@classytic/arc 2.25.0 → 2.30.0

package/dist/events/index.mjs

@@ -1,192 +1,10 @@
-import { a as MemoryEventTransport, i as withRetry, o as createEvent, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-DrQ_FesK.mjs";
+import { t as MemoryEventTransport } from "../EventTransport-C6YA8xY9.mjs";
+import { a as createEventRegistry, i as wrapWithSchema, n as subscribeWithSchema, o as defineEvent, r as wrapWithBoundary, t as subscribeWithBoundary } from "../subscribe-helpers-DfzsivM6.mjs";
+import { i as withRetry, r as createDeadLetterPublisher, t as eventPlugin } from "../eventPlugin-D2NNR4py.mjs";
 import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DY6xq4sM.mjs";
-import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
 import { and, anyOf, eq, lte, ne, or } from "@classytic/repo-core/filter";
+import { InvalidOutboxEventError, OutboxOwnershipError } from "@classytic/primitives/outbox";
 import { update } from "@classytic/repo-core/update";
-//#region src/events/defineEvent.ts
-/**
-* defineEvent — Typed Event Definitions with Optional Schema Validation
-*
-* Provides:
-* 1. defineEvent() — declare an event with name, schema, version, description
-* 2. EventRegistry — catalog of all known events + payload validation
-* 3. .create() helper — build DomainEvent with auto-generated metadata
-*
-* The built-in validator checks: object type, required fields, and top-level
-* property types. It does NOT recurse into nested objects, validate arrays,
-* enums, patterns, formats, or $ref. This is intentional — it's a lightweight
-* guard, not a full JSON Schema engine.
-*
-* For full validation, pass a custom `validate` function to `createEventRegistry()`:
-*
-* @example
-* ```typescript
-* import Ajv from 'ajv';
-* const ajv = new Ajv();
-*
-* const registry = createEventRegistry({
-*   validate: (schema, payload) => {
-*     const valid = ajv.validate(schema, payload);
-*     return valid
-*       ? { valid: true }
-*       : { valid: false, errors: ajv.errorsText().split(', ') };
-*   },
-* });
-* ```
-*
-* @example
-* ```typescript
-* import { defineEvent, createEventRegistry } from '@classytic/arc/events';
-*
-* const OrderCreated = defineEvent({
-*   name: 'order.created',
-*   version: 1,
-*   schema: {
-*     type: 'object',
-*     properties: {
-*       orderId: { type: 'string' },
-*       total: { type: 'number' },
-*     },
-*     required: ['orderId', 'total'],
-*   },
-* });
-*
-* // Type-safe event creation
-* const event = OrderCreated.create({ orderId: 'o-1', total: 100 });
-* await fastify.events.publish(event.type, event.payload, event.meta);
-*
-* // Registry for introspection + validation
-* const registry = createEventRegistry();
-* registry.register(OrderCreated);
-* const result = registry.validate('order.created', payload);
-* ```
-*/
-/**
-* Define a typed event with optional schema validation.
-*
-* @example
-* const OrderCreated = defineEvent({
-*   name: 'order.created',
-*   schema: { type: 'object', properties: { orderId: { type: 'string' } }, required: ['orderId'] },
-* });
-*
-* const event = OrderCreated.create({ orderId: '123' });
-*/
-function defineEvent(input) {
-	const { name, schema, version = 1, description } = input;
-	return {
-		name,
-		schema,
-		version,
-		description,
-		create(payload, meta) {
-			return createEvent(name, payload, {
-				schemaVersion: version,
-				...meta
-			});
-		}
-	};
-}
-/**
-* Create an event registry for cataloging and validating events.
-*
-* The registry is opt-in — unregistered events pass validation.
-* This allows gradual adoption without breaking existing code.
-*
-* @param options.validate - Custom validator replacing the built-in minimal validator.
-*   The built-in validator only checks top-level object structure (type, required, property types).
-*   For nested objects, arrays, enums, patterns, or $ref, provide AJV or similar.
-*/
-function createEventRegistry(options) {
-	const customValidator = options?.validate;
-	const definitions = /* @__PURE__ */ new Map();
-	function registryKey(name, version) {
-		return `${name}:v${version}`;
-	}
-	return {
-		register(definition) {
-			const key = registryKey(definition.name, definition.version);
-			if (definitions.has(key)) throw new Error(`Event '${definition.name}' v${definition.version} is already registered. Use a different version number for schema evolution.`);
-			definitions.set(key, definition);
-		},
-		get(name, version) {
-			if (version !== void 0) return definitions.get(registryKey(name, version));
-			let latest;
-			let latestVersion = -1;
-			for (const def of definitions.values()) if (def.name === name && def.version > latestVersion) {
-				latest = def;
-				latestVersion = def.version;
-			}
-			return latest;
-		},
-		catalog() {
-			return Array.from(definitions.values()).map((def) => ({
-				name: def.name,
-				version: def.version,
-				description: def.description,
-				schema: def.schema
-			}));
-		},
-		validate(name, payload, version) {
-			let target = version !== void 0 ? definitions.get(registryKey(name, version)) : void 0;
-			if (!target && version === void 0) {
-				let latestVersion = -1;
-				for (const candidate of definitions.values()) if (candidate.name === name && candidate.version > latestVersion) {
-					target = candidate;
-					latestVersion = candidate.version;
-				}
-			}
-			if (!target) return { valid: true };
-			if (!target.schema) return { valid: true };
-			return customValidator ? customValidator(target.schema, payload) : validatePayload(payload, target.schema);
-		}
-	};
-}
-/**
-* Built-in minimal validator — lightweight guard, NOT a full JSON Schema engine.
-*
-* Checks:
-* - payload is an object (not null, not array)
-* - required fields are present
-* - top-level property types match (string, number, boolean, array, object)
-*
-* Does NOT check:
-* - nested object properties
-* - array item types
-* - enum, pattern, format, minLength, minimum, $ref
-*
-* For full validation, pass a custom `validate` function to `createEventRegistry()`.
-*/
-function validatePayload(payload, schema) {
-	const errors = [];
-	if (schema.type === "object") {
-		if (payload === null || payload === void 0 || typeof payload !== "object" || Array.isArray(payload)) return {
-			valid: false,
-			errors: ["Payload must be an object"]
-		};
-		const record = payload;
-		if (schema.required) {
-			for (const field of schema.required) if (!(field in record) || record[field] === void 0) errors.push(`Missing required field: '${field}'`);
-		}
-		if (schema.properties) {
-			for (const [key, propSchema] of Object.entries(schema.properties)) if (key in record && record[key] !== void 0 && record[key] !== null) {
-				const expectedType = propSchema.type;
-				if (expectedType) {
-					const value = record[key];
-					const actualType = Array.isArray(value) ? "array" : typeof value;
-					if (expectedType === "integer") {
-						if (actualType !== "number" || !Number.isInteger(value)) errors.push(`Field '${key}': expected integer, got ${actualType}`);
-					} else if (expectedType !== actualType) errors.push(`Field '${key}': expected ${expectedType}, got ${actualType}`);
-				}
-			}
-		}
-	}
-	return errors.length === 0 ? { valid: true } : {
-		valid: false,
-		errors
-	};
-}
-//#endregion
 //#region src/events/eventTypes.ts
 /**
 * Event Type Constants and Helpers
@@ -251,6 +69,19 @@ const DEFAULT_LEASE_MS$2 = 3e4;
 var MemoryOutboxStore = class {
 	entries = [];
 	seenDedupeKeys = /* @__PURE__ */ new Set();
+	/**
+	* Drop every entry (including delivered / failed / dead-lettered rows) and
+	* the dedupe-key memory.
+	*
+	* For tests only — it is the in-memory analogue of truncating the table, and
+	* exists so a suite can isolate cases against ONE store instance (the
+	* `reset` hook of `runOutboxStoreContract`). Not part of `OutboxStore`; a
+	* production store must never expose this.
+	*/
+	clear() {
+		this.entries.length = 0;
+		this.seenDedupeKeys.clear();
+	}
 	async save(event, options) {
 		if (!event?.type || typeof event.type !== "string") throw new InvalidOutboxEventError("event.type is required");
 		if (!event.meta?.id || typeof event.meta.id !== "string") throw new InvalidOutboxEventError("event.meta.id is required");
@@ -467,7 +298,10 @@ function exponentialBackoff(options) {
 const DEFAULT_LEASE_MS$1 = 3e4;
 const DEFAULT_CLAIM_LIMIT = 100;
 const DEFAULT_PURGE_BATCH = 500;
-function repositoryAsOutboxStore(repository) {
+/** Column this adapter reads/writes for the visibility timestamp. */
+const DEFAULT_VISIBLE_AT_FIELD = "visibleAt";
+function repositoryAsOutboxStore(repository, options) {
+	const visibleAtField = options?.visibleAtField ?? DEFAULT_VISIBLE_AT_FIELD;
 	const missing = [];
 	if (typeof repository.create !== "function") missing.push("create");
 	if (typeof repository.getOne !== "function") missing.push("getOne");
@@ -494,7 +328,7 @@ function repositoryAsOutboxStore(repository) {
 	* lease. Used by `getPending` and `claimPending` — defined once so the
 	* two code paths stay in lockstep.
 	*/
-	const claimableFilter = (now) => and(eq("status", "pending"), lte("visibleAt", now), or(eq("leaseOwner", null), lte("leaseExpiresAt", now)));
+	const claimableFilter = (now) => and(eq("status", "pending"), lte(visibleAtField, now), or(eq("leaseOwner", null), lte("leaseExpiresAt", now)));
 	return {
 		async save(event, options) {
 			if (!event?.type || typeof event.type !== "string") throw new InvalidOutboxEventError("event.type is required");
@@ -506,7 +340,7 @@ function repositoryAsOutboxStore(repository) {
 				type: event.type,
 				status: "pending",
 				attempts: 0,
-				visibleAt: options?.visibleAt ?? now,
+				[visibleAtField]: options?.visibleAt ?? now,
 				leaseOwner: null,
 				leaseExpiresAt: null,
 				deliveredAt: null,
@@ -592,7 +426,7 @@ function repositoryAsOutboxStore(repository) {
 			const firstFailedAt = current.firstFailedAt ?? now;
 			if (await r.findOneAndUpdate(filter, update({ set: {
 				status: targetStatus,
-				visibleAt,
+				[visibleAtField]: visibleAt,
 				leaseOwner: null,
 				leaseExpiresAt: null,
 				lastFailedAt: now,
@@ -960,157 +794,4 @@ function normalizeError(err) {
 	return { message: String(err) };
 }
 //#endregion
-//#region src/events/subscribe-helpers.ts
-/**
-* Subscribe-side helpers — close the symmetry that arc's publish-side
-* already has via [`eventPlugin({ registry, validateMode: 'reject' })`](./eventPlugin.ts).
-*
-* Two wrapper pairs, both transport-agnostic:
-*
-* - `wrapWithSchema` / `subscribeWithSchema` — read the schema from a
-*   typed `EventDefinitionOutput<T>` and validate `event.payload` before
-*   the handler runs. Single source of truth for event shape: declare
-*   once at `defineEvent`, enforced on BOTH sides without parallel Zod
-*   schemas in subscriber files.
-*
-* - `wrapWithBoundary` / `subscribeWithBoundary` — catch + log + swallow
-*   handler errors, for projection / cache-invalidation / fire-and-forget
-*   handlers where retry would just delay the next-event resync. Lighter
-*   than `withRetry` (no DLQ, no exponential backoff) and avoids the
-*   "single bad event poisons the bus" hazard.
-*
-* Both pairs compose with `withRetry` and with each other:
-*
-* ```ts
-* await subscribeWithSchema(
-*   fastify,
-*   OrderPaid,
-*   withRetry(handler, { maxRetries: 3 }),
-* );
-* ```
-*
-* @see [retry.ts](./retry.ts) for the retry + DLQ wrapper.
-* @see [defineEvent.ts](./defineEvent.ts) for `defineEvent` / `EventDefinitionOutput`.
-*/
-/**
-* Pure handler wrapper — returns a new `EventHandler` that validates
-* `event.payload` against the definition's schema before invoking the handler.
-*
-* The returned handler's input is `DomainEvent<unknown>` (since the transport
-* delivers untyped events) but the inner `handler` receives `DomainEvent<T>`.
-* No cast at the call site.
-*
-* @example
-* ```ts
-* await fastify.events.subscribe(
-*   OrderPaid.name,
-*   wrapWithSchema(OrderPaid, async (event) => {
-*     // event.payload is typed via the registered schema — no cast.
-*     await postSalesEntry(event.payload.orderId, event.payload.total);
-*   }),
-* );
-* ```
-*/
-function wrapWithSchema(definition, handler, options = {}) {
-	const { validate, registry, onInvalid, logger = console, name } = options;
-	const label = name ?? definition.name;
-	return async (event) => {
-		const eventVersion = typeof event.meta?.schemaVersion === "number" ? event.meta.schemaVersion : definition.version;
-		let result;
-		if (validate && definition.schema) result = validate(definition.schema, event.payload);
-		else if (registry) result = registry.validate(definition.name, event.payload, eventVersion);
-		else if (definition.schema) {
-			const adhoc = createEventRegistry();
-			adhoc.register(definition);
-			result = adhoc.validate(definition.name, event.payload);
-		} else result = { valid: true };
-		if (!result.valid) {
-			const errors = result.errors ?? ["payload failed validation"];
-			if (onInvalid) try {
-				await onInvalid(event, errors);
-			} catch (cbErr) {
-				logger.error(`[Arc Events] '${label}' onInvalid callback threw:`, cbErr);
-			}
-			else logger.warn(`[Arc Events] '${label}' skipped event ${event.meta?.id ?? "<no-id>"} — payload failed validation: ${errors.join("; ")}`);
-			return;
-		}
-		await handler(event);
-	};
-}
-/**
-* Convenience: validate + subscribe in one call. Equivalent to
-* `fastify.events.subscribe(definition.name, wrapWithSchema(definition, handler, options))`.
-*
-* Returns the unsubscribe function from the underlying transport.
-*
-* @example
-* ```ts
-* await subscribeWithSchema(fastify, OrderPaid, async (event) => {
-*   await postSalesEntry(event.payload.orderId, event.payload.total);
-* });
-*
-* // Compose with withRetry — schema validation runs FIRST, then retry on
-* // handler failure. Invalid payloads skip without burning retry attempts.
-* await subscribeWithSchema(
-*   fastify,
-*   OrderPaid,
-*   withRetry(handler, { maxRetries: 3 }),
-* );
-* ```
-*/
-async function subscribeWithSchema(fastify, definition, handler, options) {
-	return fastify.events.subscribe(definition.name, wrapWithSchema(definition, handler, options));
-}
-/**
-* Pure handler wrapper — returns a new `EventHandler` that catches handler
-* exceptions and routes them to `onError` (or logs and swallows). For
-* projection / cache-invalidation / fire-and-forget handlers where retry
-* would just delay the next-event resync, and where one bad event must NOT
-* stop processing of subsequent events.
-*
-* Lighter than `withRetry`: no exponential backoff, no DLQ. Composes with
-* `withRetry` if you want both ("retry, then log if exhausted, never throw").
-*
-* @example
-* ```ts
-* await fastify.events.subscribe(
-*   'product:variants.changed',
-*   wrapWithBoundary(async (event) => {
-*     cache.invalidate(event.payload.productId);
-*   }),
-* );
-* ```
-*/
-function wrapWithBoundary(handler, options = {}) {
-	const { onError, logger = console, name } = options;
-	const label = name ?? handler.name ?? "anonymous";
-	return async (event) => {
-		try {
-			await handler(event);
-		} catch (err) {
-			const error = err instanceof Error ? err : new Error(String(err));
-			if (onError) try {
-				await onError(error, event);
-			} catch (cbErr) {
-				logger.error(`[Arc Events] '${label}' onError callback threw:`, cbErr);
-			}
-			else logger.error(`[Arc Events] '${label}' threw on ${event.type} — swallowed (boundary): ${error.message}`, {
-				err: error,
-				event: event.type,
-				eventId: event.meta?.id,
-				handler: label
-			});
-		}
-	};
-}
-/**
-* Convenience: subscribe + error-boundary in one call. Equivalent to
-* `fastify.events.subscribe(pattern, wrapWithBoundary(handler, options))`.
-*
-* Returns the unsubscribe function from the underlying transport.
-*/
-async function subscribeWithBoundary(fastify, pattern, handler, options) {
-	return fastify.events.subscribe(pattern, wrapWithBoundary(handler, options));
-}
-//#endregion
 export { ARC_LIFECYCLE_EVENTS, CACHE_EVENTS, CRUD_EVENT_SUFFIXES, EventOutbox, MemoryEventTransport, MemoryOutboxStore, createDeadLetterPublisher, createEventRegistry, crudEventType, defineEvent, eventPlugin, exponentialBackoff, repositoryAsOutboxStore, subscribeWithBoundary, subscribeWithSchema, withRetry, wrapWithBoundary, wrapWithSchema };

package/dist/factory/index.d.mts

@@ -1,6 +1,7 @@
-import { _ as ResourceModule, a as orderModules, c as collectModuleScheduledJobs, d as ArcModuleInput, f as ArcModuleRegistry, g as ResourceLike, h as LoadResourcesOptions, i as resolveModule, l as collectModuleWorkflows, m as ModuleContribution, n as getModuleExports, o as subscribeModuleEventHandlers, p as EventHandlerDefinition, r as resolveContribution, s as collectModuleHealthChecks, t as defineModule, u as ArcModule, v as loadResources, w as HealthCheck } from "../index-KUoxjIq1.mjs";
-import "../fastify-augmentation-dPNBVeIj.mjs";
-import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-0oe-JSSS.mjs";
+import { a as ModuleContribution, c as ResourceModule, h as HealthCheck, i as EventHandlerDefinition, l as loadResources, n as ArcModuleInput, o as LoadResourcesOptions, r as ArcModuleRegistry, s as ResourceLike, t as ArcModule } from "../types-D_n8L6VY.mjs";
+import { a as orderModules, c as collectModuleScheduledJobs, i as resolveModule, l as collectModuleWorkflows, n as getModuleExports, o as subscribeModuleEventHandlers, r as resolveContribution, s as collectModuleHealthChecks, t as defineModule } from "../index-CCzVR-N3.mjs";
+import "../fastify-augmentation-0WhPnUH7.mjs";
+import { a as RawBodyOptions, c as BetterAuthOption, d as JwtAuthOption, i as MultipartOptions, l as CustomAuthenticatorOption, n as preloadResourcesAsync, o as UnderPressureOptions, r as CreateAppOptions, s as AuthOption, t as preloadResources, u as CustomPluginAuthOption } from "../preloadResources-DCfa2egz.mjs";
 import { FastifyInstance, FastifyServerOptions } from "fastify";
 //#region src/factory/createApp.d.ts
 /**

package/dist/factory/index.mjs

@@ -1,6 +1,8 @@
 import { r as mergeHealthChecks, t as healthPlugin } from "../health-CB_m4S32.mjs";
-import { _ as collectModuleScheduledJobs, b as resolveModule, c as getPreset, d as workerPreset, f as defineModule, g as collectModuleHealthChecks, h as subscribeModuleEventHandlers, i as createApp, l as productionPreset, m as orderModules, n as preloadResourcesAsync, o as developmentPreset, p as getModuleExports, r as ArcFactory, s as edgePreset, t as preloadResources, u as testingPreset, v as collectModuleWorkflows, y as resolveContribution } from "../preloadResources-DfyngIN9.mjs";
+import { a as edgePreset, c as testingPreset, d as subscribeModuleEventHandlers, f as collectModuleHealthChecks, g as resolveModule, h as resolveContribution, i as developmentPreset, l as workerPreset, m as collectModuleWorkflows, n as createApp, o as getPreset, p as collectModuleScheduledJobs, s as productionPreset, t as ArcFactory, u as orderModules } from "../createApp-CXrKFciH.mjs";
+import { n as getModuleExports, t as defineModule } from "../module-_-M7C5ES.mjs";
 import { t as loadResources } from "../loadResources-DpU8pfjV.mjs";
+import { n as preloadResourcesAsync, t as preloadResources } from "../preloadResources-DSY5HGpS.mjs";
 //#region src/factory/createWorker.ts
 async function createWorker(options, workerOptions = {}) {
 	const { auth: _auth, helmet: _helmet, cors: _cors, rateLimit: _rateLimit, multipart: _multipart, rawBody: _rawBody, sensible: _sensible, underPressure: _underPressure, replyHelpers: _replyHelpers, ...runtimeOptions } = options;

package/dist/{fastify-augmentation-dPNBVeIj.d.mts → fastify-augmentation-0WhPnUH7.d.mts}

@@ -1,6 +1,7 @@
-import { mn as HookSystem, z as ResourceRegistry } from "./index-DPRH0Cme.mjs";
+import { mn as HookSystem, z as ResourceRegistry } from "./index-Q5gzEIWY.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-BE6wFpYv.mjs";
-import { f as ArcModuleRegistry, u as ArcModule, w as HealthCheck, y as ScheduleDefinition } from "./index-KUoxjIq1.mjs";
+import { h as HealthCheck, r as ArcModuleRegistry, t as ArcModule, u as ScheduleDefinition } from "./types-D_n8L6VY.mjs";
+import "./index-CCzVR-N3.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/core/arcCorePlugin.d.ts
 interface ArcCorePluginOptions {

package/dist/{applyPermissionResult-Tw4iXtlf.mjs → fields-CQ_7KQWw.mjs}

@@ -165,100 +165,4 @@ function resolveEffectiveRoles(userRoles, orgRoles) {
 	return [.../* @__PURE__ */ new Set([...userRoles, ...orgRoles])];
 }
 //#endregion
-//#region src/permissions/applyPermissionResult.ts
-/**
-* Normalize a permission check return value (`boolean | PermissionResult`)
-* into a concrete `PermissionResult`. This is the only place in Arc that
-* promotes booleans to results — keeps the type narrowing honest everywhere.
-*/
-function normalizePermissionResult(result) {
-	if (typeof result === "boolean") return { granted: result };
-	return result;
-}
-/**
-* Apply a granted `PermissionResult` to a Fastify request — merges row-level
-* filters into `_policyFilters` and conditionally installs the scope.
-*
-* **Scope install rule:** only writes `scope` when the current request scope
-* is absent or `public`. This prevents downgrading an already-authenticated
-* request (e.g. Better Auth set `member`, then a permission check returns a
-* narrower `service` scope — the original `member` wins because it came from
-* a more authoritative source).
-*
-* Safe to call with a non-granted result — it simply no-ops. Callers should
-* still check `result.granted` and send an error response before reaching here,
-* but this function tolerates the misuse defensively.
-*/
-function applyPermissionResult(result, request) {
-	if (!result.granted) return;
-	if (result.filters) request._policyFilters = {
-		...request._policyFilters ?? {},
-		...result.filters
-	};
-	if (result.scope) {
-		const current = request.scope;
-		if (!current || current.kind === "public") request.scope = result.scope;
-	}
-}
-/**
-* Max length of a `PermissionResult.reason` string before we fall back to the
-* generic default message. Upstream checks can return arbitrary strings; we
-* clamp to prevent accidental leakage of internal diagnostics or oversized
-* payloads via the 4xx response body.
-*/
-const MAX_DENIAL_REASON_LENGTH = 100;
-/**
-* End-to-end evaluator: runs the permission check, catches throws, normalizes
-* the result, sends a 401/403 response on denial, and applies side-effects on
-* grant. Returns `true` if the caller should continue, `false` if a response
-* has been sent and the caller should return.
-*
-* This is the single source of truth for the 5-step sequence shared by the
-* CRUD router, action router, and MCP tool handlers:
-*
-*   1. `try { await check(ctx) } catch { reply 403 }`
-*   2. `normalizePermissionResult(result)`
-*   3. If denied → 401 (no user) or 403 (user) with clamped reason
-*   4. If granted → `applyPermissionResult` (filters + scope)
-*   5. Return true/false so the caller knows whether to keep going
-*
-* Context construction, pre-check auth gating, and success-path handler
-* invocation stay at the callsite — those are genuinely different per router
-* and don't belong here.
-*
-* @returns `true` if authorized (caller continues), `false` if a response was sent
-*/
-async function evaluateAndApplyPermission(check, context, request, reply, opts) {
-	let result;
-	try {
-		result = await check(context);
-	} catch (err) {
-		request.log?.warn?.({
-			err,
-			resource: context.resource,
-			action: context.action
-		}, "Permission check threw");
-		reply.code(403).send({
-			code: "arc.forbidden",
-			message: "Permission denied",
-			status: 403
-		});
-		return false;
-	}
-	const permResult = normalizePermissionResult(result);
-	if (!permResult.granted) {
-		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
-		const reason = permResult.reason && permResult.reason.length <= MAX_DENIAL_REASON_LENGTH ? permResult.reason : defaultMsg;
-		const status = context.user ? 403 : 401;
-		reply.code(status).send({
-			code: context.user ? "arc.forbidden" : "arc.unauthorized",
-			message: reason,
-			status
-		});
-		return false;
-	}
-	applyPermissionResult(permResult, request);
-	return true;
-}
-//#endregion
-export { applyFieldWritePermissions as a, applyFieldReadPermissions as i, evaluateAndApplyPermission as n, fields as o, normalizePermissionResult as r, resolveEffectiveRoles as s, applyPermissionResult as t };
+export { resolveEffectiveRoles as i, applyFieldWritePermissions as n, fields as r, applyFieldReadPermissions as t };

package/dist/hooks/index.d.mts

@@ -1,2 +1,2 @@
-import { Cn as defineHook, Sn as createHookSystem, _n as afterDelete, bn as beforeDelete, cn as DefineHookOptions, dn as HookOperation, fn as HookPhase, gn as afterCreate, hn as HookSystemOptions, ln as HookContext, mn as HookSystem, pn as HookRegistration, un as HookHandler, vn as afterUpdate, xn as beforeUpdate, yn as beforeCreate } from "../index-DPRH0Cme.mjs";
+import { Cn as defineHook, Sn as createHookSystem, _n as afterDelete, bn as beforeDelete, cn as DefineHookOptions, dn as HookOperation, fn as HookPhase, gn as afterCreate, hn as HookSystemOptions, ln as HookContext, mn as HookSystem, pn as HookRegistration, un as HookHandler, vn as afterUpdate, xn as beforeUpdate, yn as beforeCreate } from "../index-Q5gzEIWY.mjs";
 export { type DefineHookOptions, type HookContext, type HookHandler, type HookOperation, type HookPhase, type HookRegistration, HookSystem, type HookSystemOptions, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/hooks/index.mjs

@@ -1,2 +1,2 @@
-import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-C1vB_Gc9.mjs";
+import { a as beforeCreate, c as createHookSystem, i as afterUpdate, l as defineHook, n as afterCreate, o as beforeDelete, r as afterDelete, s as beforeUpdate, t as HookSystem } from "../HookSystem-WkIougo6.mjs";
 export { HookSystem, afterCreate, afterDelete, afterUpdate, beforeCreate, beforeDelete, beforeUpdate, createHookSystem, defineHook };

package/dist/idempotency/index.mjs

@@ -1,9 +1,9 @@
 import { n as requireSingleHeaderValue } from "../headers-BvlQSDMB.mjs";
 import { n as createSafeGetOne, t as createIsDuplicateKeyError } from "../store-helpers-DY6xq4sM.mjs";
 import { t as createIdempotencyResult } from "../interface-n5hpKg1d.mjs";
+import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { createHash } from "node:crypto";
 import fp from "fastify-plugin";
-import { and, eq, exists, gt, lt, or, startsWith } from "@classytic/repo-core/filter";
 import { update } from "@classytic/repo-core/update";
 //#region src/idempotency/repository-idempotency-adapter.ts
 function repositoryAsIdempotencyStore(repository, defaultTtlMs) {