@classytic/arc 2.28.0 → 2.31.0

package/dist/{loadResources-DpU8pfjV.mjs → loadResources-yawi9tAE.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { readdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";

package/dist/{loadResourcesFromEntry-kvGT6EcO.mjs → loadResourcesFromEntry-BAjYZonx.mjs}

@@ -1,4 +1,5 @@
-import { t as ResourceRegistry } from "./ResourceRegistry-y9Hnypus.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as ResourceRegistry } from "./ResourceRegistry-qq0mn2s9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/utils/loadResourcesFromEntry.ts

package/dist/logger/index.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/logger/index.d.ts
 /**
  * Arc Logger — Centralized debug & warning system

package/dist/logger/index.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/logger/index.ts
 let globalOptions = {};
 /**

package/dist/{mcpPlugin-Cs6nRGCt.mjs → mcpPlugin-B_es0hiF.mjs}

@@ -1,16 +1,19 @@
-import { p as isArcError, t as ArcError } from "./errors-DkO8Nk6-.mjs";
-import { n as requireSingleHeaderValue } from "./headers-BvlQSDMB.mjs";
-import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-CSyCxl2V.mjs";
-import { t as BaseController } from "./BaseController-B65zbz9m.mjs";
-import { i as applyFieldReadPermissions, r as normalizePermissionResult, s as resolveEffectiveRoles } from "./applyPermissionResult-BnyVE9eD.mjs";
-import { t as executePipeline } from "./pipe-BOLmGIxa.mjs";
-import { r as resolvePipelineSteps, u as buildRequestScopeProjection } from "./pipeline-BGRnV-To.mjs";
-import { n as validateAggregations } from "./validate-Bk44F2yT.mjs";
-import { n as executeAggregation } from "./buildHandler-Dtwd8fdz.mjs";
-import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
-import { t as createIdempotencyResult } from "./interface-n5hpKg1d.mjs";
-import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { r as evaluatePermissionDecision } from "./authorizationDecision-ChvUQGG1.mjs";
+import { p as isArcError, t as ArcError } from "./errors-Cj42AntO.mjs";
+import { n as requireSingleHeaderValue } from "./headers-3zvE0rM3.mjs";
+import { b as isElevated, c as getOrgId, g as getUserId, x as isMember } from "./types-Cys0ko9Z.mjs";
+import { t as BaseController } from "./BaseController-De7GqHck.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
+import { t as executePipeline } from "./pipe-DRDNsI2T.mjs";
+import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
+import { r as resolvePipelineSteps } from "./pipeline-UPQFatit.mjs";
+import { n as validateAggregations } from "./validate-_KbifpHF.mjs";
+import { n as executeAggregation } from "./buildHandler-CDrCJzmB.mjs";
+import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
+import { t as createIdempotencyResult } from "./interface-DYzM0q-u.mjs";
+import { r as shouldRejectAdditionalProperties, t as normalizeSchemaIR } from "./schemaIR-Bm2enbnh.mjs";
 import { isHttpError, toErrorContract } from "@classytic/repo-core/errors";
 import { createHash, randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
@@ -181,9 +184,9 @@ function registerPrompt(server, prompt) {
 * | delete    | { id }     | {}                   | undefined           |
 *
 * **scopeOverride** — when a permission check (e.g. `requireApiKey()`) returns
-* `PermissionResult.scope`, the MCP tool handler must install it on the request
-* context the same way CRUD/action routes do. This parameter follows the exact
-* same non-downgrade rule as `applyPermissionResult`: it overrides only when
+* an `AuthorizationDecision.scope`, the MCP tool handler must install it on the
+* request context the same way CRUD/action routes do. This parameter follows the exact
+* same non-downgrade rule as `applyAuthorizationDecision`: it overrides only when
 * the session-derived scope is `public` (i.e. MCP called with `auth: false`).
 * An authenticated session scope is never overwritten.
 */
@@ -353,39 +356,30 @@ function buildScope(auth) {
 /**
 * Evaluate a resource's permission check in MCP context.
 *
-* Returns the full normalized `PermissionResult` so the caller can honor
-* ALL side-effects (filters + scope) consistently with CRUD/action routes.
-* Returns `null` when no permission is defined (= allow, no side effects).
+* Returns the full normalized {@link AuthorizationDecision} so the caller can
+* honor ALL side-effects (data policy + scope) consistently with CRUD/action
+* routes. Returns `null` when no permission is defined (= allow, no side effects).
 *
-* Promoting booleans to `PermissionResult` via the shared
-* `normalizePermissionResult` helper keeps the contract aligned with the
-* rest of arc — one normalization path for every call site.
+* This is the MCP transport adapter: it builds a `PermissionContext` from the
+* MCP session and delegates the actual decision to the ONE transport-neutral
+* `evaluatePermissionDecision` — same normalization + exception mapping every
+* surface uses, so MCP enforcement can't drift from HTTP/aggregation.
 */
 async function evaluatePermission(check, session, resource, action, input) {
 	if (!check) return null;
-	const user = session ? {
-		id: session.userId,
-		_id: session.userId,
-		...session
-	} : null;
-	const scope = buildScope(session);
-	return normalizePermissionResult(await check({
-		user,
-		request: {
-			user,
-			headers: {},
-			params: {},
-			query: {},
-			body: input,
-			scope,
-			metadata: { _scope: scope }
-		},
+	return evaluatePermissionDecision(check, {
+		user: session ? {
+			id: session.userId,
+			_id: session.userId,
+			...session
+		} : null,
+		scope: buildScope(session),
 		resource,
 		action,
 		resourceId: typeof input.id === "string" ? input.id : void 0,
 		params: {},
 		data: input
-	}));
+	});
 }
 /**
 * Apply field-level READ permissions to an MCP tool payload — the same
@@ -399,7 +393,7 @@ async function evaluatePermission(check, session, resource, action, input) {
 *    `requireOrgRole()` and `BodySanitizer` bypass logic.
 *  - Effective roles = session roles ∪ org roles (member scope only),
 *    via the shared `resolveEffectiveRoles`.
-*  - `scopeOverride` (a `PermissionResult.scope`) follows the same
+*  - `scopeOverride` (a decision's `scope`) follows the same
 *    non-downgrade rule as `buildRequestContext`: honored only when the
 *    session-derived scope is `public`.
 *
@@ -639,14 +633,14 @@ async function invokeController(controller, op, input, options) {
 			status: 501
 		});
 		const permResult = await evaluatePermission(permissions, session, resourceName, actionName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: actionName,
 			reason: permResult.reason,
 			session
 		});
 		const dispatch = async () => {
-			const reqCtx = buildRequestContext(input, session, op, permResult?.filters, permResult?.scope, buildContextExtras(options));
+			const reqCtx = buildRequestContext(input, session, op, permResult?.policy, permResult?.scope, buildContextExtras(options));
 			const response = await method(reqCtx);
 			const data = applyMcpReadMasking(response.data, {
 				fields,
@@ -1217,7 +1211,7 @@ function createActionToolHandler(actionName, handler, permissions, resourceName,
 			});
 		}
 		const permResult = await evaluatePermission(permissions, session, resourceName, actionName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: `action.${actionName}`,
 			reason: permResult.reason,
@@ -1226,7 +1220,7 @@ function createActionToolHandler(actionName, handler, permissions, resourceName,
 		const reqCtx = buildRequestContext({
 			...input,
 			action: actionName
-		}, session, "action", permResult?.filters, permResult?.scope, contextExtras);
+		}, session, "action", permResult?.policy, permResult?.scope, contextExtras);
 		const id = idLess ? "" : typeof input.id === "string" ? input.id : "";
 		const { id: _discardId, ...data } = input;
 		try {
@@ -1319,7 +1313,7 @@ function createAggregationToolHandler(args) {
 	const { normalized, permissions, resourceName, repo, buildOptionsFromSession, fields } = args;
 	return async (input, ctx) => {
 		const permResult = await evaluatePermission(permissions, ctx.session, resourceName, `aggregation:${normalized.name}`, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: `aggregation:${normalized.name}`,
 			reason: permResult.reason,
@@ -1327,13 +1321,13 @@ function createAggregationToolHandler(args) {
 		});
 		const filterInput = input.filter ?? {};
 		const tenantOptions = buildOptionsFromSession(ctx.session);
-		if (permResult?.filters) Object.assign(tenantOptions, { _policyFilters: permResult.filters });
 		const result = await executeAggregation(normalized, {
 			repo,
 			buildOptions: () => tenantOptions
 		}, {
 			query: filterInput,
-			tenantOptions
+			tenantOptions,
+			policyFilter: permResult?.policy
 		});
 		if (result.status === 200) {
 			const body = result.body;
@@ -1641,7 +1635,7 @@ function mapJsonSchemaTypeToArcType(jsonType) {
 *
 * 1. `mcpHandler` (full bypass) — caller-supplied function owns the whole
 *    tool result; pipeline is not invoked.
-* 2. Function handler with `raw: false/undefined` — arc's pipeline wrapper
+* 2. Function in `handler` (the arc pipeline) — arc's pipeline wrapper
 *    runs normally, and the envelope is serialized into the tool result.
 * 3. String handler — looks up a method on the controller by name.
 */
@@ -1676,8 +1670,8 @@ function operationKindForRoute(method, hasId) {
 *
 * Enforces the same contract as the REST route:
 *   1. **Permission evaluation** via the shared `evaluatePermission` — the
-*      exact path CRUD and action MCP tools use. Filters and scope from a
-*      `PermissionResult` thread through `buildRequestContext`.
+*      exact path CRUD and action MCP tools use. Policy and scope from the
+*      `AuthorizationDecision` thread through `buildRequestContext`.
 *   2. **Pipeline integration** — function handlers run inside
 *      `executePipeline` with the same steps the HTTP path resolves.
 *   3. **Controller dispatch** for string handlers.
@@ -1710,14 +1704,14 @@ function createCustomRouteHandler(route, controller, hasId, options) {
 	return async (input, _ctx) => {
 		const session = _ctx.session;
 		const permResult = await evaluatePermission(permissions, session, resourceName, operationName, input);
-		if (permResult && !permResult.granted) return permissionDeniedResult({
+		if (permResult && permResult.effect !== "allow") return permissionDeniedResult({
 			resource: resourceName,
 			operation: operationName,
 			reason: permResult.reason,
 			session
 		});
 		try {
-			const reqCtx = buildRequestContext(input, session, operationKindForRoute(route.method, hasId), permResult?.filters, permResult?.scope, contextExtras);
+			const reqCtx = buildRequestContext(input, session, operationKindForRoute(route.method, hasId), permResult?.policy, permResult?.scope, contextExtras);
 			const emit = (envelope) => {
 				const data = applyMcpReadMasking(envelope.data, {
 					fields,
@@ -1879,10 +1873,10 @@ function resourceToTools(resource, config = {}) {
 	for (const route of resource.routes ?? []) {
 		if (route.mcp === false) continue;
 		const mcpHandler = route.mcpHandler;
-		if (!!route.raw && !mcpHandler) continue;
+		if (!(route.rawHandler === void 0) && !mcpHandler) continue;
 		if (!mcpHandler && typeof route.handler === "string" && !controller) continue;
 		const routeWithRef = route;
-		let resolvedRouteHandler = route.handler;
+		let resolvedRouteHandler = route.handler ?? route.rawHandler;
 		if (typeof routeWithRef.controllerMethod === "function" && !resolvedRouteHandler) {
 			if (!controller) continue;
 			const referenced = routeWithRef.controllerMethod(controller);
@@ -2197,7 +2191,6 @@ const mcpPluginImpl = async (fastify, options) => {
 	}
 	const enabledResources = filterResourcesForMcp(options.resources, {
 		expose: options.expose,
-		include: options.include,
 		exclude: options.exclude
 	});
 	const fastifyAny = fastify;
@@ -2472,11 +2465,10 @@ function registerStatefulRoutes(fastify, prefix, options, cache, createServer, T
 * same precedence rules without duplicating them.
 */
 function filterResourcesForMcp(resources, inputs) {
-	const { expose, include, exclude } = inputs;
-	if (expose && include) throw new Error("mcpPlugin: pass either `expose` (preferred) or `include` (legacy alias), not both.");
-	if (expose && exclude) throw new Error("mcpPlugin: `expose` is default-deny — `exclude` is redundant. Drop `exclude` or switch to `include`/`exclude` for default-allow semantics.");
+	const { expose, exclude } = inputs;
+	if (expose && exclude) throw new Error("mcpPlugin: `expose` is default-deny (an allowlist) — `exclude` is redundant alongside it. Use `expose` to name what to surface, OR `exclude` to drop specific resources from the default-allow set. Not both.");
 	const eligible = resources.filter((r) => r.mcp !== false);
-	const allow = expose ?? include;
+	const allow = expose;
 	if (allow) {
 		const allowSet = new Set(allow);
 		return eligible.filter((r) => allowSet.has(r.name));

package/dist/{memory-CmnzXE5Z.mjs → memory-DR6wpa9F.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**

package/dist/{metrics-fdxI5mn_.mjs → metrics-CUdw_wLB.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({

package/dist/middleware/index.d.mts

@@ -1,4 +1,5 @@
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DPRH0Cme.mjs";
+
+import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-CpzxqePp.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {

package/dist/middleware/index.mjs

@@ -1,5 +1,6 @@
-import { t as CRUD_OPERATIONS } from "../constants-DNre0wRg.mjs";
-import { t as multipartBody } from "../multipartBody-D0eBvkeq.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
+import { t as multipartBody } from "../multipartBody-wOgj_fnj.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.d.mts

@@ -1,3 +1,4 @@
+
 import { LockAdapter } from "@classytic/repo-core/lock";
 //#region src/migrations/index.d.ts
 interface Migration {
@@ -229,9 +230,6 @@ declare class MigrationRunner {
    * Get all applied migrations
    */
   getAppliedMigrations(): Promise<MigrationRecord[]>;
-  /**
-   * Get pending migrations
-   */
   getPendingMigrations(migrations: Migration[]): Promise<Migration[]>;
   /**
    * Check if migrations are up to date

package/dist/migrations/index.mjs

@@ -1,4 +1,5 @@
-import { t as startRenewingLease } from "../renewingLease-3cuQH7h8.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-Dll8mGgc.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**
@@ -277,9 +278,6 @@ var MigrationRunner = class {
 	async getAppliedMigrations() {
 		return this.store.getApplied();
 	}
-	/**
-	* Get pending migrations
-	*/
 	async getPendingMigrations(migrations) {
 		const applied = await this.store.getApplied();
 		const appliedVersions = new Set(applied.map((m) => `${m.resource}:${m.version}`));

package/dist/module-0pFJA6YW.mjs

@@ -0,0 +1,78 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+//#region src/factory/module/index.ts
+/**
+* Identity helper for authoring a typed module — mirrors `defineResource`.
+* Gives inference + a single obvious construction site; does no work.
+*
+* `TExports` is inferred from the `bootstrap` return value, so a module
+* author gets a typed public export for free:
+*
+* ```ts
+* export const accountingModule = (deps: Deps) =>
+*   defineModule({
+*     name: "accounting",
+*     bootstrap: async () => createAccountingEngine(deps), // TExports inferred
+*   });
+* ```
+*/
+function defineModule(module) {
+	return module;
+}
+function getModuleExports(fastify, name) {
+	const recorded = readModuleExports(fastify, name);
+	if (recorded === ABSENT) {
+		const available = fastify.arc?.modules ? Object.keys(fastify.arc.modules) : [];
+		throw new Error(`[arc] no public export recorded for module "${name}".\nA module's export is its bootstrap() return value; it is readable only AFTER that module's bootstrap ran (dependsOn / list order = init order).\nModules with recorded exports: ${available.length ? available.join(", ") : "(none)"}.`);
+	}
+	return recorded;
+}
+/**
+* Sentinel for "no entry recorded", distinct from a recorded `undefined`.
+*
+* registerResources never records an `undefined` export, so today the two
+* cannot both happen — but encoding absence as `undefined` would make the
+* optional/required accessors disagree the day that changes, and a required
+* accessor that stops throwing is exactly the silent-null class of bug these
+* helpers exist to remove.
+*/
+const ABSENT = Symbol("arc.module.absent");
+/** The one honest read of the module-export map, shared by every accessor. */
+function readModuleExports(fastify, name) {
+	const modules = fastify.arc?.modules;
+	if (!modules || !Object.hasOwn(modules, name)) return ABSENT;
+	return modules[name];
+}
+function getOptionalModuleExports(fastify, name) {
+	const recorded = readModuleExports(fastify, name);
+	return recorded === ABSENT ? void 0 : recorded;
+}
+/**
+* Is a module's public export recorded yet? The predicate form of
+* `getOptionalModuleExports`, for readiness gates (`ready: () => ...`) that
+* should not have to reason about falsy-but-present exports.
+*/
+function hasModuleExports(fastify, name) {
+	return readModuleExports(fastify, name) !== ABSENT;
+}
+function lazyModuleExports(fastify, name) {
+	let resolved = ABSENT;
+	return () => {
+		if (resolved === ABSENT) resolved = readModuleExports(fastify, name);
+		return resolved === ABSENT ? void 0 : resolved;
+	};
+}
+function lazyRequiredModuleExports(fastify, name) {
+	const states = fastify.arc?.moduleStates;
+	if (states !== void 0 && !Object.hasOwn(states, name)) {
+		const composed = Object.keys(states);
+		throw new Error(`[arc] lazyRequiredModuleExports("${name}"): module "${name}" is not in the composed module graph. A lazily-required module is still a HARD dependency — compose it (and declare it in the consumer's \`dependsOn\`), or use lazyModuleExports() if the integration is genuinely optional.
+Composed modules: ${composed.length ? composed.join(", ") : "(none)"}.`);
+	}
+	let resolved = ABSENT;
+	return () => {
+		if (resolved === ABSENT) resolved = getModuleExports(fastify, name);
+		return resolved;
+	};
+}
+//#endregion
+export { lazyModuleExports as a, hasModuleExports as i, getModuleExports as n, lazyRequiredModuleExports as o, getOptionalModuleExports as r, defineModule as t };

package/dist/{multipartBody-D0eBvkeq.mjs → multipartBody-wOgj_fnj.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/{openapi-BLV4OMXb.mjs → openapi-B2L4js1v.mjs}

@@ -1,8 +1,9 @@
-import { n as getUserRoles } from "./userHelpers-Cg_y3fBz.mjs";
-import { n as convertRouteSchema } from "./schemaConverter-DJvodiHj.mjs";
-import { t as pluralize } from "./pluralize-BhrgwZb9.mjs";
-import { t as resolveActionPermission } from "./actionPermissions-CAphcmUG.mjs";
-import { t as buildActionBodySchema } from "./createActionRouter-C-N7z2EL.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
+import { n as convertRouteSchema } from "./schemaConverter-D--wdJM-.mjs";
+import { t as pluralize } from "./pluralize-O0FZgESl.mjs";
+import { t as resolveActionPermission } from "./actionPermissions-BE5NwaQk.mjs";
+import { t as buildActionBodySchema } from "./createActionRouter-CDXEdasl.mjs";
 import fp from "fastify-plugin";
 //#region src/docs/openapi/canonical-schemas.ts
 /**

package/dist/permissions/index.d.mts

@@ -1,4 +1,5 @@
-import { i as UserBase, n as PermissionContext, o as getUserRoles, r as PermissionResult, s as normalizeRoles, t as PermissionCheck } from "../types-Dmw-6Qeo.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-D3lhgzhD.mjs";
-import { A as allOf, B as applyPermissionResult, C as requireGrant, D as PermissionEventBus, E as DynamicPermissionMatrixConfig, F as requireAuth, G as requireDPoP, H as RequireAgentScopeOptions, I as requireOwnership, K as requireMandate, L as requireRoles, M as anyOf, N as denyAll, O as createDynamicPermissionMatrix, P as not, R as roles, S as modeSatisfies, T as DynamicPermissionMatrix, U as RequireMandateOptions, V as normalizePermissionResult, W as requireAgentScope, _ as createRoleHierarchy, a as permissionMatrix, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, j as allowPublic, k as createOrgPermissions, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, v as GRANT_MODES, w as ConnectEventsOptions, x as RequireGrantOptions, y as GrantMode, z as when } from "../index-BMnbzvtO.mjs";
-export { type ConnectEventsOptions, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionContext, type PermissionEventBus, type PermissionResult, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, modeSatisfies, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+
+import { a as UserBase, c as normalizeRoles, i as PermissionContext, n as DataPolicy, r as PermissionCheck, s as getUserRoles, t as AuthorizationDecision } from "../types-B7XeLEgK.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, r as FieldPermissionType, s as resolveEffectiveRoles, t as FieldPermission } from "../fields-I_EeRWND.mjs";
+import { $ as evaluatePermissionDecision, A as explainAccess, B as anyOf, C as requireGrant, D as collectPublicSurface, E as PermissionRequirement, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as roles, K as requirePlatformRole, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, O as describePermission, P as PermissionEventBus, Q as applyAuthorizationDecision, R as allow, S as modeSatisfies, T as AccessExplanation, U as not, V as deny, W as requireAuth, X as scopeOf, Y as when, Z as PermissionCheckReturn, _ as createRoleHierarchy, a as permissionMatrix, at as requireMandate, b as GrantResolution, c as publicReadAdminWrite, d as requireOrgMembership, et as normalizeToDecision, f as requireOrgRole, g as RoleHierarchy, h as requireTeamMembership, i as ownerWithAdminBypass, it as requireDPoP, j as ConnectEventsOptions, k as describePermissionMap, l as readOnly, m as requireServiceScope, n as authenticated, nt as RequireMandateOptions, o as presets_d_exports, p as requireScopeContext, q as requireRoles, r as fullPublic, rt as requireAgentScope, s as publicRead, t as adminOnly, tt as RequireAgentScopeOptions, u as requireOrgInScope, v as GRANT_MODES, w as conjoinPolicyFilters, x as RequireGrantOptions, y as GrantMode, z as allowPublic } from "../index-CEJNZFtX.mjs";
+export { type AccessExplanation, type AuthorizationDecision, type ConnectEventsOptions, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type FieldPermission, type FieldPermissionMap, type FieldPermissionType, GRANT_MODES, type GrantMode, type GrantResolution, type PermissionCheck, type PermissionCheckReturn, type PermissionContext, type PermissionEventBus, type PermissionRequirement, type RequireAgentScopeOptions, type RequireGrantOptions, type RequireMandateOptions, type RoleHierarchy, type UserBase, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/permissions/index.mjs

@@ -1,4 +1,6 @@
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-Cg_y3fBz.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, o as fields, r as normalizePermissionResult, s as resolveEffectiveRoles, t as applyPermissionResult } from "../applyPermissionResult-BnyVE9eD.mjs";
-import { A as requireAuth, C as requireDPoP, D as anyOf, E as allowPublic, M as requireRoles, N as roles, O as denyAll, P as when, S as requireAgentScope, T as allOf, _ as requireOrgMembership, a as permissionMatrix, b as requireServiceScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as requireOrgInScope, h as createOrgPermissions, i as ownerWithAdminBypass, j as requireOwnership, k as not, l as readOnly, m as createDynamicPermissionMatrix, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as requireOrgRole, w as requireMandate, x as requireTeamMembership, y as requireScopeContext } from "../permissions-BrtiBKGs.mjs";
-export { GRANT_MODES, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, applyPermissionResult, authenticated, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, denyAll, fields, fullPublic, getUserRoles, modeSatisfies, normalizePermissionResult, normalizeRoles, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, when };
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-ChvUQGG1.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CB5Cuzk9.mjs";
+import { A as allow, B as roles, C as requireScopeContext, D as requireDPoP, E as requireAgentScope, F as not, H as scopeOf, I as requireAuth, L as requireOwnership, M as anyOf, N as deny, O as requireMandate, P as denyAll, R as requirePlatformRole, S as requireOrgRole, T as requireTeamMembership, V as when, _ as explainAccess, a as permissionMatrix, b as requireOrgInScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as describePermissionMap, h as describePermission, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, m as collectPublicSurface, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions, z as requireRoles } from "../permissions-L--QDAir.mjs";
+export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };