@classytic/arc 2.28.0 → 2.31.0

package/dist/authorizationDecision-ChvUQGG1.mjs

@@ -0,0 +1,266 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { arcLog } from "./logger/index.mjs";
+import { t as ArcError } from "./errors-Cj42AntO.mjs";
+//#region src/permissions/filter-merge.ts
+/**
+* Policy-filter composition — logical AND, never last-writer-wins.
+*
+* Row-level policy filters can arrive from several INDEPENDENT sources for one
+* request: a tenant preset, an `ownedByUser` grant, an `allOf(...)` branch, a
+* host permission check. Every one of them is a RESTRICTION the row must
+* satisfy, so composing them is logical AND.
+*
+* The historical `{ ...base, ...incoming }` shallow spread did NOT implement AND:
+* when two sources constrained the SAME key with different values, the later one
+* silently REPLACED the earlier one — widening (or erasing) a restriction another
+* layer deliberately imposed. That is a defense-in-depth defect, not a
+* refinement. "Later can refine" is only sound when the refinement is provably
+* narrower, and a bare overwrite proves nothing.
+*
+* {@link conjoinPolicyFilters} composes with AND semantics while preserving the
+* common case byte-for-byte:
+*
+*  - key present on only one side      → carried through flat. Non-overlapping
+*    filters (the ~99% case) produce exactly the same object the old spread did,
+*    so there is ZERO behavior change for them.
+*  - same key, deep-equal value        → kept once (idempotent — e.g. two checks
+*    both pinning the same `organizationId`).
+*  - same key, DIFFERENT value         → BOTH constraints are preserved under an
+*    `$and`, so a row must satisfy both. For flat equality that conjunction is
+*    unsatisfiable, so the query returns nothing — the safe, correct outcome for
+*    contradictory policies (deny), and the earlier restriction is never dropped.
+*
+* Adapter safety: mongokit / sqlitekit compile `$and` natively at the DB layer,
+* and arc's in-memory `simpleEqualityMatcher` (AccessControl.checkPolicyFilters)
+* already fail-closes on operator-shaped filters. So a produced `$and` is either
+* evaluated correctly by the DB or rejected fail-closed in memory — both safe.
+*
+* This is the pragmatic, adapter-neutral form of the AND semantics. A canonical
+* filter IR in `repo-core` (nested and/or/not nodes each adapter compiles) is the
+* fuller design, but this closes the security defect without one.
+*/
+/**
+* Validate + return a `$and` operand's fragment array. A security-policy
+* normalizer must NEVER silently drop a malformed constraint — a non-array
+* `$and` (e.g. `{ $and: { organizationId: "a" } }`) is a policy bug, so fail
+* loud (fail-closed) rather than discard the restriction it was meant to carry.
+*/
+function coercePolicyAnd(value) {
+	if (!Array.isArray(value)) throw new Error(`conjoinPolicyFilters: malformed '$and' — expected an array of filter fragments, got ${value === null ? "null" : typeof value}. A policy filter constraint must not be silently dropped.`);
+	return value;
+}
+/** Are two flat policy-filter values equivalent for conjunction purposes? */
+function filterValueEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (a !== null && b !== null && typeof a === "object" && typeof b === "object") try {
+		return JSON.stringify(a) === JSON.stringify(b);
+	} catch {
+		return false;
+	}
+	return false;
+}
+/**
+* Conjoin two policy-filter maps with AND semantics. Never silently overwrites a
+* same-key constraint with a different value — conflicting keys are preserved
+* under `$and`. See the module doc for the full contract.
+*/
+function conjoinPolicyFilters(base, incoming) {
+	const baseEmpty = !base || Object.keys(base).length === 0;
+	const incomingEmpty = !incoming || Object.keys(incoming).length === 0;
+	if (baseEmpty) return incomingEmpty ? {} : { ...incoming };
+	if (incomingEmpty) return { ...base };
+	const result = {};
+	const andParts = [];
+	const baseAnd = base.$and;
+	if (baseAnd !== void 0) andParts.push(...coercePolicyAnd(baseAnd));
+	for (const [key, value] of Object.entries(base)) {
+		if (key === "$and") continue;
+		result[key] = value;
+	}
+	for (const [key, value] of Object.entries(incoming)) {
+		if (key === "$and") {
+			andParts.push(...coercePolicyAnd(value));
+			continue;
+		}
+		if (!(key in result)) {
+			result[key] = value;
+			continue;
+		}
+		if (filterValueEqual(result[key], value)) continue;
+		andParts.push({ [key]: result[key] }, { [key]: value });
+		delete result[key];
+	}
+	if (andParts.length > 0) result.$and = andParts;
+	return result;
+}
+//#endregion
+//#region src/permissions/authorizationDecision.ts
+const log = arcLog("permissions:enforce");
+/**
+* Normalize a check return into the canonical {@link AuthorizationDecision}.
+* A boolean promotes to `{ effect: "allow" | "deny" }`; a decision passes
+* through. This is the ONE place booleans are promoted, so the rest of the
+* pipeline only ever handles decisions.
+*/
+function normalizeToDecision(result) {
+	if (typeof result === "boolean") return { effect: result ? "allow" : "deny" };
+	/**
+	* A returned object MUST carry an `effect`. Without this guard a foreign shape — the
+	* pre-2.30 `{ granted: true }`, a hand-rolled `{ allowed: true }`, a stray Promise
+	* someone forgot to await — passed through as a decision with no effect and was read
+	* as DENY. A gate that says yes and is silently overruled is the worst available
+	* failure: nine `@classytic/arc-*` test suites went red at once and every symptom
+	* pointed at authentication rather than at the return shape.
+	*
+	* Throwing lands in `failed` (fail-closed, still a denial), so behaviour is unchanged
+	* for anything already correct — but the reason now names itself instead of hiding.
+	*/
+	const effect = result?.effect;
+	if (result === null || typeof result !== "object" || effect !== "allow" && effect !== "deny") throw new Error(`[arc] a permission check returned an unrecognized shape: ${JSON.stringify(result)}. Return a boolean or an AuthorizationDecision ({ effect: 'allow' | 'deny', ... }). The pre-2.30 { granted } shape is no longer accepted — it normalized to a silent deny.`);
+	return result;
+}
+/**
+* Run a permission check once and classify the result. The single source of the
+* try/normalize/catch sequence — see {@link PermissionOutcome}. Non-`ArcError`
+* throws are logged once here through arc's namespaced logger (a deliberate
+* `ArcError` denial is expected control-flow, not a warning). Pure w.r.t. the
+* request — neither reads a reply nor mutates the request.
+*/
+async function evaluatePermissionOutcome(check, context) {
+	try {
+		return {
+			status: "decided",
+			decision: normalizeToDecision(await check(context))
+		};
+	} catch (err) {
+		if (err instanceof ArcError) return {
+			status: "structured",
+			error: err
+		};
+		log.warn({
+			err,
+			resource: context.resource,
+			action: context.action
+		}, "Permission check threw — denying (fail-closed)");
+		return {
+			status: "failed",
+			error: err
+		};
+	}
+}
+/**
+* Run a permission check and return a canonical {@link AuthorizationDecision} —
+* the transport-neutral PDP (HTTP, aggregation, MCP, and any future transport).
+* A thin mapper over {@link evaluatePermissionOutcome}:
+*
+*   - a structured `ArcError` is RE-THROWN so the transport surfaces it verbatim
+*     (e.g. a tier gate throwing `arc.tier_required` with machine-readable meta);
+*   - any OTHER throw is fail-closed to a `deny` decision (a broken check must
+*     never fall open to a 500 that skips authorization).
+*
+* Pure w.r.t. the request — it neither reads a reply nor mutates the request.
+* Callers translate the returned decision into their own response mechanism and
+* apply side-effects via {@link applyAuthorizationDecision}. HTTP additionally
+* hardens a *thrown* check to 403-even-when-anonymous — that transport-specific
+* nuance lives in {@link evaluateAndApplyPermission}, not here.
+*/
+async function evaluatePermissionDecision(check, context) {
+	const outcome = await evaluatePermissionOutcome(check, context);
+	switch (outcome.status) {
+		case "decided": return outcome.decision;
+		case "structured": throw outcome.error;
+		case "failed": return { effect: "deny" };
+	}
+}
+/**
+* Apply an allowed {@link AuthorizationDecision} to a Fastify request — conjoins
+* the decision's row-level `policy` into `_policyFilters` and conditionally
+* installs the `scope`.
+*
+* **Scope install rule:** only writes `scope` when the current request scope
+* is absent or `public`. This prevents downgrading an already-authenticated
+* request (e.g. Better Auth set `member`, then a permission check returns a
+* narrower `service` scope — the original `member` wins because it came from
+* a more authoritative source).
+*
+* Safe to call with a denied decision — it simply no-ops. Callers should still
+* check `decision.effect` and send an error response before reaching here, but
+* this function tolerates the misuse defensively.
+*
+* This is the enforcement point (PEP) — the ONE place scope + data policy are
+* installed (and the obligation seam lives).
+*/
+function applyAuthorizationDecision(decision, request) {
+	if (decision.effect !== "allow") return;
+	if (decision.policy) request._policyFilters = conjoinPolicyFilters(request._policyFilters, decision.policy);
+	if (decision.scope) {
+		const current = request.scope;
+		if (!current || current.kind === "public") request.scope = decision.scope;
+	}
+}
+/**
+* Max length of a decision `reason` string before we fall back to the
+* generic default message. Upstream checks can return arbitrary strings; we
+* clamp to prevent accidental leakage of internal diagnostics or oversized
+* payloads via the 4xx response body.
+*/
+const MAX_DENIAL_REASON_LENGTH = 100;
+/**
+* End-to-end HTTP PEP: evaluates the check through the shared
+* {@link evaluatePermissionOutcome} core, sends a 401/403 response on denial,
+* and applies side-effects on grant. Returns `true` if the caller should
+* continue, `false` if a response has been sent and the caller should return.
+*
+* The HTTP specialization of the ONE evaluation core — it does NOT re-run or
+* re-normalize the check; it only maps the classified outcome onto Fastify:
+*
+*   - `structured` (thrown `ArcError`) → surface verbatim, byte-compatible with
+*     the global error handler (`code`/`message`/`status` + `meta`);
+*   - `failed` (other throw) → 403 EVEN WHEN ANONYMOUS (a broken check is a hard
+*     denial, not a "please authenticate");
+*   - `decided` → allow, or a returned deny → 401 (no user) / 403 (user) with a
+*     clamped `reason`.
+*
+* Context construction, pre-check auth gating, and success-path handler
+* invocation stay at the callsite — those are genuinely different per router
+* and don't belong here.
+*
+* @returns `true` if authorized (caller continues), `false` if a response was sent
+*/
+async function evaluateAndApplyPermission(check, context, request, reply, opts) {
+	const outcome = await evaluatePermissionOutcome(check, context);
+	if (outcome.status === "structured") {
+		const err = outcome.error;
+		reply.code(err.status).send({
+			code: err.code,
+			message: err.message,
+			status: err.status,
+			...err.meta ? { meta: err.meta } : {}
+		});
+		return false;
+	}
+	if (outcome.status === "failed") {
+		reply.code(403).send({
+			code: "arc.forbidden",
+			message: "Permission denied",
+			status: 403
+		});
+		return false;
+	}
+	const { decision } = outcome;
+	if (decision.effect !== "allow") {
+		const defaultMsg = opts?.defaultDenialMessage?.(context.user) ?? (context.user ? "Permission denied" : "Authentication required");
+		const reason = decision.reason && decision.reason.length <= MAX_DENIAL_REASON_LENGTH ? decision.reason : defaultMsg;
+		const status = context.user ? 403 : 401;
+		reply.code(status).send({
+			code: context.user ? "arc.forbidden" : "arc.unauthorized",
+			message: reason,
+			status
+		});
+		return false;
+	}
+	applyAuthorizationDecision(decision, request);
+	return true;
+}
+//#endregion
+export { conjoinPolicyFilters as a, normalizeToDecision as i, evaluateAndApplyPermission as n, evaluatePermissionDecision as r, applyAuthorizationDecision as t };

package/dist/{buildHandler-Dtwd8fdz.mjs → buildHandler-CDrCJzmB.mjs}

@@ -1,4 +1,7 @@
-import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-Bk44F2yT.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters } from "./authorizationDecision-ChvUQGG1.mjs";
+import { t as toRepositoryFilter } from "./repositoryFilter-f9eAfq_l.mjs";
+import { i as compileAggRequest, t as adapterSupportsAggregate } from "./validate-_KbifpHF.mjs";
 //#region src/core/aggregation/buildHandler.ts
 /**
 * Framework-agnostic aggregation execution. Runs safety guards,
@@ -18,13 +21,13 @@ async function executeAggregation(normalized, deps, ctx) {
 	const { repo } = deps;
 	const config = normalized.base;
 	const aggregationName = normalized.name;
-	const { query, tenantOptions } = ctx;
+	const { query, tenantOptions, policyFilter } = ctx;
 	const guardError = checkRequestGuards(query, config);
 	if (guardError) return {
 		status: 400,
 		body: guardError
 	};
-	const aggReq = compileAggRequest(normalized, extractCallerFilter(query), tenantOptions, query);
+	const aggReq = compileAggRequest(normalized, conjoinPolicyFilters(extractCallerFilter(query), policyFilter), tenantOptions, query);
 	if (config.materialized) {
 		const matCtx = {
 			filter: aggReq.filter,
@@ -51,9 +54,13 @@ async function executeAggregation(normalized, deps, ctx) {
 			}
 		}
 	};
+	const aggReqForRepo = aggReq.filter && typeof aggReq.filter === "object" ? {
+		...aggReq,
+		filter: toRepositoryFilter(aggReq.filter)
+	} : aggReq;
 	let result;
 	try {
-		result = await repo.aggregate(aggReq, tenantOptions);
+		result = await repo.aggregate(aggReqForRepo, tenantOptions);
 	} catch (err) {
 		return mapAggregateError(err, aggregationName);
 	}
@@ -95,9 +102,13 @@ async function executeAggregation(normalized, deps, ctx) {
 function buildAggregationHandler(normalized, deps) {
 	const { buildOptions } = deps;
 	return async (request, reply) => {
+		const query = request.query ?? {};
+		const tenantOptions = buildOptions(request);
+		const policyFilter = request._policyFilters;
 		const result = await executeAggregation(normalized, deps, {
-			query: request.query ?? {},
-			tenantOptions: buildOptions(request)
+			query,
+			tenantOptions,
+			policyFilter
 		});
 		reply.status(result.status);
 		if (result.headers) for (const [k, v] of Object.entries(result.headers)) reply.header(k, v);
@@ -199,6 +210,20 @@ const SHORTHAND_RANGE_OPS = /* @__PURE__ */ new Set([
 	"lt",
 	"lte"
 ]);
+/**
+* Operators whose operand MUST be a list. A URL carries `priority[in]=high,urgent`
+* as ONE string, and `$in` against a non-array is invalid — MongoDB rejects it,
+* and the portable Filter IR would spread the string into characters. Split it
+* the same way `ArcQueryParser` does for the CRUD list route, which is the
+* contract this expansion claims to match.
+*/
+const SHORTHAND_LIST_OPS = /* @__PURE__ */ new Set(["in", "nin"]);
+/** Normalize a list-operator operand to an array (URL string → split on commas). */
+function toOperandList(value) {
+	if (Array.isArray(value)) return value;
+	if (typeof value === "string") return value.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
+	return [value];
+}
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
 function tryCoerceDate(v) {
 	if (typeof v !== "string" || !ISO_DATE_RE.test(v)) return v;
@@ -222,7 +247,9 @@ function expandShorthandOperators(value) {
 	for (const [op, opVal] of Object.entries(nested)) {
 		const mongoOp = OPERATOR_SHORTHAND[op];
 		if (!mongoOp) continue;
-		expanded[mongoOp] = SHORTHAND_RANGE_OPS.has(op) ? tryCoerceDate(opVal) : opVal;
+		if (SHORTHAND_RANGE_OPS.has(op)) expanded[mongoOp] = tryCoerceDate(opVal);
+		else if (SHORTHAND_LIST_OPS.has(op)) expanded[mongoOp] = toOperandList(opVal);
+		else expanded[mongoOp] = opVal;
 	}
 	return expanded;
 }

package/dist/cache/index.d.mts

@@ -1,6 +1,7 @@
-import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BGZCzOGL.mjs";
-import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DOMT_iq7.mjs";
-import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-br4otiqF.mjs";
+
+import { n as CacheStats, r as CacheStore, t as CacheLogger } from "../interface-BOk3YnTz.mjs";
+import { a as QueryCacheConfig, i as QueryCache, n as CacheResult, r as CacheStatus, t as CacheEnvelope } from "../QueryCache-DFA-QrU9.mjs";
+import { i as queryCachePlugin, n as QueryCacheDefaults, r as QueryCachePluginOptions, t as CrossResourceRule } from "../queryCachePlugin-BzqxconG.mjs";
 //#region src/cache/keys.d.ts
 /**
  * Cache Key Utilities

package/dist/cache/index.mjs

@@ -1,6 +1,7 @@
-import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-Cd316u_y.mjs";
-import { t as MemoryCacheStore } from "../memory-CmnzXE5Z.mjs";
-import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-DSGuSVLW.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { i as versionKey, n as hashParams, r as tagVersionKey, t as buildQueryKey } from "../keys-C0_pa1tY.mjs";
+import { t as MemoryCacheStore } from "../memory-DR6wpa9F.mjs";
+import { r as QueryCache, t as queryCachePlugin } from "../queryCachePlugin-BZr8v46E.mjs";
 //#region src/cache/redis.ts
 /**
 * Redis-backed cache store.

package/dist/{caching-_NJeDd1_.mjs → caching-BFHA6Scf.mjs}

@@ -1,4 +1,5 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/caching.ts
 var caching_exports = /* @__PURE__ */ __exportAll({

package/dist/cleanup/index.d.mts

@@ -1,6 +1,7 @@
-import { L as RequestWithExtras } from "../index-DPRH0Cme.mjs";
-import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C_ZZRcD6.mjs";
-import { t as ArcModule } from "../types-Cu6vVJmh.mjs";
+
+import { L as RequestWithExtras } from "../index-CpzxqePp.mjs";
+import { A as CleanupWriteFence, C as CleanupResult, D as CleanupRunStore, E as CleanupRunStatus, F as PurgeStrategyKind, I as PurgeVerificationSummary, L as VerificationCheck, M as PurgeActor, N as PurgeEvidence, O as CleanupRunTransitionPatch, P as PurgeResourceResult, R as VerificationResult, S as CleanupRecipe, T as CleanupRunCreateResult, _ as CleanupPermissions, a as CleanupEvidenceStore, b as CleanupPlanItem, c as CleanupInput, d as CleanupLease, f as CleanupLimits, g as CleanupPermissionCheck, h as CleanupOutcomeStatus, i as CleanupContext, j as DEFAULT_CLEANUP_LIMITS, k as CleanupStepResult, l as CleanupJob, m as CleanupManifest, n as CLEANUP_TERMINAL_STATUSES, o as CleanupExecutionContext, p as CleanupLogger, r as CleanupCancelRequest, s as CleanupFinalizationPayload, t as Availability, u as CleanupJobQueue, v as CleanupPlan, w as CleanupRun, x as CleanupProgressSummary, y as CleanupPlanDraft } from "../types-C4QE8qnm.mjs";
+import { t as ArcModule } from "../types-CBgvkp8O.mjs";
 import { PurgeStrategyKind as PurgeStrategyKind$1 } from "@classytic/primitives/retention";
 import { canonicalJson } from "@classytic/primitives/canonical";
 import { CleanupStep } from "@classytic/repo-core/cleanup";

package/dist/cleanup/index.mjs

@@ -1,6 +1,7 @@
-import { g as getUserId } from "../types-CSyCxl2V.mjs";
-import { t as defineResource } from "../defineResource-2zvVVpxg.mjs";
-import { t as defineModule } from "../module-_-M7C5ES.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { g as getUserId } from "../types-Cys0ko9Z.mjs";
+import { t as defineResource } from "../defineResource-Bv6EtN1x.mjs";
+import { t as defineModule } from "../module-0pFJA6YW.mjs";
 import { createPurgeEvidence } from "@classytic/primitives/retention";
 import { canonicalJson, sha256Hex } from "@classytic/primitives/canonical";
 //#region src/cleanup/errors.ts
@@ -1175,8 +1176,7 @@ function createDataCleanupModule(deps) {
 				path: "/recipes",
 				summary: "List available cleanup recipes",
 				permissions: view,
-				raw: true,
-				handler: async (_req, reply) => {
+				rawHandler: async (_req, reply) => {
 					return reply.send({ recipes: registry.introspect() });
 				}
 			},
@@ -1185,9 +1185,8 @@ function createDataCleanupModule(deps) {
 				path: "/preview",
 				summary: "Preview a cleanup plan (no mutation)",
 				permissions: view,
-				raw: true,
 				schema: { body: previewBodySchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
 					const plan = await service.preview({
@@ -1204,9 +1203,8 @@ function createDataCleanupModule(deps) {
 				path: "/runs",
 				summary: "Execute a confirmed cleanup plan",
 				permissions: execute,
-				raw: true,
 				schema: { body: runsBodySchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const r = req;
 					const body = req.body;
 					const run = await service.execute({
@@ -1226,9 +1224,8 @@ function createDataCleanupModule(deps) {
 				path: "/runs/:id",
 				summary: "Observe a cleanup run",
 				permissions: view,
-				raw: true,
 				schema: { params: runIdParamsSchema },
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const { id } = req.params;
 					return reply.send(await service.getRun(id));
 				}
@@ -1238,12 +1235,11 @@ function createDataCleanupModule(deps) {
 				path: "/runs/:id/action",
 				summary: "Cancel or retry a cleanup run",
 				permissions: manage,
-				raw: true,
 				schema: {
 					params: runIdParamsSchema,
 					body: actionBodySchema
 				},
-				handler: async (req, reply) => {
+				rawHandler: async (req, reply) => {
 					const actionActor = resolveActor(req);
 					const { id } = req.params;
 					const { action, reason } = req.body;

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,5 @@
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DPRH0Cme.mjs";
+
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-CpzxqePp.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/describe.mjs

@@ -1,5 +1,6 @@
-import { t as CRUD_OPERATIONS } from "../../constants-DNre0wRg.mjs";
-import { n as stringifyMeasureMap } from "../../ResourceRegistry-y9Hnypus.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../../constants-D3Dv4LAV.mjs";
+import { n as stringifyMeasureMap } from "../../ResourceRegistry-qq0mn2s9.mjs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/cli/commands/describe.ts

package/dist/cli/commands/docs.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/docs.d.ts
 /**
  * Arc CLI - Docs Command

package/dist/cli/commands/docs.mjs

@@ -1,5 +1,6 @@
-import { t as buildOpenApiSpec } from "../../openapi-BLV4OMXb.mjs";
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as buildOpenApiSpec } from "../../openapi-B2L4js1v.mjs";
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/commands/docs.ts

package/dist/cli/commands/doctor.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/doctor.d.ts
 /**
  * Arc CLI - Doctor Command

package/dist/cli/commands/doctor.mjs

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { dirname, join, parse, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/cli/commands/doctor.ts

package/dist/cli/commands/generate.d.mts

@@ -1,2 +1,3 @@
-import { n as generate, t as ArcProjectConfig } from "../../generate-BnsL9GBm.mjs";
+
+import { n as generate, t as ArcProjectConfig } from "../../generate-DCGuEbqI.mjs";
 export { type ArcProjectConfig, generate };

package/dist/cli/commands/generate.mjs

@@ -1,2 +1,3 @@
-import { t as generate } from "../../generate-D0wZupBg.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as generate } from "../../generate-EcA6ui4i.mjs";
 export { generate };

package/dist/cli/commands/init.d.mts

@@ -1,2 +1,3 @@
-import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-BPEu8cs-.mjs";
+
+import { a as ProjectConfig, i as PackageManager, n as DependencyManifest, r as InitOptions, t as init } from "../../init-Cscs4lab.mjs";
 export { type DependencyManifest, type InitOptions, type PackageManager, type ProjectConfig, init };

package/dist/cli/commands/init.mjs

@@ -1,2 +1,3 @@
-import { t as init } from "../../init-tlRSt667.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as init } from "../../init-BEiNZBsJ.mjs";
 export { init };

package/dist/cli/commands/introspect.d.mts

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/introspect.d.ts
 /**
  * Arc CLI - Introspect Command

package/dist/cli/commands/introspect.mjs

@@ -1,4 +1,5 @@
-import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-BAjYZonx.mjs";
 //#region src/cli/commands/introspect.ts
 function describePermission(value) {
 	if (!value) return "none";

package/dist/cli/index.d.mts

@@ -1,7 +1,8 @@
+
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { n as generate } from "../generate-BnsL9GBm.mjs";
-import { t as init } from "../init-BPEu8cs-.mjs";
+import { n as generate } from "../generate-DCGuEbqI.mjs";
+import { t as init } from "../init-Cscs4lab.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/cli/index.mjs

@@ -1,7 +1,8 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-D0wZupBg.mjs";
-import { t as init } from "../init-tlRSt667.mjs";
+import { t as generate } from "../generate-EcA6ui4i.mjs";
+import { t as init } from "../init-BEiNZBsJ.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/{constants-DNre0wRg.mjs → constants-D3Dv4LAV.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
 //#region src/constants.ts
 /**
 * Arc Framework Constants — Single Source of Truth

package/dist/context/index.d.mts

@@ -1,3 +1,4 @@
+
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.d.ts
 /**

package/dist/context/index.mjs

@@ -1,3 +1,4 @@
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-MrlJwECf.mjs";
-import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
+/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-2TxXOJ7T.mjs";
+import { t as transactionContext } from "../transactionContext-dAfBVUrk.mjs";
 export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.d.mts

@@ -1,3 +1,4 @@
-import { $t as SlugExt, An as ControllerConfigurableOptions, B as defineResource, Jt as BaseController, Mn as ListResult, Nn as BodySanitizer, Pn as BodySanitizerConfig, Qt as TreeMixin, V as ResourceDefinition, Xt as SoftDeleteMixin, Yt as SoftDeleteExt, Zt as TreeExt, an as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugMixin, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as QueryResolver, jn as ControllerConstructionOptions, kn as BaseControllerOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkMixin, on as AccessControl, pt as AggregationMaterializedContext, rn as BaseCrudController, sn as AccessControlConfig, st as AggMeasureInput, tn as BulkExt, ut as AggregationConfig } from "../index-DPRH0Cme.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-CjVg-Epg.mjs";
+
+import { $t as TreeMixin, An as BaseControllerOptions, B as defineResource, Fn as BodySanitizerConfig, Mn as ControllerConstructionOptions, Nn as ListResult, Pn as BodySanitizer, Qt as TreeExt, V as ResourceDefinition, Xt as SoftDeleteExt, Yt as BaseController, Zt as SoftDeleteMixin, an as QueryResolver, cn as AccessControlConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugExt, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as BaseCrudController, jn as ControllerConfigurableOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkExt, on as QueryResolverConfig, pt as AggregationMaterializedContext, rn as BulkMixin, sn as AccessControl, st as AggMeasureInput, tn as SlugMixin, ut as AggregationConfig } from "../index-CpzxqePp.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-Bc2ox8_U.mjs";
 export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };