-  name: string;
-  runs: number;
-  failures: number;
-  skippedByLock: number;
-  lastRunAt: string | null;
-  lastError: string | null;
-}
-declare module "fastify" {
-  interface FastifyInstance {
-    getScheduleStats?: () => ScheduleStats[];
-  }
-}
-declare const schedulesPlugin: FastifyPluginAsync<SchedulesPluginOptions>;
-declare const _default$7: FastifyPluginAsync<SchedulesPluginOptions>;
-//#endregion
-export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleLockLike, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$6 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$7 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$8 as ssePlugin, ssePlugin as ssePluginFn, _default$9 as versioningPlugin, versioningPlugin as versioningPluginFn };
+export { type ArcCore, type ArcCorePluginOptions, type ArcPlugin, type CachingOptions, type CachingRule, type ChangeOperation, type CreatePluginDefinition, type ErrorHandlerOptions, type ErrorMapper, type GracefulShutdownOptions, type HealthCheck, type HealthOptions, type MetricEntry, type MetricsCollector, type MetricsOptions, type PluginMeta, type PluginResourceResult, type RealtimeOptions, type RequestIdOptions, type SSEOptions, type ScheduleDefinition, type ScheduleStats, type SchedulesPluginOptions, type TracingOptions, type VersioningOptions, _default as arcCorePlugin, arcCorePlugin as arcCorePluginFn, _default$1 as cachingPlugin, cachingPlugin as cachingPluginFn, createPlugin, createRequestIdGenerator, defaultIsDuplicateKeyError, errorHandlerPlugin, errorHandlerPlugin as errorHandlerPluginFn, _default$2 as gracefulShutdownPlugin, gracefulShutdownPlugin as gracefulShutdownPluginFn, _default$3 as healthPlugin, healthPlugin as healthPluginFn, _default$4 as metricsPlugin, metricsPlugin as metricsPluginFn, _default$5 as realtimePlugin, realtimePlugin as realtimePluginFn, replyHelpersPlugin, _default$6 as requestIdPlugin, requestIdPlugin as requestIdPluginFn, sanitizeRequestId, _default$7 as schedulesPlugin, schedulesPlugin as schedulesPluginFn, _default$8 as ssePlugin, ssePlugin as ssePluginFn, _default$9 as versioningPlugin, versioningPlugin as versioningPluginFn };