@classytic/arc 2.28.0 → 2.30.0

package/dist/{mcpPlugin-Cs6nRGCt.mjs → mcpPlugin-nRzm5g2s.mjs}

@@ -1,12 +1,14 @@
 import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
 import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
 import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as BaseController } from "./BaseController-B65zbz9m.mjs";
-import { i as applyFieldReadPermissions, r as normalizePermissionResult, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
+import { t as BaseController } from "./BaseController-B5DwufbB.mjs";
+import { i as evaluatePermissionDecision } from "./applyPermissionResult-Cf6zUCvb.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
 import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
-import { r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-BGRnV-To.mjs";
+import { t as buildRequestScopeProjection } from "./projection-UBDgfMwu.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-BJnpkY9i.mjs";
 import { n as validateAggregations } from "./validate-Bk44F2yT.mjs";
-import { n as executeAggregation } from "./buildHandler-Dtwd8fdz.mjs";
+import { n as executeAggregation } from "./buildHandler-BYS3Vkfz.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
 import { t as createIdempotencyResult } from "./interface-n5hpKg1d.mjs";
@@ -181,9 +183,9 @@ function registerPrompt(server, prompt) {
 * | delete    | { id }     | {}                   | undefined           |
 *
 * **scopeOverride** — when a permission check (e.g. `requireApiKey()`) returns
-* `PermissionResult.scope`, the MCP tool handler must install it on the request
-* context the same way CRUD/action routes do. This parameter follows the exact
-* same non-downgrade rule as `applyPermissionResult`: it overrides only when
+* an `AuthorizationDecision.scope`, the MCP tool handler must install it on the
+* request context the same way CRUD/action routes do. This parameter follows the exact
+* same non-downgrade rule as `applyAuthorizationDecision`: it overrides only when
 * the session-derived scope is `public` (i.e. MCP called with `auth: false`).
 * An authenticated session scope is never overwritten.
 */
@@ -353,39 +355,30 @@ function buildScope(auth) {
 /**
 * Evaluate a resource's permission check in MCP context.
 *
-* Returns the full normalized `PermissionResult` so the caller can honor
-* ALL side-effects (filters + scope) consistently with CRUD/action routes.
-* Returns `null` when no permission is defined (= allow, no side effects).
+* Returns the full normalized {@link AuthorizationDecision} so the caller can
+* honor ALL side-effects (data policy + scope) consistently with CRUD/action
+* routes. Returns `null` when no permission is defined (= allow, no side effects).
 *
-* Promoting booleans to `PermissionResult` via the shared
-* `normalizePermissionResult` helper keeps the contract aligned with the
-* rest of arc — one normalization path for every call site.
+* This is the MCP transport adapter: it builds a `PermissionContext` from the
+* MCP session and delegates the actual decision to the ONE transport-neutral
+* `evaluatePermissionDecision` — same normalization + exception mapping every
+* surface uses, so MCP enforcement can't drift from HTTP/aggregation.
 */
 async function evaluatePermission(check, session, resource, action, input) {
 	if (!check) return null;
-	const user = session ? {
-		id: session.userId,
-		_id: session.userId,
-		...session
-	} : null;
-	const scope = buildScope(session);
-	return normalizePermissionResult(await check({
-		user,
-		request: {
-			user,
-			headers: {},
-			params: {},
-			query: {},
-			body: input,
-			scope,
-			metadata: { _scope: scope }
-		},
+	return evaluatePermissionDecision(check, {
+		user: session ? {
+			id: session.userId,
+			_id: session.userId,
+			...session
+		} : null,
+		scope: buildScope(session),
 		resource,
 		action,
 		resourceId: typeof input.id === "string" ? input.id : void 0,
 		params: {},
 		data: input
-	}));
+	});
 }
 /**
 * Apply field-level READ permissions to an MCP tool payload — the same
@@ -399,7 +392,7 @@ async function evaluatePermission(check, session, resource, action, input) {
 *    `requireOrgRole()` and `BodySanitizer` bypass logic.
 *  - Effective roles = session roles ∪ org roles (member scope only),
 *    via the shared `resolveEffectiveRoles`.
-*  - `scopeOverride` (a `PermissionResult.scope`) follows the same
+*  - `scopeOverride` (a decision's `scope`) follows the same
 *    non-downgrade rule as `buildRequestContext`: honored only when the
 *    session-derived scope is `public`.
 *
@@ -639,14 +632,14 @@ async function invokeController(controller, op, input, options) {
 			status: 501
 		});
 		const permResult = await evaluatePermission(permissions, session, resourceName, actionName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: actionName,
 			reason: permResult.reason,
 			session
 		});
 		const dispatch = async () => {
-			const reqCtx = buildRequestContext(input, session, op, permResult?.filters, permResult?.scope, buildContextExtras(options));
+			const reqCtx = buildRequestContext(input, session, op, permResult?.policy, permResult?.scope, buildContextExtras(options));
 			const response = await method(reqCtx);
 			const data = applyMcpReadMasking(response.data, {
 				fields,
@@ -1217,7 +1210,7 @@ function createActionToolHandler(actionName, handler, permissions, resourceName,
 			});
 		}
 		const permResult = await evaluatePermission(permissions, session, resourceName, actionName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: `action.${actionName}`,
 			reason: permResult.reason,
@@ -1226,7 +1219,7 @@ function createActionToolHandler(actionName, handler, permissions, resourceName,
 		const reqCtx = buildRequestContext({
 			...input,
 			action: actionName
-		}, session, "action", permResult?.filters, permResult?.scope, contextExtras);
+		}, session, "action", permResult?.policy, permResult?.scope, contextExtras);
 		const id = idLess ? "" : typeof input.id === "string" ? input.id : "";
 		const { id: _discardId, ...data } = input;
 		try {
@@ -1319,7 +1312,7 @@ function createAggregationToolHandler(args) {
 	const { normalized, permissions, resourceName, repo, buildOptionsFromSession, fields } = args;
 	return async (input, ctx) => {
 		const permResult = await evaluatePermission(permissions, ctx.session, resourceName, `aggregation:${normalized.name}`, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: `aggregation:${normalized.name}`,
 			reason: permResult.reason,
@@ -1327,13 +1320,13 @@ function createAggregationToolHandler(args) {
 		});
 		const filterInput = input.filter ?? {};
 		const tenantOptions = buildOptionsFromSession(ctx.session);
-		if (permResult?.filters) Object.assign(tenantOptions, { _policyFilters: permResult.filters });
 		const result = await executeAggregation(normalized, {
 			repo,
 			buildOptions: () => tenantOptions
 		}, {
 			query: filterInput,
-			tenantOptions
+			tenantOptions,
+			policyFilter: permResult?.policy
 		});
 		if (result.status === 200) {
 			const body = result.body;
@@ -1676,8 +1669,8 @@ function operationKindForRoute(method, hasId) {
 *
 * Enforces the same contract as the REST route:
 *   1. **Permission evaluation** via the shared `evaluatePermission` — the
-*      exact path CRUD and action MCP tools use. Filters and scope from a
-*      `PermissionResult` thread through `buildRequestContext`.
+*      exact path CRUD and action MCP tools use. Policy and scope from the
+*      `AuthorizationDecision` thread through `buildRequestContext`.
 *   2. **Pipeline integration** — function handlers run inside
 *      `executePipeline` with the same steps the HTTP path resolves.
 *   3. **Controller dispatch** for string handlers.
@@ -1710,14 +1703,14 @@ function createCustomRouteHandler(route, controller, hasId, options) {
 	return async (input, _ctx) => {
 		const session = _ctx.session;
 		const permResult = await evaluatePermission(permissions, session, resourceName, operationName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: operationName,
 			reason: permResult.reason,
 			session
 		});
 		try {
-			const reqCtx = buildRequestContext(input, session, operationKindForRoute(route.method, hasId), permResult?.filters, permResult?.scope, contextExtras);
+			const reqCtx = buildRequestContext(input, session, operationKindForRoute(route.method, hasId), permResult?.policy, permResult?.scope, contextExtras);
 			const emit = (envelope) => {
 				const data = applyMcpReadMasking(envelope.data, {
 					fields,

package/dist/middleware/index.d.mts

@@ -1,4 +1,4 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DPRH0Cme.mjs";
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-Q5gzEIWY.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/migrations/index.d.mts

@@ -229,9 +229,6 @@ declare class MigrationRunner {
    * Get all applied migrations
    */
   getAppliedMigrations(): Promise<MigrationRecord[]>;
-  /**
-   * Get pending migrations
-   */
   getPendingMigrations(migrations: Migration[]): Promise<Migration[]>;
   /**
    * Check if migrations are up to date

package/dist/migrations/index.mjs

@@ -277,9 +277,6 @@ var MigrationRunner = class {
 	async getAppliedMigrations() {
 		return this.store.getApplied();
 	}
-	/**
-	* Get pending migrations
-	*/
 	async getPendingMigrations(migrations) {
 		const applied = await this.store.getApplied();
 		const appliedVersions = new Set(applied.map((m) => `${m.resource}:${m.version}`));

package/dist/{openapi-BLV4OMXb.mjs → openapi-B8Vkbxbn.mjs}

@@ -2,7 +2,7 @@ import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
 import { n as convertRouteSchema } from "./schemaConverter-DJvodiHj.mjs";
 import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
 import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-C-N7z2EL.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-BxuywVRB.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/permissions/index.d.mts

@@ -1,4 +1,4 @@
-import { i as UserBase, n as PermissionContext, o as getUserRoles, r as PermissionResult, s as normalizeRoles, t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
+import { a as UserBase, c as normalizeRoles, i as PermissionContext, n as DataPolicy, r as PermissionCheck, s as getUserRoles, t as AuthorizationDecision } from "../types-ChvvVNP8.mjs";
 import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-D3lhgzhD.mjs";
-import { A as allOf, B as applyPermissionResult, C as requireGrant, D as PermissionEventBus, E as DynamicPermissionMatrixConfig, F as requireAuth, G as requireDPoP, H as RequireAgentScopeOptions, I as requireOwnership, K as requireMandate, L as requireRoles, M as anyOf, N as denyAll, O as createDynamicPermissionMatrix, P as not, R as roles, S as modeSatisfies, T as DynamicPermissionMatrix, U as RequireMandateOptions, V as normalizePermissionResult, W as requireAgentScope, _ as createRoleHierarchy, a as permissionMatrix, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, j as allowPublic, k as createOrgPermissions, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, v as GRANT_MODES, w as ConnectEventsOptions, x as RequireGrantOptions, y as GrantMode, z as when } from "../index-BMnbzvtO.mjs";
-export { type ConnectEventsOptions, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionContext, type PermissionEventBus, type PermissionResult, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, modeSatisfies, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+import { $ as evaluatePermissionDecision, A as explainAccess, B as anyOf, C as requireGrant, D as collectPublicSurface, E as PermissionRequirement, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as when, K as requireRoles, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, O as describePermission, P as PermissionEventBus, Q as applyPermissionResult, R as allow, S as modeSatisfies, T as AccessExplanation, U as not, V as deny, W as requireAuth, X as PermissionCheckReturn, Y as scopeOf, Z as applyAuthorizationDecision, _ as createRoleHierarchy, a as permissionMatrix, at as requireMandate, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, et as normalizeToDecision, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, it as requireDPoP, j as ConnectEventsOptions, k as describePermissionMap, l as readOnly, m as requireServiceScope, n as authenticated, nt as RequireMandateOptions, o as presets_d_exports, p as requireScopeContext, q as roles, r as fullPublic, rt as requireAgentScope, s as publicRead, t as adminOnly, tt as RequireAgentScopeOptions, u as requireOrgInScope, v as GRANT_MODES, w as conjoinPolicyFilters, x as RequireGrantOptions, y as GrantMode, z as allowPublic } from "../index-Ch16aAah.mjs";
+export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEventBus, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,4 +1,5 @@
 import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, o as fields, r as normalizePermissionResult, s as resolveEffectiveRoles, t as applyPermissionResult } from "../applyPermissionResult-BnyVE9eD.mjs";
-import { A as requireAuth, C as requireDPoP, D as anyOf, E as allowPublic, M as requireRoles, N as roles, O as denyAll, P as when, S as requireAgentScope, T as allOf, _ as requireOrgMembership, a as permissionMatrix, b as requireServiceScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as requireOwnership, k as not, l as readOnly, m as createDynamicPermissionMatrix, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as requireOrgRole, w as requireMandate, x as requireTeamMembership, y as requireScopeContext } from "../permissions-BrtiBKGs.mjs";
-export { GRANT_MODES, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, modeSatisfies, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+import { a as normalizeToDecision, i as evaluatePermissionDecision, n as applyPermissionResult, o as conjoinPolicyFilters, t as applyAuthorizationDecision } from "../applyPermissionResult-Cf6zUCvb.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CQ_7KQWw.mjs";
+import { A as allow, B as when, C as requireScopeContext, D as requireDPoP, E as requireAgentScope, F as not, I as requireAuth, L as requireOwnership, M as anyOf, N as deny, O as requireMandate, P as denyAll, R as requireRoles, S as requireOrgRole, T as requireTeamMembership, V as scopeOf, _ as explainAccess, a as permissionMatrix, b as requireOrgInScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as describePermissionMap, h as describePermission, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, m as collectPublicSurface, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions, z as roles } from "../permissions-Bfu_8y1U.mjs";
+export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };