@classytic/arc 2.30.0 → 2.32.0

package/dist/{index-Ch16aAah.d.mts → index-zq6VrjaB.d.mts}

@@ -1,6 +1,7 @@
-import { r as CacheStore, t as CacheLogger } from "./interface-BGZCzOGL.mjs";
-import { i as RequestScope, n as Mandate } from "./types-DjC-KUCz.mjs";
-import { i as PermissionContext, r as PermissionCheck, t as AuthorizationDecision } from "./types-ChvvVNP8.mjs";
+
+import { r as CacheStore, t as CacheLogger } from "./interface-BOk3YnTz.mjs";
+import { i as RequestScope, n as Mandate } from "./types-ChuShpCP.mjs";
+import { i as PermissionContext, r as PermissionCheck, t as AuthorizationDecision } from "./types-B7XeLEgK.mjs";
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/permissions/agent.d.ts
 /**
@@ -162,7 +163,7 @@ interface RequireAgentScopeOptions<TDoc = Record<string, unknown>> extends Requi
  */
 declare function requireAgentScope<TDoc = Record<string, unknown>>(opts: RequireAgentScopeOptions<TDoc>): PermissionCheck<TDoc>;
 //#endregion
-//#region src/permissions/applyPermissionResult.d.ts
+//#region src/permissions/authorizationDecision.d.ts
 /**
  * A permission check returns either a bare boolean (terse allow/deny sugar) or
  * a full {@link AuthorizationDecision}. There is no legacy `PermissionResult` —
@@ -222,12 +223,6 @@ type RequestSink = FastifyRequest & {
  * installed (and the obligation seam lives).
  */
 declare function applyAuthorizationDecision(decision: AuthorizationDecision, request: RequestSink): void;
-/**
- * @deprecated Renamed to {@link applyAuthorizationDecision} — the contract is an
- * `AuthorizationDecision`, not a `PermissionResult`. This alias is kept for
- * back-compat and will be removed in a future major.
- */
-declare const applyPermissionResult: typeof applyAuthorizationDecision;
 //#endregion
 //#region src/permissions/context.d.ts
 /**
@@ -307,6 +302,24 @@ declare function requireRoles(roles: readonly string[], options?: {
    */
   includeOrgRoles?: boolean;
 }): PermissionCheck;
+/**
+ * Require a PLATFORM role — global roles only. An organization role can never
+ * satisfy this gate.
+ *
+ * `requireRoles(["ops"])` also accepts an ORG role named `ops` (that is its
+ * documented default), and `requireOrgRole("manager")` grants ANY organization's
+ * manager. Both return a bare allow with no policy, so a surface that is global
+ * by construction — a queue dashboard, a cluster-wide operations endpoint —
+ * cannot distinguish them from a real operator gate by looking at the decision.
+ * That makes "platform-only" a property the check has to DECLARE, which is what
+ * `_platformOnly` records and what such a surface can then require.
+ *
+ * Elevated scope passes: platform admin is the identity this gate is for.
+ *
+ * @example
+ * permissions: { list: requirePlatformRole("platform-ops") }
+ */
+declare function requirePlatformRole(...args: string[] | [readonly string[]]): PermissionCheck;
 /**
  * Short-form alias of `requireRoles()`. Identical behavior — checks both
  * platform roles AND org roles. Prefer `requireRoles` for new code; this
@@ -522,22 +535,45 @@ declare function createDynamicPermissionMatrix(config: DynamicPermissionMatrixCo
  * - `public` — `allowPublic()`; anyone passes.
  * - `roles` — grants if the caller holds ANY of these (platform OR org roles,
  *   unioned — matches how `requireRoles`/`requireOrgRole`/`anyOf` compose).
+ * - `scoped` — grants only within a caller SCOPE dimension (`_scopeContext`,
+ *   e.g. `{ branchRole: "head_office" }`), optionally combined with `roles`. The
+ *   scope dimensions are known statically even though their per-request VALUES
+ *   aren't, so a consumer that holds the caller's scope (a FE that knows the
+ *   active branch's role) can decide it client-side — the piece a flat `roles`
+ *   requirement could not express.
  * - `authenticated` — the check reads request-time facts (custom auth, service
- *   scope, ownership, scope-context, grants) that no static analysis can decide;
- *   the definitive answer is computed per request. Treat as "server decides".
+ *   scope, ownership, grants) that no static analysis can decide; the definitive
+ *   answer is computed per request. Treat as "server decides".
  */
 type PermissionRequirement = {
   readonly kind: "public";
 } | {
   readonly kind: "roles";
   readonly roles: readonly string[];
+  /**
+   * `true` when these roles are NECESSARY but not SUFFICIENT — the gate is an
+   * `allOf(...)` that also carries an opaque runtime branch (ownership /
+   * custom / dynamic / flow-mode …). A role MATCH is then `conditional`, not a
+   * definitive `allow`; a MISMATCH is still a definitive `deny`.
+   */
+  readonly conditional?: boolean;
+} | {
+  readonly kind: "scoped";
+  /** Required scope dimensions: `value` string = must equal; `undefined` = must be present. */
+  readonly scope: Readonly<Record<string, string | undefined>>;
+  /** Roles ALSO required alongside the scope (union of platform + org roles), if any. */
+  readonly roles?: readonly string[];
+  /** See `roles.conditional` — the composite also has an opaque/contradictory branch. */
+  readonly conditional?: boolean;
 } | {
   readonly kind: "authenticated";
 };
 /**
  * Extract a check's static requirement from its `PermissionCheckMeta`. Public
- * wins; then the union of platform + org roles a role gate declares; otherwise
- * "authenticated" (auth-required / custom / request-time checks).
+ * wins; then a scope-context gate (optionally with roles); then the union of
+ * platform + org roles a role gate declares; otherwise "authenticated"
+ * (auth-required / custom / request-time checks). An `allOf` that couldn't be
+ * fully captured statically carries `conditional: true` (see `_conditional`).
  */
 declare function describePermission(check: PermissionCheck): PermissionRequirement;
 /** Result of {@link explainAccess}. */
@@ -566,6 +602,8 @@ interface AccessExplanation {
 declare function explainAccess(check: PermissionCheck, principal?: {
   roles?: readonly string[];
   orgRoles?: readonly string[];
+  /** The caller's scope-context values (e.g. `{ branchRole: "head_office" }`) — supply to decide a `scoped` gate. */
+  scope?: Readonly<Record<string, string | undefined>>;
 }): AccessExplanation;
 /**
  * Introspect a whole permission map (`{ list, get, create, ... }` or any
@@ -952,4 +990,73 @@ declare function fullPublic<TDoc = Record<string, unknown>>(overrides?: Permissi
  */
 declare function readOnly<TDoc = Record<string, unknown>>(overrides?: PermissionOverrides<TDoc>): ResourcePermissions<TDoc>;
 //#endregion
-export { evaluatePermissionDecision as $, explainAccess as A, anyOf as B, requireGrant as C, collectPublicSurface as D, PermissionRequirement as E, createDynamicPermissionMatrix as F, requireOwnership as G, denyAll as H, createOrgPermissions as I, when as J, requireRoles as K, allOf as L, DynamicPermissionMatrix as M, DynamicPermissionMatrixConfig as N, describePermission as O, PermissionEventBus as P, applyPermissionResult as Q, allow as R, modeSatisfies as S, AccessExplanation as T, not as U, deny as V, requireAuth as W, PermissionCheckReturn as X, scopeOf as Y, applyAuthorizationDecision as Z, createRoleHierarchy as _, permissionMatrix as a, requireMandate as at, GrantResolution as b, publicReadAdminWrite as c, requireOrgMembership as d, normalizeToDecision as et, requireOrgRole as f, RoleHierarchy as g, requireTeamMembership as h, ownerWithAdminBypass as i, requireDPoP as it, ConnectEventsOptions as j, describePermissionMap as k, readOnly as l, requireServiceScope as m, authenticated as n, RequireMandateOptions as nt, presets_d_exports as o, requireScopeContext as p, roles as q, fullPublic as r, requireAgentScope as rt, publicRead as s, adminOnly as t, RequireAgentScopeOptions as tt, requireOrgInScope as u, GRANT_MODES as v, conjoinPolicyFilters as w, RequireGrantOptions as x, GrantMode as y, allowPublic as z };
+//#region src/permissions/matrix.d.ts
+type PermissionEntryType = "public" | "authenticated" | "roles" | "scoped";
+interface PermissionEntry {
+  type: PermissionEntryType;
+  roles: string[];
+  /**
+   * Present only for `scoped` — the caller-scope dimensions the gate requires
+   * (e.g. `{ branchRole: "head_office" }`), for the client to resolve against
+   * the viewer's active context.
+   */
+  scope?: Record<string, unknown>;
+}
+/**
+ * The slice of arc's `ResourceRegistry` this reads.
+ *
+ * Structural on purpose: coupling to the full registry type would drag the
+ * resource layer into the permissions layer, and this only ever reads names
+ * and gates.
+ */
+interface PermissionMatrixRegistry {
+  getAll(): ReadonlyArray<{
+    name: string;
+    permissions?: Record<string, unknown>;
+    actions?: ReadonlyArray<{
+      name: string;
+      permissions?: unknown;
+    }>;
+    aggregations?: ReadonlyArray<{
+      name: string;
+      permissions?: unknown;
+    }>;
+  }>;
+}
+interface PermissionMatrixOptions {
+  /** The live registry. Omit and the matrix carries only curated modules. */
+  registry?: PermissionMatrixRegistry;
+  /**
+   * Curated, human-named groupings the client already organises around
+   * (`products`, `finance`, …). Overlaid FIRST — the live registry wins on an
+   * exact name collision, because the enforced gate beats an approximation.
+   */
+  curatedModules?: Record<string, unknown>;
+  /**
+   * Second curated layer, applied only where `curatedModules` has no entry —
+   * typically per-resource policies behind the domain groupings.
+   */
+  fallbackModules?: Record<string, unknown>;
+  /** Platform-level role names. */
+  platformRoles?: readonly string[];
+  /** Organization/branch-level role names. */
+  orgRoles?: readonly string[];
+}
+interface PermissionMatrix {
+  /** Every role name, both namespaces — so a role picker has one source. */
+  roles: string[];
+  roleGroups: {
+    platform: string[];
+    branch: string[];
+  };
+  modules: Record<string, Record<string, PermissionEntry>>;
+}
+/** Re-shape arc's typed requirement into the wire entry. */
+declare function introspectCheck(check: PermissionCheck): PermissionEntry;
+/** Introspect a permission module, flattening nested groups to `a.b`. */
+declare function introspectModule(mod: Record<string, unknown>): Record<string, PermissionEntry>;
+/** Every live resource's ACTUAL gates, keyed by arc resource name. */
+declare function introspectRegistry(registry: PermissionMatrixRegistry): Record<string, Record<string, PermissionEntry>>;
+declare function buildPermissionMatrix(options?: PermissionMatrixOptions): PermissionMatrix;
+//#endregion
+export { requireAuth as $, RequireGrantOptions as A, ConnectEventsOptions as B, requireServiceScope as C, GRANT_MODES as D, createRoleHierarchy as E, PermissionRequirement as F, createOrgPermissions as G, DynamicPermissionMatrixConfig as H, collectPublicSurface as I, allowPublic as J, allOf as K, describePermission as L, requireGrant as M, conjoinPolicyFilters as N, GrantMode as O, AccessExplanation as P, not as Q, describePermissionMap as R, requireScopeContext as S, RoleHierarchy as T, PermissionEventBus as U, DynamicPermissionMatrix as V, createDynamicPermissionMatrix as W, deny as X, anyOf as Y, denyAll as Z, publicReadAdminWrite as _, PermissionMatrixRegistry as a, scopeOf as at, requireOrgMembership as b, introspectModule as c, evaluatePermissionDecision as ct, authenticated as d, RequireMandateOptions as dt, requireOwnership as et, fullPublic as f, requireAgentScope as ft, publicRead as g, presets_d_exports as h, PermissionMatrixOptions as i, when as it, modeSatisfies as j, GrantResolution as k, introspectRegistry as l, normalizeToDecision as lt, permissionMatrix as m, requireMandate as mt, PermissionEntryType as n, requireRoles as nt, buildPermissionMatrix as o, PermissionCheckReturn as ot, ownerWithAdminBypass as p, requireDPoP as pt, allow as q, PermissionMatrix as r, roles as rt, introspectCheck as s, applyAuthorizationDecision as st, PermissionEntry as t, requirePlatformRole as tt, adminOnly as u, RequireAgentScopeOptions as ut, readOnly as v, requireTeamMembership as w, requireOrgRole as x, requireOrgInScope as y, explainAccess as z };

package/dist/index.d.mts

@@ -1,11 +1,12 @@
-import { $t as SlugExt, A as RequestIdOptions, An as ControllerConfigurableOptions, B as defineResource, Bt as RouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcListResult, E as GracefulShutdownOptions, En as ArcGetResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, Jt as BaseController, L as RequestWithExtras, Lt as IController, Mn as ListResult, N as FastifyRequestExtras, Nt as RateLimitConfig, O as HealthOptions, On as ArcUpdateResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeMixin, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcDeleteResult, U as ResourceConfig, Ut as AuthPluginOptions, V as ResourceDefinition, X as CrudRouteKey, Xt as SoftDeleteMixin, Y as PresetResult, Yt as SoftDeleteExt, Z as CrudSchemas, Zt as TreeExt, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugMixin, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, jn as ControllerConstructionOptions, k as IntrospectionPluginOptions, kn as BaseControllerOptions, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkMixin, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BaseCrudController, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as BulkExt, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, wn as ArcCreateResult, y as OwnershipCheck, zt as IRequestContext } from "./index-Q5gzEIWY.mjs";
-import { a as UserBase, d as JWTPayload, i as PermissionContext, l as AnyRecord, m as UserOrganization, n as DataPolicy, r as PermissionCheck, t as AuthorizationDecision, u as ArcRequest } from "./types-ChvvVNP8.mjs";
-import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-D3lhgzhD.mjs";
-import "./fastify-augmentation-0WhPnUH7.mjs";
-import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-Cx7bro4R.mjs";
-import { B as anyOf, F as createDynamicPermissionMatrix, G as requireOwnership, H as denyAll, I as createOrgPermissions, J as when, K as requireRoles, L as allOf, M as DynamicPermissionMatrix, N as DynamicPermissionMatrixConfig, W as requireAuth, c as publicReadAdminWrite, d as requireOrgMembership, f as requireOrgRole, h as requireTeamMembership, i as ownerWithAdminBypass, l as readOnly, m as requireServiceScope, n as authenticated, o as presets_d_exports, p as requireScopeContext, r as fullPublic, s as publicRead, t as adminOnly, u as requireOrgInScope, z as allowPublic } from "./index-Ch16aAah.mjs";
-import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-DHcHVAgk.mjs";
+
+import { $t as TreeMixin, A as RequestIdOptions, An as BaseControllerOptions, B as defineResource, Bt as RawRouteHandler, C as RequestContext, D as HealthCheck, Dn as ArcGetResult, E as GracefulShutdownOptions, En as ArcDeleteResult, F as FastifyWithDecorators, Ft as ControllerLike, H as CrudController, L as RequestWithExtras, Lt as IController, Mn as ControllerConstructionOptions, N as FastifyRequestExtras, Nn as ListResult, Nt as RateLimitConfig, O as HealthOptions, On as ArcListResult, P as FastifyWithAuth, Q as MiddlewareConfig, Qt as TreeExt, Rt as IControllerResponse, S as QueryParserInterface, T as CrudRouterOptions, Tn as ArcCreateResult, U as ResourceConfig, V as ResourceDefinition, Vt as RouteHandler, Wt as AuthPluginOptions, X as CrudRouteKey, Xt as SoftDeleteExt, Y as PresetResult, Yt as BaseController, Z as CrudSchemas, Zt as SoftDeleteMixin, a as InferAdapterDoc, c as TypedController, ct as AggMeasureShorthand, d as PaginationResult, dt as AggregationDateRangeRequirement, en as SlugExt, et as RouteSchemaOptions, f as IntrospectionData, ft as AggregationIndexHint, g as ArcInternalMetadata, gt as AggregationsMap, h as ResourceMetadata, ht as AggregationRateLimit, i as ValidationResult, in as BaseCrudController, jn as ControllerConfigurableOptions, k as IntrospectionPluginOptions, kn as ArcUpdateResult, l as TypedRepository, lt as AggregationCacheConfig, m as RegistryStats, mt as AggregationMaterializedResult, n as ConfigError, nn as BulkExt, nt as FieldRule, o as InferDocType, ot as EventDefinition, p as RegistryEntry, pt as AggregationMaterializedContext, q as PresetFunction, r as ValidateOptions, rn as BulkMixin, s as InferResourceDoc, st as AggMeasureInput, t as RouteHandlerMethod, tn as SlugMixin, u as TypedResourceConfig, ut as AggregationConfig, w as ServiceContext, y as OwnershipCheck, zt as IRequestContext } from "./index-CpzxqePp.mjs";
+import { a as UserBase, d as JWTPayload, i as PermissionContext, l as AnyRecord, m as UserOrganization, n as DataPolicy, r as PermissionCheck, t as AuthorizationDecision, u as ArcRequest } from "./types-B7XeLEgK.mjs";
+import { a as applyFieldWritePermissions, i as applyFieldReadPermissions, n as FieldPermissionMap, o as fields, t as FieldPermission } from "./fields-I_EeRWND.mjs";
+import "./fastify-augmentation-BppG5bMT.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, D as defineAggregation, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, b as ResourceSeams, j as DEFAULT_LIMIT, k as CrudOperation, p as getControllerScope, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "./index-DXlHwvuE.mjs";
+import { $ as requireAuth, C as requireServiceScope, G as createOrgPermissions, H as DynamicPermissionMatrixConfig, J as allowPublic, K as allOf, S as requireScopeContext, V as DynamicPermissionMatrix, W as createDynamicPermissionMatrix, Y as anyOf, Z as denyAll, _ as publicReadAdminWrite, b as requireOrgMembership, d as authenticated, et as requireOwnership, f as fullPublic, g as publicRead, h as presets_d_exports, it as when, nt as requireRoles, p as ownerWithAdminBypass, u as adminOnly, v as readOnly, w as requireTeamMembership, x as requireOrgRole, y as requireOrgInScope } from "./index-zq6VrjaB.mjs";
+import { a as NotFoundError, d as ValidationError, f as createDomainError, i as ForbiddenError, t as ArcError, u as UnauthorizedError } from "./errors-BGdVwP25.mjs";
 //#region src/index.d.ts
 declare const version: string;
 //#endregion
-export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };
+export { type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, type AnyRecord, type ArcCreateResult, type ArcDeleteResult, ArcError, type ArcGetResult, type ArcInternalMetadata, type ArcListResult, type ArcRequest, type ArcUpdateResult, type AuthPluginOptions, type AuthorizationDecision, BaseController, type BaseControllerOptions, BaseCrudController, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, type ControllerLike, type CrudController, type CrudOperation, type CrudRouteKey, type CrudRouterOptions, type CrudSchemas, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DataPolicy, type DynamicPermissionMatrix, type DynamicPermissionMatrixConfig, type EventDefinition, type FastifyRequestExtras, type FastifyWithAuth, type FastifyWithDecorators, type FieldPermission, type FieldPermissionMap, type FieldRule, ForbiddenError, type GracefulShutdownOptions, HOOK_OPERATIONS, HOOK_PHASES, type HealthCheck, type HealthOptions, type HookOperation, type HookPhase, type IController, type IControllerResponse, type IRequestContext, type InferAdapterDoc, type InferDocType, type InferResourceDoc, type IntrospectionData, type IntrospectionPluginOptions, type JWTPayload, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, type MiddlewareConfig, type MutationOperation, NotFoundError, type OwnershipCheck, type PaginationResult, type PermissionCheck, type PermissionContext, type PresetFunction, type PresetResult, type QueryParserInterface, RESERVED_QUERY_PARAMS, type RateLimitConfig, type RawRouteHandler, type RegistryEntry, type RegistryStats, type RequestContext, type RequestIdOptions, type RequestWithExtras, type ResourceConfig, ResourceDefinition, type ResourceMetadata, type ResourceSeams, type RouteHandler, type RouteHandlerMethod, type RouteSchemaOptions, SYSTEM_FIELDS, type SeamedResourceConfig, type ServiceContext, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type TypedController, type TypedRepository, type TypedResourceConfig, UnauthorizedError, type UserBase, type UserOrganization, type ValidateOptions, ValidationError, type ValidationResult, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_d_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/index.mjs

@@ -1,13 +1,14 @@
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-DNre0wRg.mjs";
-import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-DkO8Nk6-.mjs";
-import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-B5DwufbB.mjs";
-import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-CQ_7KQWw.mjs";
-import { a as ResourceDefinition, t as defineResource } from "./defineResource-CxWqDCAy.mjs";
-import { c as getControllerScope } from "./pipeline-BJnpkY9i.mjs";
-import { t as defineAggregation } from "./defineAggregation-ufWjUwml.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-poalJLvp.mjs";
-import { B as when, C as requireScopeContext, I as requireAuth, L as requireOwnership, M as anyOf, P as denyAll, R as requireRoles, S as requireOrgRole, T as requireTeamMembership, b as requireOrgInScope, c as publicReadAdminWrite, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, n as authenticated, o as presets_exports, r as fullPublic, s as publicRead, t as adminOnly, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions } from "./permissions-Bfu_8y1U.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "./constants-J99LGTJI.mjs";
+import { d as createDomainError, i as NotFoundError, l as UnauthorizedError, r as ForbiddenError, t as ArcError, u as ValidationError } from "./errors-Bh1KK5ps.mjs";
+import { a as BulkMixin, i as SlugMixin, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, t as BaseController } from "./BaseController-Dk34dxhI.mjs";
+import { n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { a as ResourceDefinition, t as defineResource } from "./defineResource-XFPPUu2c.mjs";
+import { c as getControllerScope } from "./pipeline-CPA-jx0M.mjs";
+import { t as defineAggregation } from "./defineAggregation-gX4No1gt.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, o as defineAction } from "./core-BwwmNSp7.mjs";
+import { B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, I as anyOf, N as allOf, O as requireServiceScope, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, a as adminOnly, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, k as requireTeamMembership, o as authenticated, p as readOnly, s as fullPublic, u as presets_exports, w as requireOrgInScope } from "./permissions-Dl_m0NCe.mjs";
 //#region src/index.ts
-const version = "2.30.0";
+const version = "2.32.0";
 //#endregion
 export { ArcError, BaseController, BaseCrudController, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, ForbiddenError, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, NotFoundError, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, UnauthorizedError, ValidationError, adminOnly, allOf, allowPublic, anyOf, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, createDomainError, createDynamicPermissionMatrix, createOrgPermissions, defineAction, defineAggregation, defineResource, defineResourceVariants, denyAll, fields, fullPublic, getControllerScope, mergeResourceConfig, ownerWithAdminBypass, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAuth, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, version, when };

package/dist/{init-tlRSt667.mjs → init-BbfP8aky.mjs}

@@ -1,3 +1,4 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join } from "node:path";
@@ -459,6 +460,11 @@ export async function createAppInstance()${ts ? ": Promise<FastifyInstance>" : "
     preset: config.env === 'production' ? (${config.edge ? "'edge'" : "'production'"}) : 'development',
     resources,
     resourcePrefix: '/api',
+    // Arc registers the error handler itself (CastError → 400, validation →
+    // 422, duplicate key → 409). Configure it HERE — registering
+    // errorHandlerPlugin again in your own plugins file overrides arc's in the
+    // same scope and boots with an FSTWRN004 warning.
+    errorHandler: { includeStack: config.isDev },
     ${authConfig}
     cors: {
       origin: config.cors.origins,
@@ -608,8 +614,7 @@ export const authResource = defineResource({
       path: '/register',
       summary: 'Register new user',
       permissions: allowPublic(),
-      handler: handlers.register,
-      raw: true,
+      rawHandler: handlers.register,
       schema: { body: schemas.registerBody, response: { 201: schemas.successResponse } },
     },
     {
@@ -617,8 +622,7 @@ export const authResource = defineResource({
       path: '/login',
       summary: 'User login',
       permissions: allowPublic(),
-      handler: handlers.login,
-      raw: true,
+      rawHandler: handlers.login,
       schema: { body: schemas.loginBody, response: { 200: schemas.loginResponse } },
     },
     {
@@ -626,8 +630,7 @@ export const authResource = defineResource({
       path: '/refresh',
       summary: 'Refresh access token',
       permissions: allowPublic(),
-      handler: handlers.refreshToken,
-      raw: true,
+      rawHandler: handlers.refreshToken,
       schema: { body: schemas.refreshBody, response: { 200: schemas.tokenResponse } },
     },
     {
@@ -635,8 +638,7 @@ export const authResource = defineResource({
       path: '/forgot-password',
       summary: 'Request password reset',
       permissions: allowPublic(),
-      handler: handlers.forgotPassword,
-      raw: true,
+      rawHandler: handlers.forgotPassword,
       schema: { body: schemas.forgotBody, response: { 200: schemas.successResponse } },
     },
     {
@@ -644,8 +646,7 @@ export const authResource = defineResource({
       path: '/reset-password',
       summary: 'Reset password with token',
       permissions: allowPublic(),
-      handler: handlers.resetPassword,
-      raw: true,
+      rawHandler: handlers.resetPassword,
       schema: { body: schemas.resetBody, response: { 200: schemas.successResponse } },
     },
   ],
@@ -669,8 +670,7 @@ export const userProfileResource = defineResource({
       path: '/me',
       summary: 'Get current user profile',
       permissions: requireAuth(),
-      handler: handlers.getUserProfile,
-      raw: true,
+      rawHandler: handlers.getUserProfile,
       schema: { response: { 200: schemas.userProfileResponse } },
     },
     {
@@ -678,8 +678,7 @@ export const userProfileResource = defineResource({
       path: '/me',
       summary: 'Update current user profile',
       permissions: requireAuth(),
-      handler: handlers.updateUserProfile,
-      raw: true,
+      rawHandler: handlers.updateUserProfile,
       schema: { body: schemas.updateUserBody, response: { 200: schemas.userProfileResponse } },
     },
   ],
@@ -998,7 +997,7 @@ export async function updateUserProfile(request${ts ? ": FastifyRequest" : ""},
     delete updates.role;
     delete updates.organizations;
 
-    const user = await userRepository.Model.findByIdAndUpdate(userId, updates, { new: true });
+    const user = await userRepository.Model.findByIdAndUpdate(userId, updates, { returnDocument: 'after' });
     return reply.send(user);
   } catch (error) {
     request.log.error({ err: error }, 'Update profile error');
@@ -2380,7 +2379,8 @@ export const requireAdmin = ()${returnType} =>
 export const requireSuperadmin = ()${returnType} =>
   requireRoles(['superadmin']);
 `;
-	if (config.tenant === "multi") if (config.auth === "better-auth") content += `
+	if (config.tenant === "multi") {
+		if (config.auth === "better-auth") content += `
 // ============================================================================
 // Better Auth Organization & Team Permission Helpers
 // ============================================================================
@@ -2432,7 +2432,7 @@ export const requireOrgManager = ()${returnType} =>
 export const requireOrgStaff = ()${returnType} =>
   requireOrgMembership();
 `;
-	else content += `
+		else content += `
 /**
  * Require organization owner (elevated scope auto-bypasses)
  */
@@ -2451,6 +2451,7 @@ export const requireOrgManager = ()${returnType} =>
 export const requireOrgStaff = ()${returnType} =>
   requireRoles(['owner', 'manager', 'staff', 'admin', 'superadmin']);
 `;
+	}
 	content += `
 // ============================================================================
 // Standard Permission Sets
@@ -2533,7 +2534,6 @@ function pluginsIndexTemplate(config) {
  */
 
 ${typeImport}${ts ? "import type { AppConfig } from '../config/index.js';\n" : ""}import { openApiPlugin, scalarPlugin } from '@classytic/arc/docs';
-import { errorHandlerPlugin } from '@classytic/arc/plugins';
 `;
 	content += `
 /**
@@ -2546,12 +2546,9 @@ export async function registerPlugins(
   app${appType},
   deps${configType}
 )${ts ? ": Promise<void>" : ""} {
-  const { config } = deps;
-
-  // Error handling (CastError → 400, validation → 422, duplicate → 409)
-  await app.register(errorHandlerPlugin, {
-    includeStack: config.isDev,
-  });
+  // NOTE: no error handler here — arc registers it inside createApp().
+  // Configure it via createApp({ errorHandler: { includeStack } }) in app.ts.
+  // Registering it again would override arc's in the same scope (FSTWRN004).
 
   // API Documentation (Scalar UI)
   // OpenAPI spec: /_docs/openapi.json
@@ -2567,8 +2564,9 @@ export async function registerPlugins(
     theme: 'default',
   });
 
-  // Add your custom plugins here:
-  // await app.register(myCustomPlugin, { ...options });
+  // Add your custom plugins here — deps carries your config and services:
+  // const { config } = deps;
+  // await app.register(myCustomPlugin, { apiKey: config.someKey });
 }
 `;
 	return content;
@@ -3020,7 +3018,7 @@ class UserRepository extends Repository${ts ? "<UserDocument>" : ""} {
     return this.Model.findByIdAndUpdate(
       userId,
       { resetPasswordToken: token, resetPasswordExpires: expiresAt },
-      { new: true }
+      { returnDocument: 'after' }
     );
   }
 ${config.tenant === "multi" ? `

package/dist/{init-BPEu8cs-.d.mts → init-Cscs4lab.d.mts}

@@ -1,3 +1,4 @@
+
 //#region src/cli/commands/init/types.d.ts
 /**
  * Shared types for the `arc init` scaffolder.

package/dist/integrations/event-gateway.d.mts

@@ -1,5 +1,6 @@
-import { n as DomainEvent } from "../EventTransport-QmY7A258.mjs";
-import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-_Pd0CgR0.mjs";
+
+import { n as DomainEvent } from "../EventTransport-2uVV34WU.mjs";
+import { c as WebSocketClient, l as WebSocketMessage } from "../websocket-BOXVggMf.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 //#region src/integrations/event-gateway.d.ts
 interface EventGatewayOptions {

package/dist/integrations/event-gateway.mjs

@@ -1,10 +1,11 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import fp from "fastify-plugin";
 //#region src/integrations/event-gateway.ts
 const eventGatewayPluginImpl = async (fastify, opts = {}) => {
 	const { auth = true, orgScoped = false, roomPolicy, maxMessageBytes, maxSubscriptionsPerClient, authenticate } = opts;
 	if (auth && !authenticate && !fastify.hasDecorator("authenticate")) throw new Error("[arc-event-gateway] auth is true but fastify.authenticate is not registered. Register an auth plugin first, provide a custom authenticate function, or set auth: false.");
 	if (opts.sse !== false) {
-		const { default: ssePlugin } = await import("../sse-BQ1w0dfl.mjs").then((n) => n.r);
+		const { default: ssePlugin } = await import("../sse-B9P4Y-UI.mjs").then((n) => n.r);
 		await fastify.register(ssePlugin, {
 			path: opts.sse?.path ?? "/events/stream",
 			requireAuth: auth,

package/dist/integrations/index.d.mts

@@ -1,7 +1,8 @@
-import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-_Pd0CgR0.mjs";
+
+import { c as WebSocketClient, l as WebSocketMessage, u as WebSocketPluginOptions } from "../websocket-BOXVggMf.mjs";
 import { EventGatewayOptions } from "./event-gateway.mjs";
-import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-CG4yqMDB.mjs";
-import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-Bmmn-fO0.mjs";
+import { a as JobMeta, c as JobsPluginOptions, i as JobDispatcher, l as QueueStats, n as JobDefinition, r as JobDispatchOptions } from "../index-C-481Zf2.mjs";
+import { _ as ToolDefinition, c as McpAuthResult, d as McpResourceConfig, f as PromptDefinition, g as ToolContext, h as ToolAnnotations, n as CallToolResult, o as CrudOperation, r as CreateMcpServerConfig, t as BetterAuthHandler, u as McpPluginOptions } from "../types-CwcUQ610.mjs";
 import { StreamlinePluginOptions, WorkflowLike, WorkflowRunLike } from "./streamline.mjs";
 import { WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription } from "./webhooks.mjs";
 export type { BetterAuthHandler, CallToolResult, CreateMcpServerConfig, CrudOperation, EventGatewayOptions, JobDefinition, JobDispatchOptions, JobDispatcher, JobMeta, JobsPluginOptions, McpAuthResult, McpPluginOptions, McpResourceConfig, PromptDefinition, QueueStats, StreamlinePluginOptions, ToolAnnotations, ToolContext, ToolDefinition, WebSocketClient, WebSocketMessage, WebSocketPluginOptions, WebhookDeliveryRecord, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WorkflowLike, WorkflowRunLike };

package/dist/integrations/index.mjs

@@ -1 +1,2 @@
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 export {};

package/dist/integrations/jobs/index.d.mts

@@ -1,2 +1,3 @@
-import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-CG4yqMDB.mjs";
+
+import { a as JobMeta, c as JobsPluginOptions, d as ExecuteTimedHandlerOptions, f as TimedHandlerLogger, i as JobDispatcher, l as QueueStats, n as JobDefinition, o as JobRepeatOptions, p as executeTimedHandler, r as JobDispatchOptions, s as JobStatus, t as jobsPlugin, u as defineJob } from "../../index-C-481Zf2.mjs";
 export { type ExecuteTimedHandlerOptions, type JobDefinition, type JobDispatchOptions, type JobDispatcher, type JobMeta, type JobRepeatOptions, type JobStatus, type JobsPluginOptions, type QueueStats, type TimedHandlerLogger, defineJob, executeTimedHandler, jobsPlugin };