@classytic/arc 2.25.0 → 2.30.0

package/README.md

@@ -1,5 +1,7 @@
 # @classytic/arc
 
+[![Sponsor](https://img.shields.io/github/sponsors/classytic?style=flat-square&label=Sponsor&logo=GitHub&color=EA4AAA)](https://github.com/sponsors/classytic)
+
 Database-agnostic resource framework for Fastify. One `defineResource()` call -> REST + auth + permissions + events + caching + OpenAPI + MCP tools.
 
 Fastify 5+ | Node.js 22+ | ESM only

package/dist/{BaseController--M8EMzt0.mjs → BaseController-B5DwufbB.mjs}

@@ -1,10 +1,12 @@
 import { h as SYSTEM_FIELDS, o as DEFAULT_TENANT_FIELD } from "./constants-DNre0wRg.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { d as createDomainError, f as createError, i as NotFoundError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { d as createDomainError, f as createError, i as NotFoundError, p as isArcError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { n as getUserRoles, t as getUserId } from "./userHelpers-Cg_y3fBz.mjs";
 import { b as isElevated, c as getOrgId, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
 import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-Cg05HPsn.mjs";
-import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-Tw4iXtlf.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-Dz8k3S4P.mjs";
+import { o as conjoinPolicyFilters } from "./applyPermissionResult-Cf6zUCvb.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CQ_7KQWw.mjs";
 import { g as ArcQueryParser, n as scheduleBackground } from "./utils-taUVD4p3.mjs";
 import { t as buildQueryKey } from "./keys-Cd316u_y.mjs";
 //#region src/core/AccessControl.ts
@@ -38,7 +40,7 @@ var AccessControl = class {
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
 		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filter[this.tenantField] = orgId;
-		return filter;
+		return toRepositoryFilter(filter);
 	}
 	/**
 	* Check if a post-fetch item matches the request's `_policyFilters`.
@@ -110,9 +112,9 @@ var AccessControl = class {
 	checkOwnership(item, req) {
 		const ownershipCheck = this._meta(req)?._ownershipCheck;
 		if (!item || !ownershipCheck) return true;
-		const { field, userId } = ownershipCheck;
+		const { field, userId, missingOwner } = ownershipCheck;
 		const itemOwnerId = item[field];
-		if (!itemOwnerId) return true;
+		if (!itemOwnerId) return missingOwner === "allow";
 		return String(itemOwnerId) === String(userId);
 	}
 	/**
@@ -453,6 +455,7 @@ async function executeHookedOp(ctx, args, executor) {
 		const beforeReturn = await hooks.executeBefore(resourceName, args.op, args.input, hookOpts);
 		if (pipeProcessed) processedData = beforeReturn;
 	} catch (err) {
+		if (isArcError(err)) throw err;
 		throw createError(400, "Hook execution failed", {
 			code: `BEFORE_${args.op.toUpperCase()}_HOOK_ERROR`,
 			message: err.message
@@ -669,12 +672,12 @@ var QueryResolver = class {
 		const page = parsed.after ? void 0 : parsed.page ? Math.max(1, parsed.page) : 1;
 		const sortString = parsed.sort ? Object.entries(parsed.sort).map(([k, v]) => v === -1 ? `-${k}` : k).join(",") : this.defaultSort;
 		const rawSelect = parsed.select ?? req.query?.select;
-		const filters = { ...parsed.filters };
 		const policyFilters = arcContext?._policyFilters;
-		if (policyFilters) Object.assign(filters, policyFilters);
+		let filters = conjoinPolicyFilters(parsed.filters, policyFilters);
 		const scope = arcContext?._scope;
 		const orgId = scope ? getOrgId(scope) : void 0;
-		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters[this.tenantField] = orgId;
+		if (this.tenantField && orgId && !policyFilters?.[this.tenantField]) filters = conjoinPolicyFilters(filters, { [this.tenantField]: orgId });
+		const portableFilters = toRepositoryFilter(filters);
 		return {
 			page,
 			limit,
@@ -683,7 +686,7 @@ var QueryResolver = class {
 			populate: this.sanitizePopulate(parsed.populate, this.schemaOptions),
 			populateOptions: this.sanitizePopulateOptions(parsed.populateOptions, this.schemaOptions),
 			lookups: this.sanitizeLookups(parsed.lookups, this.schemaOptions),
-			filters,
+			filters: portableFilters,
 			search: parsed.search,
 			after: parsed.after,
 			user: req.user,
@@ -799,7 +802,7 @@ var BaseCrudController = class {
 	/**
 	* Composable access control (ID filtering, policy checks, org scope, ownership).
 	*
-	* Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+	* Not `readonly` — `configure()` rebuilds it when the host
 	* supplies tenant/idField/matchesFilter post-construction. Same model as
 	* `queryResolver` after `setQueryParser` shipped in 2.10.9.
 	*/
@@ -807,7 +810,7 @@ var BaseCrudController = class {
 	/**
 	* Composable body sanitization (field permissions, system fields).
 	*
-	* Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+	* Not `readonly` — `configure()` rebuilds it when the host
 	* supplies schemaOptions/onFieldWriteDenied post-construction.
 	*/
 	bodySanitizer;
@@ -1683,6 +1686,7 @@ function SoftDeleteMixin(Base) {
 					meta: { id }
 				});
 			} catch (err) {
+				if (isArcError(err)) throw err;
 				throw createError(400, "Hook execution failed", {
 					code: "BEFORE_RESTORE_HOOK_ERROR",
 					message: err.message

package/dist/EventTransport-C6YA8xY9.mjs

@@ -0,0 +1,103 @@
+import { createEvent, matchEventPattern } from "@classytic/primitives/events";
+//#region src/events/EventTransport.ts
+/**
+* Internal arc events module — concrete in-memory transport.
+*
+* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
+* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
+* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
+* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
+* Two reasons:
+*
+*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
+*      audit-log plugin, future kits and downstream services all share them.
+*      Owning them in `primitives` (pure types, zero runtime, zero deps)
+*      eliminates the "manually mirror in two places" problem the previous
+*      `primitives/src/events.ts` header explicitly called out.
+*   2. Inverting the dependency direction lets future packages (sqlitekit
+*      audit, billing services) consume the contract without depending on
+*      arc's HTTP-coupled stack.
+*
+* Hosts MUST import the types from primitives directly:
+*
+* ```typescript
+* import type {
+*   EventMeta, DomainEvent, EventHandler, EventTransport,
+*   DeadLetteredEvent, PublishManyResult,
+* } from '@classytic/primitives/events';
+* import { createEvent, createChildEvent } from '@classytic/primitives/events';
+* ```
+*
+* arc's `events/index.ts` barrel does NOT re-export these — by design, so
+* that consumer code is forced into the canonical import path and the org's
+* "no re-exports" rule holds at every public surface.
+*
+* What stays here:
+*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
+*     used as arc's default transport. Its handler-set state is process-local;
+*     wrong layer for primitives.
+*   - `MemoryEventTransportOptions` — its options shape.
+*
+* Inside arc, files that previously imported types from `./EventTransport.js`
+* keep working: this file re-exports them from primitives for arc's own
+* call sites. That re-export is an internal refactor convenience — the
+* public `events/index.ts` barrel stays clean.
+*/
+/**
+* In-memory event transport (default).
+*
+* Events are delivered synchronously within the process. Not suitable for
+* multi-instance deployments — pair with `RedisEventTransport` /
+* `RedisStreamTransport` (subpath imports) for those.
+*/
+var MemoryEventTransport = class {
+	name = "memory";
+	handlers = /* @__PURE__ */ new Map();
+	logger;
+	constructor(options) {
+		this.logger = options?.logger ?? console;
+	}
+	async publish(event) {
+		const allHandlers = /* @__PURE__ */ new Set();
+		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
+		for (const handler of allHandlers) try {
+			await handler(event);
+		} catch (err) {
+			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
+		}
+	}
+	/**
+	* Reference `publishMany` implementation — delegates to `publish()` in order.
+	*
+	* Production transports (Kafka, Redis pipeline, SQS batch) should override
+	* this with a single batched network call. Memory transport has nothing to
+	* batch, so we just loop — the loop still returns a proper result map so
+	* `EventOutbox.relay` can exercise the batched code path in tests.
+	*/
+	async publishMany(events) {
+		const results = /* @__PURE__ */ new Map();
+		for (const event of events) try {
+			await this.publish(event);
+			results.set(event.meta.id, null);
+		} catch (err) {
+			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
+		}
+		return results;
+	}
+	async subscribe(pattern, handler) {
+		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
+		this.handlers.get(pattern)?.add(handler);
+		return () => {
+			const set = this.handlers.get(pattern);
+			if (set) {
+				set.delete(handler);
+				if (set.size === 0) this.handlers.delete(pattern);
+			}
+		};
+	}
+	async close() {
+		this.handlers.clear();
+	}
+};
+//#endregion
+export { createEvent as n, MemoryEventTransport as t };

package/dist/{HookSystem-C1vB_Gc9.mjs → HookSystem-WkIougo6.mjs}

@@ -1,4 +1,15 @@
+import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
 //#region src/hooks/HookSystem.ts
+/**
+* Hook System
+*
+* Lifecycle hooks for resource operations.
+* Allows intercepting and modifying data at various points.
+*/
+/** Lift the validated scope out of the request context (undefined when unscoped). */
+function scopeOf(context) {
+	return buildRequestScopeProjection(context?._scope);
+}
 var HookSystem = class {
 	hooks;
 	logger;
@@ -9,16 +20,10 @@ var HookSystem = class {
 		this.logger = options?.logger ?? { error: noop };
 		this.warn = options?.logger?.warn ?? noop;
 	}
-	/**
-	* Generate hook key
-	*/
 	getKey(resource, operation, phase) {
 		return `${resource}:${operation}:${phase}`;
 	}
-	/**
-	* Register a hook
-	* Supports both object parameter and positional arguments
-	*/
+	/** Supports both the object-parameter and positional argument forms. */
 	register(resourceOrOptions, operation, phase, handler, priority = 10) {
 		let hookName;
 		let resource;
@@ -63,15 +68,9 @@ var HookSystem = class {
 			if (idx !== -1) hooks.splice(idx, 1);
 		};
 	}
-	/**
-	* Register before hook
-	*/
 	before(resource, operation, handler, priority = 10) {
 		return this.register(resource, operation, "before", handler, priority);
 	}
-	/**
-	* Register after hook
-	*/
 	after(resource, operation, handler, priority = 10) {
 		return this.register(resource, operation, "after", handler, priority);
 	}
@@ -105,6 +104,7 @@ var HookSystem = class {
 					data,
 					user: options?.user,
 					context: options?.context,
+					scope: scopeOf(options?.context),
 					meta: options?.meta
 				};
 				return hook.handler(ctx, next);
@@ -113,9 +113,6 @@ var HookSystem = class {
 		};
 		return next();
 	}
-	/**
-	* Execute hooks for a given context
-	*/
 	async execute(ctx) {
 		const key = this.getKey(ctx.resource, ctx.operation, ctx.phase);
 		const hooks = this.hooks.get(key) ?? [];
@@ -133,6 +130,7 @@ var HookSystem = class {
 				result: ctx.result,
 				user: ctx.user,
 				context: ctx.context,
+				scope: ctx.scope ?? scopeOf(ctx.context),
 				meta: ctx.meta
 			};
 			const hookResult = await hook.handler(handlerContext);
@@ -140,9 +138,6 @@ var HookSystem = class {
 		}
 		return result;
 	}
-	/**
-	* Execute before hooks
-	*/
 	async executeBefore(resource, operation, data, options) {
 		return await this.execute({
 			resource,
@@ -154,10 +149,7 @@ var HookSystem = class {
 			meta: options?.meta
 		}) ?? data;
 	}
-	/**
-	* Execute after hooks
-	* Errors in after hooks are logged but don't fail the request
-	*/
+	/** Errors in after hooks are logged but never fail the request. */
 	async executeAfter(resource, operation, result, options) {
 		try {
 			await this.execute({
@@ -226,17 +218,11 @@ var HookSystem = class {
 		}
 		return result;
 	}
-	/**
-	* Get all registered hooks
-	*/
 	getAll() {
 		const all = [];
 		for (const hooks of this.hooks.values()) all.push(...hooks);
 		return all;
 	}
-	/**
-	* Get hooks for a specific resource
-	*/
 	getForResource(resource) {
 		const all = [];
 		for (const [key, hooks] of this.hooks.entries()) if (key.startsWith(`${resource}:`)) all.push(...hooks);
@@ -298,15 +284,9 @@ var HookSystem = class {
 		const key = this.getKey(resource, operation, phase);
 		return (this.hooks.get(key)?.length ?? 0) > 0;
 	}
-	/**
-	* Clear all hooks
-	*/
 	clear() {
 		this.hooks.clear();
 	}
-	/**
-	* Clear hooks for a specific resource
-	*/
 	clearResource(resource) {
 		for (const key of this.hooks.keys()) if (key.startsWith(`${resource}:`)) this.hooks.delete(key);
 	}

package/dist/applyPermissionResult-Cf6zUCvb.mjs

@@ -0,0 +1,257 @@
+import { arcLog } from "./logger/index.mjs";
+import { t as ArcError } from "./errors-DkO8Nk6-.mjs";
+//#region src/permissions/filter-merge.ts
+/**
+* Policy-filter composition — logical AND, never last-writer-wins.
+*
+* Row-level policy filters can arrive from several INDEPENDENT sources for one
+* request: a tenant preset, an `ownedByUser` grant, an `allOf(...)` branch, a
+* host permission check. Every one of them is a RESTRICTION the row must
+* satisfy, so composing them is logical AND.
+*
+* The historical `{ ...base, ...incoming }` shallow spread did NOT implement AND:
+* when two sources constrained the SAME key with different values, the later one
+* silently REPLACED the earlier one — widening (or erasing) a restriction another
+* layer deliberately imposed. That is a defense-in-depth defect, not a
+* refinement. "Later can refine" is only sound when the refinement is provably
+* narrower, and a bare overwrite proves nothing.
+*
+* {@link conjoinPolicyFilters} composes with AND semantics while preserving the
+* common case byte-for-byte:
+*
+*  - key present on only one side      → carried through flat. Non-overlapping
+*    filters (the ~99% case) produce exactly the same object the old spread did,
+*    so there is ZERO behavior change for them.
+*  - same key, deep-equal value        → kept once (idempotent — e.g. two checks
+*    both pinning the same `organizationId`).
+*  - same key, DIFFERENT value         → BOTH constraints are preserved under an
+*    `$and`, so a row must satisfy both. For flat equality that conjunction is
+*    unsatisfiable, so the query returns nothing — the safe, correct outcome for
+*    contradictory policies (deny), and the earlier restriction is never dropped.
+*
+* Adapter safety: mongokit / sqlitekit compile `$and` natively at the DB layer,
+* and arc's in-memory `simpleEqualityMatcher` (AccessControl.checkPolicyFilters)
+* already fail-closes on operator-shaped filters. So a produced `$and` is either
+* evaluated correctly by the DB or rejected fail-closed in memory — both safe.
+*
+* This is the pragmatic, adapter-neutral form of the AND semantics. A canonical
+* filter IR in `repo-core` (nested and/or/not nodes each adapter compiles) is the
+* fuller design, but this closes the security defect without one.
+*/
+/**
+* Validate + return a `$and` operand's fragment array. A security-policy
+* normalizer must NEVER silently drop a malformed constraint — a non-array
+* `$and` (e.g. `{ $and: { organizationId: "a" } }`) is a policy bug, so fail
+* loud (fail-closed) rather than discard the restriction it was meant to carry.
+*/
+function coercePolicyAnd(value) {
+	if (!Array.isArray(value)) throw new Error(`conjoinPolicyFilters: malformed '$and' — expected an array of filter fragments, got ${value === null ? "null" : typeof value}. A policy filter constraint must not be silently dropped.`);
+	return value;
+}
+/** Are two flat policy-filter values equivalent for conjunction purposes? */
+function filterValueEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (a !== null && b !== null && typeof a === "object" && typeof b === "object") try {
+		return JSON.stringify(a) === JSON.stringify(b);
+	} catch {
+		return false;
+	}
+	return false;
+}
+/**
+* Conjoin two policy-filter maps with AND semantics. Never silently overwrites a
+* same-key constraint with a different value — conflicting keys are preserved
+* under `$and`. See the module doc for the full contract.
+*/
+function conjoinPolicyFilters(base, incoming) {
+	const baseEmpty = !base || Object.keys(base).length === 0;
+	const incomingEmpty = !incoming || Object.keys(incoming).length === 0;
+	if (baseEmpty) return incomingEmpty ? {} : { ...incoming };
+	if (incomingEmpty) return { ...base };
+	const result = {};
+	const andParts = [];
+	const baseAnd = base.$and;
+	if (baseAnd !== void 0) andParts.push(...coercePolicyAnd(baseAnd));
+	for (const [key, value] of Object.entries(base)) {
+		if (key === "$and") continue;
+		result[key] = value;
+	}
+	for (const [key, value] of Object.entries(incoming)) {
+		if (key === "$and") {
+			andParts.push(...coercePolicyAnd(value));
+			continue;
+		}
+		if (!(key in result)) {
+			result[key] = value;
+			continue;
+		}
+		if (filterValueEqual(result[key], value)) continue;
+		andParts.push({ [key]: result[key] }, { [key]: value });
+		delete result[key];
+	}
+	if (andParts.length > 0) result.$and = andParts;
+	return result;
+}
+//#endregion
+//#region src/permissions/applyPermissionResult.ts
+const log = arcLog("permissions:enforce");
+/**
+* Normalize a check return into the canonical {@link AuthorizationDecision}.
+* A boolean promotes to `{ effect: "allow" | "deny" }`; a decision passes
+* through. This is the ONE place booleans are promoted, so the rest of the
+* pipeline only ever handles decisions.
+*/
+function normalizeToDecision(result) {
+	return typeof result === "boolean" ? { effect: result ? "allow" : "deny" } : result;
+}
+/**
+* Run a permission check once and classify the result. The single source of the
+* try/normalize/catch sequence — see {@link PermissionOutcome}. Non-`ArcError`
+* throws are logged once here through arc's namespaced logger (a deliberate
+* `ArcError` denial is expected control-flow, not a warning). Pure w.r.t. the
+* request — neither reads a reply nor mutates the request.
+*/
+async function evaluatePermissionOutcome(check, context) {
+	try {
+		return {
+			status: "decided",
+			decision: normalizeToDecision(await check(context))
+		};
+	} catch (err) {
+		if (err instanceof ArcError) return {
+			status: "structured",
+			error: err
+		};
+		log.warn({
+			err,
+			resource: context.resource,
+			action: context.action
+		}, "Permission check threw — denying (fail-closed)");
+		return {
+			status: "failed",
+			error: err
+		};
+	}
+}
+/**
+* Run a permission check and return a canonical {@link AuthorizationDecision} —
+* the transport-neutral PDP (HTTP, aggregation, MCP, and any future transport).
+* A thin mapper over {@link evaluatePermissionOutcome}:
+*
+*   - a structured `ArcError` is RE-THROWN so the transport surfaces it verbatim
+*     (e.g. a tier gate throwing `arc.tier_required` with machine-readable meta);
+*   - any OTHER throw is fail-closed to a `deny` decision (a broken check must
+*     never fall open to a 500 that skips authorization).
+*
+* Pure w.r.t. the request — it neither reads a reply nor mutates the request.
+* Callers translate the returned decision into their own response mechanism and
+* apply side-effects via {@link applyAuthorizationDecision}. HTTP additionally
+* hardens a *thrown* check to 403-even-when-anonymous — that transport-specific
+* nuance lives in {@link evaluateAndApplyPermission}, not here.
+*/
+async function evaluatePermissionDecision(check, context) {
+	const outcome = await evaluatePermissionOutcome(check, context);
+	switch (outcome.status) {
+		case "decided": return outcome.decision;
+		case "structured": throw outcome.error;
+		case "failed": return { effect: "deny" };
+	}
+}
+/**
+* Apply an allowed {@link AuthorizationDecision} to a Fastify request — conjoins
+* the decision's row-level `policy` into `_policyFilters` and conditionally
+* installs the `scope`.
+*
+* **Scope install rule:** only writes `scope` when the current request scope
+* is absent or `public`. This prevents downgrading an already-authenticated
+* request (e.g. Better Auth set `member`, then a permission check returns a
+* narrower `service` scope — the original `member` wins because it came from
+* a more authoritative source).
+*
+* Safe to call with a denied decision — it simply no-ops. Callers should still
+* check `decision.effect` and send an error response before reaching here, but
+* this function tolerates the misuse defensively.
+*
+* This is the enforcement point (PEP) — the ONE place scope + data policy are
+* installed (and the obligation seam lives).
+*/
+function applyAuthorizationDecision(decision, request) {
+	if (decision.effect !== "allow") return;
+	if (decision.policy) request._policyFilters = conjoinPolicyFilters(request._policyFilters, decision.policy);
+	if (decision.scope) {
+		const current = request.scope;
+		if (!current || current.kind === "public") request.scope = decision.scope;
+	}
+}
+/**
+* @deprecated Renamed to {@link applyAuthorizationDecision} — the contract is an
+* `AuthorizationDecision`, not a `PermissionResult`. This alias is kept for
+* back-compat and will be removed in a future major.
+*/
+const applyPermissionResult = applyAuthorizationDecision;
+/**
+* Max length of a decision `reason` string before we fall back to the
+* generic default message. Upstream checks can return arbitrary strings; we
+* clamp to prevent accidental leakage of internal diagnostics or oversized
+* payloads via the 4xx response body.
+*/
+const MAX_DENIAL_REASON_LENGTH = 100;
+/**
+* End-to-end HTTP PEP: evaluates the check through the shared
+* {@link evaluatePermissionOutcome} core, sends a 401/403 response on denial,
+* and applies side-effects on grant. Returns `true` if the caller should
+* continue, `false` if a response has been sent and the caller should return.
+*
+* The HTTP specialization of the ONE evaluation core — it does NOT re-run or
+* re-normalize the check; it only maps the classified outcome onto Fastify:
+*
+*   - `structured` (thrown `ArcError`) → surface verbatim, byte-compatible with
+*     the global error handler (`code`/`message`/`status` + `meta`);
+*   - `failed` (other throw) → 403 EVEN WHEN ANONYMOUS (a broken check is a hard
+*     denial, not a "please authenticate");
+*   - `decided` → allow, or a returned deny → 401 (no user) / 403 (user) with a
+*     clamped `reason`.
+*
+* Context construction, pre-check auth gating, and success-path handler
+* invocation stay at the callsite — those are genuinely different per router
+* and don't belong here.
+*
+* @returns `true` if authorized (caller continues), `false` if a response was sent
+*/
+async function evaluateAndApplyPermission(check, context, request, reply, opts) {
+	const outcome = await evaluatePermissionOutcome(check, context);
+	if (outcome.status === "structured") {
+		const err = outcome.error;
+		reply.code(err.status).send({
+			code: err.code,
+			message: err.message,
+			status: err.status,
+			...err.meta ? { meta: err.meta } : {}
+		});
+		return false;
+	}
+	if (outcome.status === "failed") {
+		reply.code(403).send({
+			code: "arc.forbidden",
+			message: "Permission denied",
+			status: 403
+		});
+		return false;
+	}
+	const { decision } = outcome;
+	if (decision.effect !== "allow") {
+		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
+		const reason = decision.reason && decision.reason.length <= MAX_DENIAL_REASON_LENGTH ? decision.reason : defaultMsg;
+		const status = context.user ? 403 : 401;
+		reply.code(status).send({
+			code: context.user ? "arc.forbidden" : "arc.unauthorized",
+			message: reason,
+			status
+		});
+		return false;
+	}
+	applyAuthorizationDecision(decision, request);
+	return true;
+}
+//#endregion
+export { normalizeToDecision as a, evaluatePermissionDecision as i, applyPermissionResult as n, conjoinPolicyFilters as o, evaluateAndApplyPermission as r, applyAuthorizationDecision as t };

package/dist/audit/index.d.mts

@@ -1,5 +1,5 @@
-import "../index-DPRH0Cme.mjs";
-import { i as UserBase } from "../types-Dmw-6Qeo.mjs";
+import "../index-Q5gzEIWY.mjs";
+import { a as UserBase } from "../types-ChvvVNP8.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { RepositoryLike } from "@classytic/repo-core/adapter";
 //#region src/audit/stores/interface.d.ts

package/dist/audit/index.mjs

@@ -1,6 +1,6 @@
 import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
-import fp from "fastify-plugin";
 import { and, anyOf, eq, gte, lt, lte } from "@classytic/repo-core/filter";
+import fp from "fastify-plugin";
 //#region src/audit/repository-audit-adapter.ts
 function repositoryAsAuditStore(repository, options = {}) {
 	const idField = repository.idField ?? "_id";

package/dist/auth/index.d.mts

@@ -1,5 +1,5 @@
-import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-DPRH0Cme.mjs";
-import { t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
+import { Ht as AuthHelpers, Ut as AuthPluginOptions } from "../index-Q5gzEIWY.mjs";
+import { r as PermissionCheck } from "../types-ChvvVNP8.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { a as SessionManagerOptions, c as createSessionManager, i as SessionData, n as MemorySessionStoreOptions, o as SessionManagerResult, r as SessionCookieOptions, s as SessionStore, t as MemorySessionStore } from "../sessionManager-BHOM3N_0.mjs";
 import { FastifyPluginAsync, FastifyReply as FastifyReply$1, FastifyRequest } from "fastify";

package/dist/auth/index.mjs

@@ -2,7 +2,7 @@ import { d as createDomainError, l as UnauthorizedError, p as isArcError, t as A
 import { n as requireSingleHeaderValue } from "../headers-BvlQSDMB.mjs";
 import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
 import { o as toJsonSchema } from "../schemaConverter-DJvodiHj.mjs";
-import { _ as requireOrgMembership, v as requireOrgRole, x as requireTeamMembership } from "../permissions-BrtiBKGs.mjs";
+import { S as requireOrgRole, T as requireTeamMembership, x as requireOrgMembership } from "../permissions-Bfu_8y1U.mjs";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/auth/authPlugin.ts