@classytic/arc 2.28.0 → 2.30.0

package/dist/{index-DPRH0Cme.d.mts → index-Q5gzEIWY.d.mts}

@@ -1,10 +1,11 @@
 import { a as QueryCacheConfig } from "./QueryCache-DOMT_iq7.mjs";
 import { P as ArcHeaders, i as RequestScope } from "./types-DjC-KUCz.mjs";
-import { c as AnyRecord, i as UserBase, t as PermissionCheck } from "./types-Dmw-6Qeo.mjs";
+import { a as UserBase, l as AnyRecord, r as PermissionCheck } from "./types-ChvvVNP8.mjs";
 import "./elevation-C9s5hFP_.mjs";
 import { n as FieldPermissionMap } from "./fields-D3lhgzhD.mjs";
 import { n as EncryptionDirective } from "./types-Cc91nXuA.mjs";
 import { n as DomainEvent } from "./EventTransport-QmY7A258.mjs";
+import { Filter } from "@classytic/repo-core/filter";
 import { KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, RouteHandlerMethod, RouteHandlerMethod as RouteHandlerMethod$1 } from "fastify";
 import { DataAdapter, RepositoryLike } from "@classytic/repo-core/adapter";
@@ -188,6 +189,22 @@ interface ControllerConfigurableOptions {
  */
 interface BaseControllerOptions extends ControllerConstructionOptions, ControllerConfigurableOptions {}
 //#endregion
+//#region src/scope/projection.d.ts
+/**
+ * Lightweight projection of `RequestScope` — just the fields tenant-aware
+ * hooks and controllers usually read. Full discriminated-union access is
+ * still available through the underlying `RequestScope` for advanced
+ * branching on `scope.kind`.
+ */
+interface RequestScopeProjection$1 {
+  /** Tenant the caller is scoped to (member, pinned elevated admin, service key bound to an org). */
+  organizationId?: string;
+  /** Caller's user id when authenticated — undefined for public / service-only scopes. */
+  userId?: string;
+  /** Org-level roles (e.g. `['admin', 'warehouse-manager']`) — separate from global `user.roles`. */
+  orgRoles?: string[];
+}
+//#endregion
 //#region src/hooks/HookSystem.d.ts
 type HookPhase = "before" | "around" | "after";
 type HookOperation = "create" | "update" | "delete" | "restore" | "read" | "list";
@@ -200,6 +217,18 @@ interface HookContext<T = AnyRecord> {
   user?: UserBase;
   context?: RequestContext;
   meta?: AnyRecord;
+  /**
+   * Tenant/user projection of the validated `RequestScope` — the same shape
+   * `ResourceHookContext.scope` and `IRequestContext.scope` expose, from the
+   * same helper, so every surface reads identity identically.
+   *
+   * THIS is the identity source in a global hook. `ctx.user` comes from the
+   * auth adapter and is not scope-validated; the canonical `updatedBy` hook is
+   * `ctx.scope?.userId`, not `ctx.user?.id`. `undefined` on public/unscoped
+   * routes. Branch on `scope.kind` via `ctx.context._scope` when you need the
+   * full discriminated union.
+   */
+  scope?: RequestScopeProjection$1;
 }
 type HookHandler<T = AnyRecord> = (ctx: HookContext<T>) => void | Promise<void> | T | Promise<T>;
 /**
@@ -230,14 +259,8 @@ declare class HookSystem {
   private logger;
   private warn;
   constructor(options?: HookSystemOptions);
-  /**
-   * Generate hook key
-   */
   private getKey;
-  /**
-   * Register a hook
-   * Supports both object parameter and positional arguments
-   */
+  /** Supports both the object-parameter and positional argument forms. */
   register<T = AnyRecord>(resourceOrOptions: string | {
     name?: string;
     resource: string;
@@ -247,13 +270,7 @@ declare class HookSystem {
     priority?: number;
     dependsOn?: string[];
   }, operation?: HookOperation, phase?: HookPhase, handler?: HookHandler<T>, priority?: number): () => void;
-  /**
-   * Register before hook
-   */
   before<T = AnyRecord>(resource: string, operation: HookOperation, handler: HookHandler<T>, priority?: number): () => void;
-  /**
-   * Register after hook
-   */
   after<T = AnyRecord>(resource: string, operation: HookOperation, handler: HookHandler<T>, priority?: number): () => void;
   /**
    * Register around hook — wraps the core operation.
@@ -269,22 +286,13 @@ declare class HookSystem {
     context?: RequestContext;
     meta?: AnyRecord;
   }): Promise<T | undefined>;
-  /**
-   * Execute hooks for a given context
-   */
   execute<T = AnyRecord>(ctx: HookContext<T>): Promise<T | undefined>;
-  /**
-   * Execute before hooks
-   */
   executeBefore<T = AnyRecord>(resource: string, operation: HookOperation, data: T, options?: {
     user?: UserBase;
     context?: RequestContext;
     meta?: AnyRecord;
   }): Promise<T>;
-  /**
-   * Execute after hooks
-   * Errors in after hooks are logged but don't fail the request
-   */
+  /** Errors in after hooks are logged but never fail the request. */
   executeAfter<T = AnyRecord>(resource: string, operation: HookOperation, result: T | T[], options?: {
     user?: UserBase;
     context?: RequestContext;
@@ -297,13 +305,7 @@ declare class HookSystem {
    * Hooks without names or dependencies pass through in their original order.
    */
   private topologicalSort;
-  /**
-   * Get all registered hooks
-   */
   getAll(): HookRegistration[];
-  /**
-   * Get hooks for a specific resource
-   */
   getForResource(resource: string): HookRegistration[];
   /**
    * Get hooks matching filter criteria.
@@ -347,13 +349,7 @@ declare class HookSystem {
    * Check if any hooks exist for a specific resource/operation/phase combination.
    */
   has(resource: string, operation: HookOperation, phase: HookPhase): boolean;
-  /**
-   * Clear all hooks
-   */
   clear(): void;
-  /**
-   * Clear hooks for a specific resource
-   */
   clearResource(resource: string): void;
 }
 /**
@@ -464,7 +460,7 @@ interface AccessControlConfig {
 /** Minimal repository interface for access-controlled fetch operations */
 interface AccessControlRepository {
   getById(id: string, options?: QueryOptions): Promise<unknown>;
-  getOne?: (filter: AnyRecord, options?: QueryOptions) => Promise<unknown>;
+  getOne?: (filter: AnyRecord | Filter, options?: QueryOptions) => Promise<unknown>;
 }
 declare class AccessControl {
   private readonly tenantField;
@@ -483,7 +479,7 @@ declare class AccessControl {
    * Build filter for single-item operations (get/update/delete)
    * Combines ID filter with policy/org filters for proper security enforcement
    */
-  buildIdFilter(id: string, req: IRequestContext): AnyRecord;
+  buildIdFilter(id: string, req: IRequestContext): AnyRecord | Filter;
   /**
    * Check if a post-fetch item matches the request's `_policyFilters`.
    *
@@ -657,7 +653,7 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /**
    * Composable access control (ID filtering, policy checks, org scope, ownership).
    *
-   * Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+   * Not `readonly` — `configure()` rebuilds it when the host
    * supplies tenant/idField/matchesFilter post-construction. Same model as
    * `queryResolver` after `setQueryParser` shipped in 2.10.9.
    */
@@ -665,7 +661,7 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
   /**
    * Composable body sanitization (field permissions, system fields).
    *
-   * Not `readonly` since 2.15.0 — `configure()` rebuilds it when the host
+   * Not `readonly` — `configure()` rebuilds it when the host
    * supplies schemaOptions/onFieldWriteDenied post-construction.
    */
   bodySanitizer: BodySanitizer;
@@ -854,9 +850,9 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    */
   private scheduleCacheRefresh;
   /** Cached `list()` flow with SWR semantics. Returns null when cache is disabled. */
-  protected withListCache(req: IRequestContext, options: ParsedQuery): Promise<IControllerResponse<ListResult<TDoc>> | null>;
+  protected withListCache(req: IRequestContext, options: ControllerQueryOptions): Promise<IControllerResponse<ListResult<TDoc>> | null>;
   /** Cached `get()` flow with SWR semantics. Returns null when cache is disabled. */
-  protected withGetCache(req: IRequestContext, id: string, options: ParsedQuery): Promise<IControllerResponse<TDoc> | null>;
+  protected withGetCache(req: IRequestContext, id: string, options: ControllerQueryOptions): Promise<IControllerResponse<TDoc> | null>;
   list(req: IRequestContext): Promise<IControllerResponse<ListResult<TDoc>>>;
   /**
    * Resource-dispatch verbs router. Returns `null` when the request is
@@ -897,10 +893,10 @@ declare class BaseCrudController<TDoc = AnyRecord, TRepository extends Repositor
    */
   protected isFieldExposedForRead(field: string): boolean;
   /** Execute list query through hooks (extracted for cache revalidation) */
-  protected executeListQuery(options: ParsedQuery, req: IRequestContext): Promise<ListResult<TDoc>>;
+  protected executeListQuery(options: ControllerQueryOptions, req: IRequestContext): Promise<ListResult<TDoc>>;
   get(req: IRequestContext): Promise<IControllerResponse<TDoc>>;
   /** Execute get query through hooks (extracted for cache revalidation) */
-  protected executeGetQuery(id: string, options: ParsedQuery, req: IRequestContext): Promise<{
+  protected executeGetQuery(id: string, options: ControllerQueryOptions, req: IRequestContext): Promise<{
     doc: TDoc | null;
     reason: FetchDenialReason | null;
   }>;
@@ -1325,11 +1321,9 @@ interface ServerAccessor {
 /**
  * First-class projection of `request._scope` for controller handlers.
  *
- * **v2.10.6:** previously, pulling tenant/user/role info from inside a
- * controller override meant digging through `req.metadata._scope` and
- * calling `getOrgId(scope)` / `getUserId(user)` manually. This projection
- * lifts the two fields most hosts need directly onto `req` so cross-kit
- * controller code reads:
+ * Lifts the two fields most hosts need directly onto `req`, so a controller
+ * override never digs through `req.metadata._scope` and calls
+ * `getOrgId(scope)` / `getUserId(user)` by hand:
  *
  * ```ts
  * async create(req: IRequestContext) {
@@ -1530,11 +1524,11 @@ interface IController<TDoc = unknown> {
  * Flexible controller interface — accepts controllers with any handler style,
  * including class instances with extra methods / private fields.
  *
- * **v2.10.6:** the previous `[key: string]: unknown` index signature made
- * real class instances fail structural assignment (`new ScrapController()`
- * needed a `as unknown as ControllerLike` cast, because class instances
- * don't have an index signature). Dropped — arc only invokes the CRUD
- * methods at runtime, so the rest of the shape is the caller's concern.
+ * Deliberately NO index signature: one would make real class instances fail
+ * structural assignment (`new ScrapController()` would need an
+ * `as unknown as ControllerLike` cast, because class instances don't have
+ * one). Arc only invokes the CRUD methods at runtime, so the rest of the
+ * shape is the caller's concern.
  *
  * The five CRUD slots stay optional so partial controllers (e.g. read-only)
  * assign too. Additional domain methods on the controller are allowed by
@@ -2318,12 +2312,9 @@ interface ResourceExtensions {
  * Hook context passed to resource-level hook handlers. Mirrors
  * HookSystem's HookContext but with a simpler API for inline use.
  *
- * **v2.10.8:** `context` and a first-class `scope` projection are now
- * forwarded from the internal `HookContext`. Before this release, inline
- * `config.hooks` handlers had no way to reach the caller's tenant or
- * user info — they had to bypass the documented API and push directly
- * into `resource._pendingHooks` to get the raw internal shape. Now the
- * documented DX is complete:
+ * `context` and a first-class `scope` projection are forwarded from the
+ * internal `HookContext`, so an inline handler reaches the caller's tenant
+ * and user through the documented API:
  *
  * ```ts
  * hooks: {
@@ -2358,7 +2349,7 @@ interface ResourceHookContext {
    * First-class projection of request scope — `{ organizationId?, userId?, orgRoles? }`.
    * Populated for every scoped request so multi-tenant hooks don't have to
    * drill into `context._scope.organizationId` themselves. Matches the
-   * identically-named field on `IRequestContext` (v2.10.6) so the same
+   * identically-named field on `IRequestContext` so the same
    * read pattern works in controllers and hooks.
    */
   scope?: {
@@ -2670,6 +2661,16 @@ interface PresetResult {
   /** Preset routes — merged into the resource's `routes` array. */
   routes?: RouteDefinition[] | ((permissions: ResourcePermissions) => RouteDefinition[]);
   middlewares?: MiddlewareConfig;
+  /**
+   * Permission gates the preset contributes as SECURE DEFAULTS. Merged per-op
+   * into the resource's `permissions`, but ONLY for operations the host has not
+   * explicitly gated — the host's own permission always wins. Lets a preset make
+   * authorization part of the permission/introspection model (required auth at
+   * `onRequest`, MCP parity) instead of relying on middleware alone. Example:
+   * `ownedByUser` injects `requireAuth()` on update/delete so an ownership
+   * resource is never public-by-omission.
+   */
+  permissions?: Partial<ResourcePermissions>;
   schemaOptions?: RouteSchemaOptions;
   controllerOptions?: Record<string, unknown>;
   hooks?: PresetHook[];
@@ -3035,6 +3036,18 @@ interface ResourceConfig<TDoc = AnyRecord> {
   skipValidation?: boolean;
   /** Don't register in introspection */
   skipRegistry?: boolean;
+  /**
+   * Fail-closed permission invariant. When `true`, any enabled CRUD WRITE
+   * (create/update/delete) that mounts WITHOUT a permission gate is a FATAL
+   * define-time error — `defineResource()` throws instead of shipping an
+   * unauthenticated write with only a warning. Reads that are ungated stay a
+   * non-fatal `info` hint (public catalogs are legitimate).
+   *
+   * Off by default (public-by-omission still only warns) so existing hosts are
+   * not broken. Opt in per-resource here, or app-wide via the
+   * `ARC_STRICT_PERMISSIONS=true` env — the recommended production posture.
+   */
+  strictPermissions?: boolean;
   /**
    * Default `limit` value when the request omits `?limit=`. Default 20.
    * Surfaced at the resource level (rather than only via a custom
@@ -3238,16 +3251,19 @@ interface ResourceConfig<TDoc = AnyRecord> {
  * "this resource will never work" failures.
  */
 /**
- * One non-fatal diagnostic produced during resource validation.
+ * One diagnostic produced during resource validation.
  *
- * - `severity`: log level the host logger uses (`warn` for misconfigurations
- *   the host should clean up, `info` for deprecation hints).
+ * - `severity`: `error` is FATAL — `defineResource()` throws at define-time,
+ *   the resource never boots (used by strict security invariants like ungated
+ *   CRUD under `strictPermissions`). `warn` flags a misconfiguration the host
+ *   should clean up; `info` is a deprecation hint. `warn`/`info` are non-fatal
+ *   and flushed through the host logger on first mount.
  * - `code`: stable identifier for the diagnostic — hosts and tests can match
  *   on this without parsing the human-readable message.
  * - `message`: pre-formatted line, resource name already interpolated.
  */
 interface ResourceDiagnostic {
-  severity: "warn" | "info";
+  severity: "error" | "warn" | "info";
   code: string;
   message: string;
 }
@@ -3787,6 +3803,7 @@ interface ArcInternalMetadata extends RequestContext {
   _ownershipCheck?: {
     field: string;
     userId: string;
+    missingOwner?: "deny" | "allow";
   };
   /** Arc instance references (hooks, field permissions, etc.) */
   arc?: {
@@ -3819,7 +3836,13 @@ interface ControllerQueryOptions {
    */
   lookups?: LookupOption[];
   select?: string | string[] | Record<string, 0 | 1>;
-  filters?: Record<string, unknown>;
+  /**
+   * Resolved row filter. Flat equality filters are a plain record; filters
+   * carrying `$`-operators (`$or`/`$and`/`$gte`) are normalized to the portable
+   * repo-core `Filter` IR at the repository boundary (see `toRepositoryFilter`)
+   * so every kit compiles them. Repositories accept both (`FilterInput`).
+   */
+  filters?: Record<string, unknown> | Filter;
   search?: string;
   lean?: boolean;
   after?: string;
@@ -3875,6 +3898,14 @@ interface PopulateOption {
  * parsers (MongoKit, PrismaKit) add fields without breaking Arc's types.
  */
 interface ParsedQuery {
+  /**
+   * Row filter — a plain record in the parser's operator dialect. This is the
+   * PARSER contract: a `QueryParser` (arc built-in, MongoKit, PrismaKit) emits a
+   * record, never repo-core `Filter` IR. IR appears only AFTER security
+   * composition, on `ControllerQueryOptions.filters` (via `toRepositoryFilter`).
+   * Keeping this record-only means `QueryResolver` never has to guess whether a
+   * parsed filter is an IR node it must not blindly spread tenant/policy onto.
+   */
   filters?: Record<string, unknown>;
   limit?: number;
   sort?: string | Record<string, 1 | -1>;

package/dist/index.d.mts

@@ -1,11 +1,11 @@
-import { $t as SlugExt, A as RequestIdOptions, An as ControllerConfigurableOptions, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcListResult, E as GracefulShutdownOptions, En as ArcGetResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, Jt as BaseController, L as RequestWithExtras, Lt as IController, Mn as ListResult, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ArcUpdateResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeMixin, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcDeleteResult, U as ResourceConfig, Ut as AuthPluginOptions, V as ResourceDefinition, X as CrudRouteKey, Xt as SoftDeleteMixin, Y as PresetResult, Yt as SoftDeleteExt, Z as CrudSchemas, Zt as TreeExt, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugMixin, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, jn as ControllerConstructionOptions, k as IntrospectionPluginOptions, kn as BaseControllerOptions, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkMixin, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BaseCrudController, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as BulkExt, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, wn as ArcCreateResult, y as OwnershipCheck, zt as IRequestContext } from "./index-DPRH0Cme.mjs";
-import { c as AnyRecord, i as UserBase, l as ArcRequest, n as PermissionContext, p as UserOrganization, r as PermissionResult, t as PermissionCheck, u as JWTPayload } from "./types-Dmw-6Qeo.mjs";
+import { $t as SlugExt, A as RequestIdOptions, An as ControllerConfigurableOptions, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcListResult, E as GracefulShutdownOptions, En as ArcGetResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, Jt as BaseController, L as RequestWithExtras, Lt as IController, Mn as ListResult, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ArcUpdateResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeMixin, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcDeleteResult, U as ResourceConfig, Ut as AuthPluginOptions, V as ResourceDefinition, X as CrudRouteKey, Xt as SoftDeleteMixin, Y as PresetResult, Yt as SoftDeleteExt, Z as CrudSchemas, Zt as TreeExt, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugMixin, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, jn as ControllerConstructionOptions, k as IntrospectionPluginOptions, kn as BaseControllerOptions, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkMixin, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BaseCrudController, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as BulkExt, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, wn as ArcCreateResult, y as OwnershipCheck, zt as IRequestContext } from "./index-Q5gzEIWY.mjs";
+import { a as UserBase, d as JWTPayload, i as PermissionContext, l as AnyRecord, m as UserOrganization, n as DataPolicy, r as PermissionCheck, t as AuthorizationDecision, u as ArcRequest } from "./types-ChvvVNP8.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-D3lhgzhD.mjs";
-import "./fastify-augmentation-OzYGIiU1.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-CjVg-Epg.mjs";
-import { A as allOf, E as DynamicPermissionMatrixConfig, F as requireAuth, I as requireOwnership, L as requireRoles, M as anyOf, N as denyAll, O as createDynamicPermissionMatrix, T as DynamicPermissionMatrix, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, j as allowPublic, k as createOrgPermissions, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as when } from "./index-BMnbzvtO.mjs";
+import "./fastify-augmentation-0WhPnUH7.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-Cx7bro4R.mjs";
+import { B as anyOf, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as when, K as requireRoles, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, W as requireAuth, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as allowPublic } from "./index-Ch16aAah.mjs";
 import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DHcHVAgk.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PermissionResult, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,12 +1,13 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DNre0wRg.mjs";
 import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B65zbz9m.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, o as fields } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-2zvVVpxg.mjs";
-import { c as getControllerScope } from "./pipeline-BGRnV-To.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction, s as defineAggregation } from "./core-BGa8TXJR.mjs";
-import { A as requireAuth, D as anyOf, E as allowPublic, M as requireRoles, O as denyAll, P as when, T as allOf, _ as requireOrgMembership, b as requireServiceScope, c as publicReadAdminWrite, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as requireOwnership, l as readOnly, m as createDynamicPermissionMatrix, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as requireOrgRole, x as requireTeamMembership, y as requireScopeContext } from "./permissions-BrtiBKGs.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B5DwufbB.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-CxWqDCAy.mjs";
+import { c as getControllerScope } from "./pipeline-BJnpkY9i.mjs";
+import { t as defineAggregation } from "./defineAggregation-ufWjUwml.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-poalJLvp.mjs";
+import { B as when, C as requireScopeContext, I as requireAuth, L as requireOwnership, M as anyOf, P as denyAll, R as requireRoles, S as requireOrgRole, T as requireTeamMembership, b as requireOrgInScope, c as publicReadAdminWrite, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions } from "./permissions-Bfu_8y1U.mjs";
 //#region src/index.ts
-const version = "2.28.0";
+const version = "2.30.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/integrations/index.d.mts

@@ -1,7 +1,7 @@
 import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-_Pd0CgR0.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
 import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-CG4yqMDB.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-QFGc3Cjv.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-Bmmn-fO0.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/mcp/index.d.mts

@@ -1,8 +1,8 @@
-import { Rt as IControllerResponse, V as ResourceDefinition, Vt as ServerAccessor, zt as IRequestContext } from "../../index-DPRH0Cme.mjs";
+import { Rt as IControllerResponse, V as ResourceDefinition, Vt as ServerAccessor, zt as IRequestContext } from "../../index-Q5gzEIWY.mjs";
 import { i as RequestScope } from "../../types-DjC-KUCz.mjs";
-import { t as PermissionCheck } from "../../types-Dmw-6Qeo.mjs";
+import { r as PermissionCheck } from "../../types-ChvvVNP8.mjs";
 import { n as FieldPermissionMap } from "../../fields-D3lhgzhD.mjs";
-import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-QFGc3Cjv.mjs";
+import { _ as ToolDefinition, a as CrudDescriptionOverride, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, i as CrudDescriptionMeta, l as McpExecutionWiring, m as SessionEntry, n as CallToolResult, o as CrudOperation, p as PromptResult, r as CreateMcpServerConfig, s as McpAuthResolver, t as BetterAuthHandler, u as McpPluginOptions } from "../../types-Bmmn-fO0.mjs";
 import { ErrorContract } from "@classytic/repo-core/errors";
 import { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -340,9 +340,9 @@ interface McpContextExtras {
  * | delete    | { id }     | {}                   | undefined           |
  *
  * **scopeOverride** — when a permission check (e.g. `requireApiKey()`) returns
- * `PermissionResult.scope`, the MCP tool handler must install it on the request
- * context the same way CRUD/action routes do. This parameter follows the exact
- * same non-downgrade rule as `applyPermissionResult`: it overrides only when
+ * an `AuthorizationDecision.scope`, the MCP tool handler must install it on the
+ * request context the same way CRUD/action routes do. This parameter follows the exact
+ * same non-downgrade rule as `applyAuthorizationDecision`: it overrides only when
  * the session-derived scope is `public` (i.e. MCP called with `auth: false`).
  * An authenticated session scope is never overwritten.
  */

package/dist/integrations/mcp/index.mjs

@@ -1,4 +1,4 @@
-import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-Cs6nRGCt.mjs";
+import { a as defaultCrudDescription, c as mcpHandlerAdapter, d as toCallToolResult, f as toCallToolSuccess, h as resolveToolCollisions, i as fieldRulesToZod, l as permissionDeniedResult, m as createMcpServer, n as mcpPlugin, o as resolveCrudDescription, p as buildRequestContext, r as resourceToTools, s as invokeController, t as filterResourcesForMcp, u as toCallToolError } from "../../mcpPlugin-nRzm5g2s.mjs";
 //#region src/integrations/mcp/defineTool.ts
 /**
 * Define a type-safe MCP tool.

package/dist/integrations/mcp/testing.d.mts

@@ -1,4 +1,4 @@
-import { c as McpAuthResult, u as McpPluginOptions } from "../../types-QFGc3Cjv.mjs";
+import { c as McpAuthResult, u as McpPluginOptions } from "../../types-Bmmn-fO0.mjs";
 //#region src/integrations/mcp/testing.d.ts
 interface TestMcpClientOptions {
   /** MCP plugin options (resources, overrides, etc.) — same as mcpPlugin config */

package/dist/integrations/mcp/testing.mjs

@@ -1,4 +1,4 @@
-import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-Cs6nRGCt.mjs";
+import { m as createMcpServer, r as resourceToTools, t as filterResourcesForMcp } from "../../mcpPlugin-nRzm5g2s.mjs";
 //#region src/integrations/mcp/testing.ts
 /**
 * @classytic/arc/mcp/testing — MCP Test Utilities