@classytic/arc 2.28.0 → 2.30.0

package/dist/cleanup/index.d.mts

@@ -1,6 +1,6 @@
-import { L as RequestWithExtras } from "../index-DPRH0Cme.mjs";
+import { L as RequestWithExtras } from "../index-Q5gzEIWY.mjs";
 import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C_ZZRcD6.mjs";
-import { t as ArcModule } from "../types-Cu6vVJmh.mjs";
+import { t as ArcModule } from "../types-D_n8L6VY.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,5 +1,5 @@
 import { g as getUserId } from "../types-CSyCxl2V.mjs";
-import { t as defineResource } from "../defineResource-2zvVVpxg.mjs";
+import { t as defineResource } from "../defineResource-CxWqDCAy.mjs";
 import { t as defineModule } from "../module-_-M7C5ES.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DPRH0Cme.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-Q5gzEIWY.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-BLV4OMXb.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-B8Vkbxbn.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { $t as SlugExt, An as ControllerConfigurableOptions, B as defineResource, Jt as BaseController, Mn as ListResult, Nn as BodySanitizer, Pn as BodySanitizerConfig, Qt as TreeMixin, V as ResourceDefinition, Xt as SoftDeleteMixin, Yt as SoftDeleteExt, Zt as TreeExt, an as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugMixin, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as QueryResolver, jn as ControllerConstructionOptions, kn as BaseControllerOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkMixin, on as AccessControl, pt as AggregationMaterializedContext, rn as BaseCrudController, sn as AccessControlConfig, st as AggMeasureInput, tn as BulkExt, ut as AggregationConfig } from "../index-DPRH0Cme.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-CjVg-Epg.mjs";
+import { $t as SlugExt, An as ControllerConfigurableOptions, B as defineResource, Jt as BaseController, Mn as ListResult, Nn as BodySanitizer, Pn as BodySanitizerConfig, Qt as TreeMixin, V as ResourceDefinition, Xt as SoftDeleteMixin, Yt as SoftDeleteExt, Zt as TreeExt, an as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugMixin, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as QueryResolver, jn as ControllerConstructionOptions, kn as BaseControllerOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkMixin, on as AccessControl, pt as AggregationMaterializedContext, rn as BaseCrudController, sn as AccessControlConfig, st as AggMeasureInput, tn as BulkExt, ut as AggregationConfig } from "../index-Q5gzEIWY.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Cx7bro4R.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,6 +1,7 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-B65zbz9m.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-2zvVVpxg.mjs";
-import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-BGRnV-To.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, s as defineAggregation, t as getEntityId } from "../core-BGa8TXJR.mjs";
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-B5DwufbB.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-CxWqDCAy.mjs";
+import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-BJnpkY9i.mjs";
+import { t as defineAggregation } from "../defineAggregation-ufWjUwml.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-poalJLvp.mjs";
 export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/{core-BGa8TXJR.mjs → core-poalJLvp.mjs}

@@ -1,51 +1,5 @@
 import "./constants-DNre0wRg.mjs";
-import { t as defineResource } from "./defineResource-2zvVVpxg.mjs";
-//#region src/core/aggregation/defineAggregation.ts
-/**
-* Declare a single resource aggregation. Exported configs flow into
-* `defineResource({ aggregations: { ... } })` either as named keys or
-* via auto-discovery patterns (loadAggregations — future).
-*
-* @example Inline
-* ```ts
-* defineResource({
-*   name: 'order',
-*   aggregations: {
-*     revenueByStatus: defineAggregation({
-*       groupBy: 'status',
-*       measures: { count: 'count', revenue: 'sum:totalPrice' },
-*       permissions: requireRoles(['admin']),
-*     }),
-*   },
-* });
-* ```
-*
-* @example Multi-file
-* ```ts
-* // orders/aggregations/revenue-by-status.ts
-* import { defineAggregation } from '@classytic/arc';
-*
-* export const revenueByStatus = defineAggregation({
-*   groupBy: 'status',
-*   measures: { count: 'count', revenue: 'sum:totalPrice' },
-*   permissions: requireRoles(['admin']),
-*   timeout: 5000,
-*   cache: { staleTime: 60 },
-* });
-*
-* // orders/order.resource.ts
-* import * as aggregations from './aggregations/index.js';
-*
-* defineResource({
-*   name: 'order',
-*   aggregations,                                  // 30+ entries flow in
-* });
-* ```
-*/
-function defineAggregation(config) {
-	return config;
-}
-//#endregion
+import { t as defineResource } from "./defineResource-CxWqDCAy.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema
@@ -218,4 +172,4 @@ function getEntityQuery(req) {
 	return { [getEntityIdField(req)]: id };
 }
 //#endregion
-export { mergeResourceConfig as a, defineResourceVariants as i, getEntityIdField as n, defineAction as o, getEntityQuery as r, defineAggregation as s, getEntityId as t };
+export { mergeResourceConfig as a, defineResourceVariants as i, getEntityIdField as n, defineAction as o, getEntityQuery as r, getEntityId as t };

package/dist/{createActionRouter-C-N7z2EL.mjs → createActionRouter-BxuywVRB.mjs}

@@ -2,8 +2,8 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
 import { a as buildRouteHooks, i as selectPluginMw, l as buildAuthMiddlewareForPermissions, n as buildRouteConfig, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
-import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-DTp18Ah_.mjs";
-import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-BGRnV-To.mjs";
+import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-JkxIEBJq.mjs";
+import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-BJnpkY9i.mjs";
 import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({

package/dist/{createAggregationRouter-wzwFa_dW.mjs → createAggregationRouter-BiY-lGdY.mjs}

@@ -1,7 +1,9 @@
-import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
+import { f as createError } from "./errors-DkO8Nk6-.mjs";
+import { u as getRequestScope } from "./types-CSyCxl2V.mjs";
+import { r as evaluateAndApplyPermission } from "./applyPermissionResult-Cf6zUCvb.mjs";
 import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
 import { n as validateAggregations } from "./validate-Bk44F2yT.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-Dtwd8fdz.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-BYS3Vkfz.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is
@@ -38,15 +40,9 @@ function registerOne(fastify, normalized, ctx) {
 	const config = normalized.base;
 	const authMw = buildAuthMiddleware(fastify, config.permissions);
 	const permissionFn = config.permissions;
-	const permissionMw = async (req, _reply) => {
+	const permissionMw = async (req, reply) => {
 		const ctx = buildPermissionContextLite(req, normalized.name);
-		const raw = await permissionFn(ctx);
-		if (!normalizePermissionGranted(raw)) {
-			const status = req.user ? 403 : 401;
-			const reason = normalizePermissionReason(raw);
-			if (status === 401) throw new UnauthorizedError(reason ?? "Authentication required to access this aggregation.");
-			throw new ForbiddenError(reason ?? "You do not have permission to access this aggregation.");
-		}
+		await evaluateAndApplyPermission(permissionFn, ctx, req, reply, { defaultDenialMessage: (user) => user ? "You do not have permission to access this aggregation." : "Authentication required to access this aggregation." });
 	};
 	const hooks = buildRouteHooks({
 		arcDecorator,
@@ -99,20 +95,11 @@ function buildPermissionContextLite(req, aggregationName) {
 	const reqWithExtras = req;
 	return {
 		user: reqWithExtras.user ?? null,
+		scope: getRequestScope(req),
 		request: req,
 		resource: reqWithExtras.arc?.resource ?? "aggregation",
 		action: `aggregation:${aggregationName}`
 	};
 }
-/** PermissionCheck returns `boolean | PermissionResult`. Pull `granted`. */
-function normalizePermissionGranted(raw) {
-	if (typeof raw === "boolean") return raw;
-	return raw.granted;
-}
-/** Pull `reason` when the check returned a structured `PermissionResult`. */
-function normalizePermissionReason(raw) {
-	if (typeof raw === "boolean") return void 0;
-	return raw.reason;
-}
 //#endregion
 export { createAggregationRouter };

package/dist/{createApp-Du5G54TM.mjs → createApp-CXrKFciH.mjs}

@@ -4,6 +4,7 @@ import { n as PUBLIC_SCOPE } from "./types-CSyCxl2V.mjs";
 import { t as createTenantKeyGenerator } from "./rateLimitKey-BoWRH3e7.mjs";
 import { i as createRequestIdGenerator, r as mergeHealthChecks } from "./health-CB_m4S32.mjs";
 import { t as parseJsonBody } from "./jsonBody-BlzAoGCe.mjs";
+import { r as wrapWithBoundary } from "./subscribe-helpers-DfzsivM6.mjs";
 import Fastify from "fastify";
 import qs from "qs";
 //#region src/factory/module/resolve.ts
@@ -100,8 +101,9 @@ async function subscribeModuleEventHandlers(fastify, modules) {
 					if (prior !== void 0) throw new Error(`[arc] duplicate event-handler name "${def.name}" — declared by module "${prior}" and module "${m.name}". Named event handlers must be unique across the module graph; prefix names with the owning module.`);
 					owner.set(def.name, m.name);
 				}
+				const handler = applyBoundary(def, m.name, fastify);
 				const patterns = Array.isArray(def.event) ? def.event : [def.event];
-				for (const pattern of patterns) unsubscribes.push(await bus.subscribe(pattern, def.handler));
+				for (const pattern of patterns) unsubscribes.push(await bus.subscribe(pattern, handler));
 			}
 		}
 		return unsubscribes;
@@ -111,6 +113,25 @@ async function subscribeModuleEventHandlers(fastify, modules) {
 		throw err;
 	}
 }
+/**
+* Apply the declaration's opt-in error boundary. Without `boundary`, the raw
+* handler is subscribed and a throw reaches the transport — which is what makes
+* the durable path work (unacked → redelivered → DLQ). With it, failures are
+* logged through `fastify.log` and swallowed, for handlers whose retry would
+* only delay the next event's resync.
+*
+* The boundary label falls back to `<module>.<pattern>` so an unnamed handler
+* still produces an attributable log line instead of "anonymous".
+*/
+function applyBoundary(def, moduleName, fastify) {
+	if (!def.boundary) return def.handler;
+	const onError = typeof def.boundary === "object" ? def.boundary.onError : void 0;
+	return wrapWithBoundary(def.handler, {
+		logger: fastify.log,
+		name: def.name ?? `${moduleName}.${String(def.event)}`,
+		...onError ? { onError } : {}
+	});
+}
 /** Best-effort reverse-order teardown; every unsubscribe is attempted. */
 async function unsubscribeModuleEventHandlers(unsubscribes) {
 	const errors = [];
@@ -439,7 +460,7 @@ async function registerArcCore(fastify, config, trackPlugin) {
 	await fastify.register(arcCorePlugin, { emitEvents: config.arcPlugins?.emitEvents !== false });
 	trackPlugin("arc-core");
 	if (config.arcPlugins?.events !== false) {
-		const { default: eventPlugin } = await import("./eventPlugin-DrQ_FesK.mjs").then((n) => n.n);
+		const { default: eventPlugin } = await import("./eventPlugin-D2NNR4py.mjs").then((n) => n.n);
 		const eventOpts = typeof config.arcPlugins?.events === "object" ? config.arcPlugins.events : {};
 		await fastify.register(eventPlugin, {
 			...eventOpts,
@@ -511,7 +532,7 @@ async function registerArcPlugins(fastify, config, trackPlugin, modules, moduleH
 	}
 	if (config.arcPlugins?.realtime) if (config.arcPlugins?.events === false) fastify.log.warn("Realtime plugin requires events plugin (arcPlugins.events). Realtime disabled.");
 	else {
-		const { default: realtimePlugin } = await import("./realtime-DEuDu9io.mjs").then((n) => n.r);
+		const { default: realtimePlugin } = await import("./realtime-B9nmIY5V.mjs").then((n) => n.r);
 		const opts = config.arcPlugins.realtime === true ? {} : config.arcPlugins.realtime;
 		await fastify.register(realtimePlugin, opts);
 		trackPlugin("arc-realtime", opts);

package/dist/defineAggregation-ufWjUwml.mjs

@@ -0,0 +1,47 @@
+//#region src/core/aggregation/defineAggregation.ts
+/**
+* Declare a single resource aggregation. Exported configs flow into
+* `defineResource({ aggregations: { ... } })` either as named keys or
+* via auto-discovery patterns (loadAggregations — future).
+*
+* @example Inline
+* ```ts
+* defineResource({
+*   name: 'order',
+*   aggregations: {
+*     revenueByStatus: defineAggregation({
+*       groupBy: 'status',
+*       measures: { count: 'count', revenue: 'sum:totalPrice' },
+*       permissions: requireRoles(['admin']),
+*     }),
+*   },
+* });
+* ```
+*
+* @example Multi-file
+* ```ts
+* // orders/aggregations/revenue-by-status.ts
+* import { defineAggregation } from '@classytic/arc';
+*
+* export const revenueByStatus = defineAggregation({
+*   groupBy: 'status',
+*   measures: { count: 'count', revenue: 'sum:totalPrice' },
+*   permissions: requireRoles(['admin']),
+*   timeout: 5000,
+*   cache: { staleTime: 60 },
+* });
+*
+* // orders/order.resource.ts
+* import * as aggregations from './aggregations/index.js';
+*
+* defineResource({
+*   name: 'order',
+*   aggregations,                                  // 30+ entries flow in
+* });
+* ```
+*/
+function defineAggregation(config) {
+	return config;
+}
+//#endregion
+export { defineAggregation as t };

package/dist/{defineResource-2zvVVpxg.mjs → defineResource-CxWqDCAy.mjs}

@@ -3,17 +3,17 @@ import { arcLog } from "./logger/index.mjs";
 import { r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
 import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
 import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-CSyCxl2V.mjs";
-import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B65zbz9m.mjs";
+import { d as DEFAULT_FIELD_WRITE_DENIAL_POLICY, t as BaseController } from "./BaseController-B5DwufbB.mjs";
 import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, n as buildRouteConfig, o as resolveRoutePreHandlers, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
-import { a as applyFieldWritePermissions, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-DTp18Ah_.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions } from "./fields-CQ_7KQWw.mjs";
+import { r as buildCrudPermissionMw, t as tryRegisterRoute } from "./registerRoute-JkxIEBJq.mjs";
 import { c as getDefaultCrudSchemas } from "./utils-taUVD4p3.mjs";
 import { n as convertRouteSchema, r as ensureSchemaConverter, t as convertOpenApiSchemas } from "./schemaConverter-DJvodiHj.mjs";
 import { i as pipeUIMessageStreamToReply, r as isReadableStream } from "./streaming-BQcW6_Kq.mjs";
 import { t as hasEvents } from "./typeGuards-C9KXUly6.mjs";
-import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-BGRnV-To.mjs";
-import { A as requireAuth } from "./permissions-BrtiBKGs.mjs";
-import { r as getAvailablePresets, t as applyPresets } from "./presets-DwFDVKP0.mjs";
+import { a as createFastifyHandler, i as createCrudHandlers, n as buildPipelineHandler, o as createRequestContext, r as resolvePipelineSteps } from "./pipeline-BJnpkY9i.mjs";
+import { I as requireAuth } from "./permissions-Bfu_8y1U.mjs";
+import { r as getAvailablePresets, t as applyPresets } from "./presets-CJOEXLuk.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
 //#region src/core/middlewares/fieldWrite.ts
@@ -462,26 +462,6 @@ function buildBaseController(resolvedConfig, adapter, repository) {
 //#endregion
 //#region src/core/defineResource/hooks.ts
 /**
-* Phase 6 — wire preset hooks + inline `config.hooks` onto the
-* resource's `_pendingHooks`.
-*
-* Two sources feed the same array:
-*   1. Preset hooks collected during `applyPresets()` (raw `_hooks`
-*      on the internal config). Already in the canonical
-*      `{ operation, phase, handler, priority }` shape — copied
-*      verbatim (priority defaults to 10).
-*   2. Inline `config.hooks.beforeCreate` / `afterCreate` / etc.
-*      Authored by the user on the original `ResourceConfig`.
-*      Wrapped in a `ResourceHookContext` projection (v2.10.8) so
-*      authors can read `scope` / `context` without reaching into
-*      internal request fields.
-*
-* The 6 inline hook keys (before/after × create/update/delete) used
-* to be 6 nearly-identical blocks; collapsed into a table + loop so
-* a future hook (e.g. `beforeRead`) is one row, not seven scattered
-* edits.
-*/
-/**
 * Combined entry-point for Phase 6. Pushes preset-collected hooks
 * first, then inline `config.hooks` (so hosts can rely on
 * registration order if priorities tie).
@@ -544,19 +524,17 @@ const INLINE_HOOK_SPECS = [
 	}
 ];
 /**
-* Project a raw HookSystem context into a `ResourceHookContext` for
-* inline `config.hooks.*` handlers. The projection lifts `scope`
-* out of `context._scope` so authors don't reach into internal
-* fields.
+* Project a raw HookSystem context into a `ResourceHookContext` for inline
+* `config.hooks.*` handlers. `scope` rides in already computed — `HookContext`
+* carries the same projection — so the two surfaces cannot drift.
 */
 function buildHookContext(ctx) {
 	const context = ctx.context;
-	const rawScope = context?._scope;
 	return {
 		data: ctx.data ?? ctx.result ?? {},
 		user: ctx.user,
 		context,
-		scope: buildRequestScopeProjection(rawScope),
+		scope: ctx.scope,
 		meta: ctx.meta
 	};
 }
@@ -802,7 +780,7 @@ function stripFromRequired(schema, fieldName) {
 }
 /**
 * Strip framework-injected fields from the `required[]` list of every
-* body-shaped slot in an adapter's generated schemas (v2.11.0).
+* body-shaped slot in an adapter's generated schemas.
 *
 * A "framework-injected field" is any field marked `systemManaged: true`
 * in `schemaOptions.fieldRules`. Arc populates those fields from the
@@ -957,22 +935,32 @@ const WRITE_OPERATIONS = /* @__PURE__ */ new Set([
 * wiring, ...) count as gates and don't false-positive.
 *
 * Severity ladder:
-*   - `warn` when any enabled WRITE op (create/update/delete) is ungated —
-*     this is real exposure the host must acknowledge.
+*   - `error` when any enabled WRITE op is ungated AND `strict` is on — the
+*     resource fails boot (`defineResource()` throws). This is the fail-closed
+*     production invariant: an unauthenticated write must never ship silently.
+*   - `warn` (default) when any enabled WRITE op (create/update/delete) is
+*     ungated — real exposure the host must acknowledge, but non-fatal so
+*     existing hosts are not broken.
 *   - `info` when only reads are ungated — public catalogs
 *     (`referenceData: true`) are a legitimate shape, but the host should
 *     still state intent with `permissions.fullPublic()` / `allowPublic()`.
+*
+* `strict` is opt-in (resource `strictPermissions: true` or the
+* `ARC_STRICT_PERMISSIONS` env), so the default behavior is unchanged.
 */
-function collectUngatedCrudDiagnostics(config) {
+function collectUngatedCrudDiagnostics(config, strict = false) {
 	if (config.disableDefaultRoutes) return [];
 	const disabled = new Set(config.disabledRoutes ?? []);
 	const permissions = config.permissions ?? {};
 	const ungated = CRUD_OPERATIONS.filter((op) => !disabled.has(op) && typeof permissions[op] !== "function");
 	if (ungated.length === 0) return [];
+	const severity = ungated.some((op) => WRITE_OPERATIONS.has(op)) ? strict ? "error" : "warn" : "info";
 	return [{
-		severity: ungated.some((op) => WRITE_OPERATIONS.has(op)) ? "warn" : "info",
+		severity,
 		code: "crud-public-by-omission",
-		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\nAn omitted permission mounts the route WITHOUT auth. State intent explicitly:\n  permissions: permissions.fullPublic()     // intentionally public\n  permissions: permissions.authenticated()  // require auth on every op\n  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
+		message: `[Arc] Resource '${config.name}' mounts ${ungated.length} CRUD route(s) with no permission gate: ${ungated.join(", ")}.\n` + (severity === "error" ? "strictPermissions is on and an ungated WRITE is fatal. State intent explicitly:\n" : "An omitted permission mounts the route WITHOUT auth. State intent explicitly:\n") + `  permissions: permissions.fullPublic()     // intentionally public
+  permissions: permissions.authenticated()  // require auth on every op
+  permissions: { ${ungated[0]}: requireAuth(), ... }  // per-operation`
 	}];
 }
 //#endregion
@@ -1217,7 +1205,7 @@ function buildResourcePlugin(resource) {
 		const isFirstMount = !resource._sharedStateRegisteredOn.has(sharedRoot);
 		if (isFirstMount) resource._sharedStateRegisteredOn.add(sharedRoot);
 		if (isFirstMount && resource._diagnostics?.length) for (const diagnostic of resource._diagnostics) {
-			const level = diagnostic.severity === "info" ? "info" : "warn";
+			const level = diagnostic.severity === "info" ? "info" : diagnostic.severity === "error" ? "error" : "warn";
 			fastify.log?.[level]?.(diagnostic.message);
 		}
 		const arc = fastify.arc;
@@ -1278,7 +1266,7 @@ function buildResourcePlugin(resource) {
 				extensions: resource.extensions
 			});
 			if (resource.actions && Object.keys(resource.actions).length > 0) {
-				const { createActionRouter } = await import("./createActionRouter-C-N7z2EL.mjs").then((n) => n.n);
+				const { createActionRouter } = await import("./createActionRouter-BxuywVRB.mjs").then((n) => n.n);
 				createActionRouter(typedInstance, {
 					...normalizeActionsToRouterConfig(resource.actions, resource.actionPermissions, resource.tag, resource.permissions, resource.name, typedInstance.log),
 					resourceName: resource.name,
@@ -1293,7 +1281,7 @@ function buildResourcePlugin(resource) {
 				});
 			}
 			if (resource.aggregations && Object.keys(resource.aggregations).length > 0) {
-				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-wzwFa_dW.mjs"), import("./validate-Bk44F2yT.mjs").then((n) => n.r)]);
+				const [{ createAggregationRouter }, { adapterSupportsAggregate, ArcAggregationConfigError }] = await Promise.all([import("./createAggregationRouter-BiY-lGdY.mjs"), import("./validate-Bk44F2yT.mjs").then((n) => n.r)]);
 				const repoForAgg = resource.controller?.repository ?? resource.repository;
 				if (!adapterSupportsAggregate(repoForAgg)) {
 					const undispatchable = Object.entries(resource.aggregations).filter(([, cfg]) => !cfg.materialized).map(([name]) => name);
@@ -2169,7 +2157,12 @@ function defineResource(config) {
 	const configWithId = resolveIdField(normalisedConfig, repository);
 	const resolvedConfig = applyPresetsAndAutoInject(configWithId);
 	const hasCrudRoutes = computeHasCrudRoutes(resolvedConfig);
-	if (!normalisedConfig.skipValidation) diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig));
+	if (!normalisedConfig.skipValidation) {
+		const strict = resolvedConfig.strictPermissions ?? process.env.ARC_STRICT_PERMISSIONS === "true";
+		diagnostics = diagnostics.concat(collectUngatedCrudDiagnostics(resolvedConfig, strict));
+	}
+	const fatal = diagnostics.filter((d) => d.severity === "error");
+	if (fatal.length > 0) throw new Error(fatal.map((d) => d.message).join("\n\n"));
 	const narrowedConfig = resolvedConfig;
 	const narrowedAdapter = configWithId.adapter;
 	const controller = resolveOrAutoCreateController(narrowedConfig, narrowedAdapter, repository, hasCrudRoutes);

package/dist/docs/index.d.mts

@@ -1,4 +1,4 @@
-import { p as RegistryEntry } from "../index-DPRH0Cme.mjs";
+import { p as RegistryEntry } from "../index-Q5gzEIWY.mjs";
 import { t as ExternalOpenApiPaths } from "../externalPaths-BE6wFpYv.mjs";
 import { FastifyPluginAsync } from "fastify";
 //#region src/docs/openapi/types.d.ts

package/dist/docs/index.mjs

@@ -1,5 +1,5 @@
 import { n as getUserRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-BLV4OMXb.mjs";
+import { n as openApiPlugin, r as openapi_default, t as buildOpenApiSpec } from "../openapi-B8Vkbxbn.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/scalar.ts
 const scalarPlugin = async (fastify, opts = {}) => {

package/dist/{eventPlugin-DrQ_FesK.mjs → eventPlugin-D2NNR4py.mjs}

@@ -2,109 +2,8 @@ import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { d as createDomainError } from "./errors-DkO8Nk6-.mjs";
 import { n as requestContext } from "./requestContext-MrlJwECf.mjs";
+import { n as createEvent, t as MemoryEventTransport } from "./EventTransport-C6YA8xY9.mjs";
 import fp from "fastify-plugin";
-import { createEvent, matchEventPattern } from "@classytic/primitives/events";
-//#region src/events/EventTransport.ts
-/**
-* Internal arc events module — concrete in-memory transport.
-*
-* **Public type contracts moved out (arc 2.12).** `EventMeta`, `DomainEvent`,
-* `EventHandler`, `EventLogger`, `EventTransport`, `DeadLetteredEvent`,
-* `PublishManyResult`, plus the `createEvent` / `createChildEvent` /
-* `matchEventPattern` helpers, are now owned by `@classytic/primitives/events`.
-* Two reasons:
-*
-*   1. The shapes ARE the cross-package contract. arc, arc-next, mongokit's
-*      audit-log plugin, future kits and downstream services all share them.
-*      Owning them in `primitives` (pure types, zero runtime, zero deps)
-*      eliminates the "manually mirror in two places" problem the previous
-*      `primitives/src/events.ts` header explicitly called out.
-*   2. Inverting the dependency direction lets future packages (sqlitekit
-*      audit, billing services) consume the contract without depending on
-*      arc's HTTP-coupled stack.
-*
-* Hosts MUST import the types from primitives directly:
-*
-* ```typescript
-* import type {
-*   EventMeta, DomainEvent, EventHandler, EventTransport,
-*   DeadLetteredEvent, PublishManyResult,
-* } from '@classytic/primitives/events';
-* import { createEvent, createChildEvent } from '@classytic/primitives/events';
-* ```
-*
-* arc's `events/index.ts` barrel does NOT re-export these — by design, so
-* that consumer code is forced into the canonical import path and the org's
-* "no re-exports" rule holds at every public surface.
-*
-* What stays here:
-*   - `MemoryEventTransport` — the in-memory `EventTransport` implementation
-*     used as arc's default transport. Its handler-set state is process-local;
-*     wrong layer for primitives.
-*   - `MemoryEventTransportOptions` — its options shape.
-*
-* Inside arc, files that previously imported types from `./EventTransport.js`
-* keep working: this file re-exports them from primitives for arc's own
-* call sites. That re-export is an internal refactor convenience — the
-* public `events/index.ts` barrel stays clean.
-*/
-/**
-* In-memory event transport (default).
-*
-* Events are delivered synchronously within the process. Not suitable for
-* multi-instance deployments — pair with `RedisEventTransport` /
-* `RedisStreamTransport` (subpath imports) for those.
-*/
-var MemoryEventTransport = class {
-	name = "memory";
-	handlers = /* @__PURE__ */ new Map();
-	logger;
-	constructor(options) {
-		this.logger = options?.logger ?? console;
-	}
-	async publish(event) {
-		const allHandlers = /* @__PURE__ */ new Set();
-		for (const [pattern, handlers] of this.handlers) if (matchEventPattern(pattern, event.type)) for (const h of handlers) allHandlers.add(h);
-		for (const handler of allHandlers) try {
-			await handler(event);
-		} catch (err) {
-			this.logger.error(`[EventTransport] Handler error for ${event.type}:`, err);
-		}
-	}
-	/**
-	* Reference `publishMany` implementation — delegates to `publish()` in order.
-	*
-	* Production transports (Kafka, Redis pipeline, SQS batch) should override
-	* this with a single batched network call. Memory transport has nothing to
-	* batch, so we just loop — the loop still returns a proper result map so
-	* `EventOutbox.relay` can exercise the batched code path in tests.
-	*/
-	async publishMany(events) {
-		const results = /* @__PURE__ */ new Map();
-		for (const event of events) try {
-			await this.publish(event);
-			results.set(event.meta.id, null);
-		} catch (err) {
-			results.set(event.meta.id, err instanceof Error ? err : new Error(String(err)));
-		}
-		return results;
-	}
-	async subscribe(pattern, handler) {
-		if (!this.handlers.has(pattern)) this.handlers.set(pattern, /* @__PURE__ */ new Set());
-		this.handlers.get(pattern)?.add(handler);
-		return () => {
-			const set = this.handlers.get(pattern);
-			if (set) {
-				set.delete(handler);
-				if (set.size === 0) this.handlers.delete(pattern);
-			}
-		};
-	}
-	async close() {
-		this.handlers.clear();
-	}
-};
-//#endregion
 //#region src/events/retry.ts
 /**
 * Wrap an event handler with retry logic and dead letter support.
@@ -338,4 +237,4 @@ var eventPlugin_default = fp(eventPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { MemoryEventTransport as a, withRetry as i, eventPlugin_exports as n, createEvent as o, createDeadLetterPublisher as r, eventPlugin as t };
+export { withRetry as i, eventPlugin_exports as n, createDeadLetterPublisher as r, eventPlugin as t };