@classytic/arc 2.31.0 → 2.32.0

package/dist/permissions/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-ChvUQGG1.mjs";
-import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-ChYJ6CdK.mjs";
-import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-CB5Cuzk9.mjs";
-import { A as allow, B as roles, C as requireScopeContext, D as requireDPoP, E as requireAgentScope, F as not, H as scopeOf, I as requireAuth, L as requireOwnership, M as anyOf, N as deny, O as requireMandate, P as denyAll, R as requirePlatformRole, S as requireOrgRole, T as requireTeamMembership, V as when, _ as explainAccess, a as permissionMatrix, b as requireOrgInScope, c as publicReadAdminWrite, d as GRANT_MODES, f as modeSatisfies, g as describePermissionMap, h as describePermission, i as ownerWithAdminBypass, j as allowPublic, k as allOf, l as readOnly, m as collectPublicSurface, n as authenticated, o as presets_exports, p as requireGrant, r as fullPublic, s as publicRead, t as adminOnly, u as createRoleHierarchy, v as createDynamicPermissionMatrix, w as requireServiceScope, x as requireOrgMembership, y as createOrgPermissions, z as requireRoles } from "../permissions-L--QDAir.mjs";
-export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as conjoinPolicyFilters, i as normalizeToDecision, r as evaluatePermissionDecision, t as applyAuthorizationDecision } from "../authorizationDecision-__T3EJDA.mjs";
+import { n as getUserRoles, r as normalizeRoles } from "../userHelpers-BNsOXzOd.mjs";
+import { i as resolveEffectiveRoles, n as applyFieldWritePermissions, r as fields, t as applyFieldReadPermissions } from "../fields-DEi65pGj.mjs";
+import { A as requireAgentScope, B as requireAuth, C as createOrgPermissions, D as requireScopeContext, E as requireOrgRole, F as allowPublic, G as when, H as requirePlatformRole, I as anyOf, K as scopeOf, L as deny, M as requireMandate, N as allOf, O as requireServiceScope, P as allow, R as denyAll, S as createDynamicPermissionMatrix, T as requireOrgMembership, U as requireRoles, V as requireOwnership, W as roles, _ as requireGrant, a as adminOnly, b as describePermissionMap, c as ownerWithAdminBypass, d as publicRead, f as publicReadAdminWrite, g as modeSatisfies, h as GRANT_MODES, i as introspectRegistry, j as requireDPoP, k as requireTeamMembership, l as permissionMatrix, m as createRoleHierarchy, n as introspectCheck, o as authenticated, p as readOnly, r as introspectModule, s as fullPublic, t as buildPermissionMatrix, u as presets_exports, v as collectPublicSurface, w as requireOrgInScope, x as explainAccess, y as describePermission, z as not } from "../permissions-Dl_m0NCe.mjs";
+export { GRANT_MODES, adminOnly, allOf, allow, allowPublic, anyOf, applyAuthorizationDecision, applyFieldReadPermissions, applyFieldWritePermissions, authenticated, buildPermissionMatrix, collectPublicSurface, conjoinPolicyFilters, createDynamicPermissionMatrix, createOrgPermissions, createRoleHierarchy, deny, denyAll, describePermission, describePermissionMap, evaluatePermissionDecision, explainAccess, fields, fullPublic, getUserRoles, introspectCheck, introspectModule, introspectRegistry, modeSatisfies, normalizeRoles, normalizeToDecision, not, ownerWithAdminBypass, permissionMatrix, presets_exports as permissions, publicRead, publicReadAdminWrite, readOnly, requireAgentScope, requireAuth, requireDPoP, requireGrant, requireMandate, requireOrgInScope, requireOrgMembership, requireOrgRole, requireOwnership, requirePlatformRole, requireRoles, requireScopeContext, requireServiceScope, requireTeamMembership, resolveEffectiveRoles, roles, scopeOf, when };

package/dist/{permissions-L--QDAir.mjs → permissions-Dl_m0NCe.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-ChvUQGG1.mjs";
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
-import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Cys0ko9Z.mjs";
-import { t as MemoryCacheStore } from "./memory-DR6wpa9F.mjs";
+import { a as conjoinPolicyFilters, i as normalizeToDecision } from "./authorizationDecision-__T3EJDA.mjs";
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, n as PUBLIC_SCOPE, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-DXYX7dIR.mjs";
+import { t as MemoryCacheStore } from "./memory-DsuWnj4T.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/context.ts
 /**
@@ -578,7 +578,8 @@ function requireAgentScope(opts) {
 */
 function requireOrgMembership() {
 	const check = (ctx) => {
-		if (hasOrgAccess(scopeOf(ctx))) return true;
+		const scope = scopeOf(ctx);
+		if (hasOrgAccess(scope)) return true;
 		if (!ctx.user) return deny("Authentication required");
 		return deny("Organization membership required");
 	};
@@ -1545,4 +1546,96 @@ function readOnly(overrides) {
 	}, overrides);
 }
 //#endregion
-export { allow as A, roles as B, requireScopeContext as C, requireDPoP as D, requireAgentScope as E, not as F, scopeOf as H, requireAuth as I, requireOwnership as L, anyOf as M, deny as N, requireMandate as O, denyAll as P, requirePlatformRole as R, requireOrgRole as S, requireTeamMembership as T, when as V, explainAccess as _, permissionMatrix as a, requireOrgInScope as b, publicReadAdminWrite as c, GRANT_MODES as d, modeSatisfies as f, describePermissionMap as g, describePermission as h, ownerWithAdminBypass as i, allowPublic as j, allOf as k, readOnly as l, collectPublicSurface as m, authenticated as n, presets_exports as o, requireGrant as p, fullPublic as r, publicRead as s, adminOnly as t, createRoleHierarchy as u, createDynamicPermissionMatrix as v, requireServiceScope as w, requireOrgMembership as x, createOrgPermissions as y, requireRoles as z };
+//#region src/permissions/matrix.ts
+/**
+* Permission MATRIX — what the caller may do, answered from the live registry.
+*
+* A permission-gated frontend has to decide which screens and buttons to render
+* before it issues a request. Without a server answer it keeps a hand-written
+* copy of the gates, and that copy drifts the moment a resource changes one —
+* silently, and in the dangerous direction: the UI offers an action the server
+* will refuse, or hides one the user is entitled to.
+*
+* This builds the answer from what arc ACTUALLY enforces. Every registered
+* resource contributes its CRUD gates, its state-transition `action:<verb>`
+* gates and its `agg:<name>` gates, introspected through `describePermission`.
+* A resource that exists therefore gates its own screen with no one adding it
+* anywhere — including resources unique to one deployment.
+*
+* ## Why it lives in arc
+*
+* Every input is arc's: `describePermission`, the resource registry, the shapes
+* of `actions` and `aggregations`. Nothing here knows what a domain is. Built
+* in a host, it is re-derived per deployment — and the known gap below is a
+* gap in arc's own introspection, which a host cannot close but arc can.
+*
+* ## Known gap
+*
+* `anyOf(a, b)` composes checks into a bare function with no aggregated meta,
+* so `anyOf(platformAdminOnly(), requireOrgRole(…))` introspects as
+* `authenticated` with no roles. Consumers must read `authenticated` as "the
+* server decides" rather than "any logged-in user", and fall back to an
+* explicit gate for those. Fixing it means teaching the combinators to
+* aggregate meta — an arc change, tracked here because this is where it shows.
+*/
+/** Re-shape arc's typed requirement into the wire entry. */
+function introspectCheck(check) {
+	const req = describePermission(check);
+	if (req.kind === "public") return {
+		type: "public",
+		roles: []
+	};
+	if (req.kind === "roles") return {
+		type: "roles",
+		roles: [...req.roles]
+	};
+	if (req.kind === "scoped") return {
+		type: "scoped",
+		roles: req.roles ? [...req.roles] : [],
+		scope: { ...req.scope }
+	};
+	return {
+		type: "authenticated",
+		roles: []
+	};
+}
+/** Introspect a permission module, flattening nested groups to `a.b`. */
+function introspectModule(mod) {
+	const result = {};
+	for (const [action, check] of Object.entries(mod)) if (typeof check === "function") result[action] = introspectCheck(check);
+	else if (typeof check === "object" && check !== null) for (const [nested, entry] of Object.entries(introspectModule(check))) result[`${action}.${nested}`] = entry;
+	return result;
+}
+/** Every live resource's ACTUAL gates, keyed by arc resource name. */
+function introspectRegistry(registry) {
+	const modules = {};
+	for (const entry of registry.getAll()) {
+		const map = {};
+		for (const [action, check] of Object.entries(entry.permissions ?? {})) if (typeof check === "function") map[action] = introspectCheck(check);
+		for (const a of entry.actions ?? []) if (typeof a.permissions === "function") map[`action:${a.name}`] = introspectCheck(a.permissions);
+		for (const agg of entry.aggregations ?? []) if (typeof agg.permissions === "function") map[`agg:${agg.name}`] = introspectCheck(agg.permissions);
+		if (Object.keys(map).length > 0) modules[entry.name] = map;
+	}
+	return modules;
+}
+function buildPermissionMatrix(options = {}) {
+	const platform = [...options.platformRoles ?? []];
+	const branch = [...options.orgRoles ?? []];
+	const modules = {};
+	for (const [name, mod] of Object.entries(options.curatedModules ?? {})) if (typeof mod === "object" && mod !== null) modules[name] = introspectModule(mod);
+	for (const [name, mod] of Object.entries(options.fallbackModules ?? {})) {
+		if (modules[name]) continue;
+		if (typeof mod === "object" && mod !== null) modules[name] = introspectModule(mod);
+	}
+	if (options.registry) Object.assign(modules, introspectRegistry(options.registry));
+	return {
+		roles: [.../* @__PURE__ */ new Set([...platform, ...branch])],
+		roleGroups: {
+			platform,
+			branch
+		},
+		modules
+	};
+}
+//#endregion
+export { requireAgentScope as A, requireAuth as B, createOrgPermissions as C, requireScopeContext as D, requireOrgRole as E, allowPublic as F, when as G, requirePlatformRole as H, anyOf as I, scopeOf as K, deny as L, requireMandate as M, allOf as N, requireServiceScope as O, allow as P, denyAll as R, createDynamicPermissionMatrix as S, requireOrgMembership as T, requireRoles as U, requireOwnership as V, roles as W, requireGrant as _, adminOnly as a, describePermissionMap as b, ownerWithAdminBypass as c, publicRead as d, publicReadAdminWrite as f, modeSatisfies as g, GRANT_MODES as h, introspectRegistry as i, requireDPoP as j, requireTeamMembership as k, permissionMatrix as l, createRoleHierarchy as m, introspectCheck as n, authenticated as o, readOnly as p, introspectModule as r, fullPublic as s, buildPermissionMatrix as t, presets_exports as u, collectPublicSurface as v, requireOrgInScope as w, explainAccess as x, describePermission as y, not as z };

package/dist/{pipe-DRDNsI2T.mjs → pipe-ELHCP3zj.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { r as ForbiddenError } from "./errors-Cj42AntO.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { r as ForbiddenError } from "./errors-Bh1KK5ps.mjs";
 //#region src/pipeline/pipe.ts
 /**
 * Compose pipeline steps into an ordered array.
@@ -40,9 +40,7 @@ async function executePipeline(steps, ctx, handler, operation) {
 			case "transform":
 				transforms.push(step);
 				break;
-			case "interceptor":
-				interceptors.push(step);
-				break;
+			case "interceptor": interceptors.push(step);
 		}
 	}
 	for (const g of guards) if (!await g.handler(ctx)) throw new ForbiddenError(`Guard '${g.name}' denied access`);

package/dist/pipeline/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as pipe, t as executePipeline } from "../pipe-DRDNsI2T.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as pipe, t as executePipeline } from "../pipe-ELHCP3zj.mjs";
 //#region src/pipeline/guard.ts
 /**
 * Create a named guard.

package/dist/{pipeline-UPQFatit.mjs → pipeline-CPA-jx0M.mjs}

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-Cys0ko9Z.mjs";
-import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
-import { t as executePipeline } from "./pipe-DRDNsI2T.mjs";
-import { t as buildRequestScopeProjection } from "./projection-BHw6xlOQ.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE, x as isMember } from "./types-DXYX7dIR.mjs";
+import { i as resolveEffectiveRoles, t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { t as executePipeline } from "./pipe-ELHCP3zj.mjs";
+import { t as buildRequestScopeProjection } from "./projection-CjHhM5W1.mjs";
 import { isPaginatedResult, toCanonicalList } from "@classytic/repo-core/pagination";
 //#region src/core/fastifyAdapter.ts
 /** Type guard for Mongoose-like documents with toObject() */
@@ -122,9 +122,7 @@ function computeFieldCapabilities(fieldPerms, effectiveRoles) {
 			case "visibleTo":
 				readable = perm.roles?.some((r) => effectiveRoles.includes(r)) ?? false;
 				break;
-			case "writableBy":
-				writable = perm.roles?.some((r) => effectiveRoles.includes(r)) ?? false;
-				break;
+			case "writableBy": writable = perm.roles?.some((r) => effectiveRoles.includes(r)) ?? false;
 		}
 		caps[field] = {
 			readable,
@@ -172,8 +170,10 @@ function sendControllerResponse(reply, response, request) {
 	/** Apply both field mask and field-level permissions to a data item */
 	const applyPermissions = (data) => {
 		let result = fieldMaskConfig ? applyFieldMask(data, fieldMaskConfig) : data;
-		if (fieldPerms && result && typeof result === "object") if (Array.isArray(result)) result = result.map((item) => applyFieldReadPermissions(item, fieldPerms, effectiveRoles));
-		else result = applyFieldReadPermissions(result, fieldPerms, effectiveRoles);
+		if (fieldPerms && result && typeof result === "object") {
+			if (Array.isArray(result)) result = result.map((item) => applyFieldReadPermissions(item, fieldPerms, effectiveRoles));
+			else result = applyFieldReadPermissions(result, fieldPerms, effectiveRoles);
+		}
 		return result;
 	};
 	if (response.headers) for (const [key, value] of Object.entries(response.headers)) reply.header(key, value);
@@ -281,11 +281,12 @@ function resolvePipelineSteps(pipeline, operation) {
 */
 function buildPipelineHandler(controllerMethod, steps, operation, resourceName) {
 	return async (req, reply) => {
-		sendControllerResponse(reply, await executePipeline(steps, {
+		const pipeCtx = {
 			...createRequestContext(req),
 			resource: resourceName,
 			operation
-		}, (ctx) => controllerMethod(ctx), operation), req);
+		};
+		sendControllerResponse(reply, await executePipeline(steps, pipeCtx, (ctx) => controllerMethod(ctx), operation), req);
 	};
 }
 /**
@@ -310,11 +311,12 @@ function buildActionPipelineHandler(handler, steps, operation, resourceName) {
 		data: await handler(id, data, req)
 	});
 	return async (id, data, req) => {
-		return executePipeline(steps, {
+		const pipeCtx = {
 			...createRequestContext(req),
 			resource: resourceName,
 			operation
-		}, async (_ctx) => ({
+		};
+		return executePipeline(steps, pipeCtx, async (_ctx) => ({
 			status: 200,
 			data: await handler(id, data, req)
 		}), operation);

package/dist/plugins/index.d.mts

@@ -2,8 +2,8 @@
 import { At as RouteDefinition, J as PresetHook, Q as MiddlewareConfig, et as RouteSchemaOptions } from "../index-CpzxqePp.mjs";
 import { l as AnyRecord } from "../types-B7XeLEgK.mjs";
 import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-CpYUJmPA.mjs";
-import { _ as _default$3, d as ScheduleStats, f as SchedulesPluginOptions, g as HealthOptions, h as HealthCheck, m as schedulesPlugin, p as _default$7, u as ScheduleDefinition, v as healthPlugin } from "../types-CBgvkp8O.mjs";
-import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-zh0_AYHa.mjs";
+import { _ as HealthCheck, b as healthPlugin, f as ScheduleDefinition, g as schedulesPlugin, h as _default$7, m as SchedulesPluginOptions, p as ScheduleStats, v as HealthOptions, y as _default$3 } from "../types-CT5vu6M0.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-BppG5bMT.mjs";
 import { _ as CachingRule, a as MetricsCollector, c as metricsPlugin, d as _default$5, f as realtimePlugin, g as CachingOptions, h as ssePlugin, i as MetricEntry, l as ChangeOperation, m as _default$8, n as _default$9, o as MetricsOptions, p as SSEOptions, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as RealtimeOptions, v as _default$1, y as cachingPlugin } from "../versioning-D_rhHfZm.mjs";
 import { t as TracingOptions } from "../tracing-Dro5eH6j.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";

package/dist/plugins/index.mjs

@@ -1,19 +1,19 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { p as MUTATION_OPERATIONS } from "../constants-D3Dv4LAV.mjs";
-import { c as getOrgId } from "../types-Cys0ko9Z.mjs";
-import { n as requestContext } from "../requestContext-2TxXOJ7T.mjs";
-import { t as hasEvents } from "../typeGuards-B0ryPo3I.mjs";
-import { t as HookSystem } from "../HookSystem-BcmPyq5I.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-qq0mn2s9.mjs";
-import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-DjZYjM7H.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-BFHA6Scf.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-C5NeD6bT.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-CUdw_wLB.mjs";
-import { n as realtime_default, t as realtimePlugin } from "../realtime-C5NoxWFY.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-DIiZKGUt.mjs";
-import { n as schedules_default, t as schedulesPlugin } from "../schedules-DdtlICTf.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-CUTo9y0X.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-CHDTor3P.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { p as MUTATION_OPERATIONS } from "../constants-J99LGTJI.mjs";
+import { c as getOrgId } from "../types-DXYX7dIR.mjs";
+import { n as requestContext } from "../requestContext-B6vQF-sy.mjs";
+import { t as hasEvents } from "../typeGuards-B_5-hKjJ.mjs";
+import { t as HookSystem } from "../HookSystem-vimw5D7Z.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-BVr7PgA0.mjs";
+import { a as requestIdPlugin, i as createRequestIdGenerator, n as health_default, o as requestId_default, s as sanitizeRequestId, t as healthPlugin } from "../health-5XnTa2uo.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-DFJqHyFs.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-B2AZUJUj.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-DdQL8syd.mjs";
+import { n as realtime_default, t as realtimePlugin } from "../realtime-DVvVZZFz.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-DS-P0b32.mjs";
+import { n as schedules_default, t as schedulesPlugin } from "../schedules-C2Q3uv2d.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-B9P4Y-UI.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CKv2jz_U.mjs";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts
 const arcCorePlugin = async (fastify, opts = {}) => {

package/dist/plugins/response-cache.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as hasEvents } from "../typeGuards-B0ryPo3I.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as hasEvents } from "../typeGuards-B_5-hKjJ.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/response-cache.ts
 /**

package/dist/plugins/tracing-entry.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { createRequire } from "node:module";
 import fp from "fastify-plugin";
 //#region src/plugins/tracing.ts
@@ -59,7 +59,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.31.0";
+	const resolvedVersion = serviceVersion ?? "2.32.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/{pluralize-O0FZgESl.mjs → pluralize-C2ZkKbsn.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/utils/pluralize.ts
 /**
 * Lightweight English pluralization for the Arc CLI.

package/dist/{preloadResources-Dz6BjzM6.mjs → preloadResources-CDs87fTw.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/factory/preloadResources.ts
 /**
 * Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.

package/dist/{preloadResources-CyoJMSiO.d.mts → preloadResources-T1hmlTEZ.d.mts}

@@ -6,8 +6,8 @@ import { a as EventTransport } from "./EventTransport-2uVV34WU.mjs";
 import { t as ExternalOpenApiPaths } from "./externalPaths-CmGOxOtD.mjs";
 import { r as QueryCachePluginOptions } from "./queryCachePlugin-BzqxconG.mjs";
 import { t as ErrorHandlerOptions } from "./errorHandler-CpYUJmPA.mjs";
-import { f as SchedulesPluginOptions, g as HealthOptions, n as ArcModuleInput, s as ResourceLike } from "./types-CBgvkp8O.mjs";
-import "./index-CFThn1K9.mjs";
+import { l as ResourceLike, m as SchedulesPluginOptions, n as ArcModuleInput, v as HealthOptions } from "./types-CT5vu6M0.mjs";
+import "./index-ZWhLTp_s.mjs";
 import { t as EventPluginOptions } from "./eventPlugin-GF5nnBIq.mjs";
 import { g as CachingOptions, o as MetricsOptions, p as SSEOptions, t as VersioningOptions, u as RealtimeOptions } from "./versioning-D_rhHfZm.mjs";
 import { r as IdempotencyStore } from "./interface-DEWNOMza.mjs";

package/dist/presets/filesUpload.mjs

@@ -1,11 +1,11 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { i as NotFoundError, u as ValidationError } from "../errors-Cj42AntO.mjs";
-import { c as getOrgId, g as getUserId } from "../types-Cys0ko9Z.mjs";
-import { I as requireAuth, j as allowPublic } from "../permissions-L--QDAir.mjs";
-import { t as multipartBody } from "../multipartBody-wOgj_fnj.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { i as NotFoundError, u as ValidationError } from "../errors-Bh1KK5ps.mjs";
+import { c as getOrgId, g as getUserId } from "../types-DXYX7dIR.mjs";
+import { B as requireAuth, F as allowPublic } from "../permissions-Dl_m0NCe.mjs";
+import { t as multipartBody } from "../multipartBody-BnkBLN7v.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
-const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+const DEFAULT_MAX_FILE_SIZE = 10485760;
 function defaultContextFrom(scope) {
 	if (!scope) return {};
 	const userId = getUserId(scope);

package/dist/presets/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C4-g4_4P.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-Dntd_pUO.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import "../constants-D3Dv4LAV.mjs";
-import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-Cys0ko9Z.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import "../constants-J99LGTJI.mjs";
+import { b as isElevated, c as getOrgId, d as getScopeContext, m as getTeamId, u as getRequestScope, v as hasOrgAccess } from "../types-DXYX7dIR.mjs";
 //#region src/presets/multiTenant.ts
 /**
 * Resolve a single TenantFieldSpec against the current scope.

package/dist/presets/search.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { I as requireAuth, j as allowPublic } from "../permissions-L--QDAir.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { B as requireAuth, F as allowPublic } from "../permissions-Dl_m0NCe.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-C4-g4_4P.mjs → presets-Dntd_pUO.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { l as UnauthorizedError } from "./errors-Cj42AntO.mjs";
-import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Cys0ko9Z.mjs";
-import { I as requireAuth, j as allowPublic, z as requireRoles } from "./permissions-L--QDAir.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { l as UnauthorizedError } from "./errors-Bh1KK5ps.mjs";
+import { b as isElevated, n as PUBLIC_SCOPE } from "./types-DXYX7dIR.mjs";
+import { B as requireAuth, F as allowPublic, U as requireRoles } from "./permissions-Dl_m0NCe.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**
@@ -14,7 +14,8 @@ import { multiTenantPreset } from "./presets/multiTenant.mjs";
 */
 function createOwnershipCheck(ownerField, missingOwner) {
 	return async (request, _reply) => {
-		if (isElevated(request.scope ?? PUBLIC_SCOPE)) return;
+		const scope = request.scope ?? PUBLIC_SCOPE;
+		if (isElevated(scope)) return;
 		const user = request.user;
 		if (!user) throw new UnauthorizedError("Authentication required for this operation");
 		const userWithId = user;

package/dist/{projection-BHw6xlOQ.mjs → projection-CjHhM5W1.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { c as getOrgId, g as getUserId, x as isMember } from "./types-Cys0ko9Z.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { c as getOrgId, g as getUserId, x as isMember } from "./types-DXYX7dIR.mjs";
 //#region src/scope/projection.ts
 /**
 * Compute the request-scope projection. Returns `undefined` when no

package/dist/{queryCachePlugin-BZr8v46E.mjs → queryCachePlugin-Dhps-Ldt.mjs}

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
-import { t as hasEvents } from "./typeGuards-B0ryPo3I.mjs";
-import { i as versionKey, r as tagVersionKey } from "./keys-C0_pa1tY.mjs";
-import { t as MemoryCacheStore } from "./memory-DR6wpa9F.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
+import { t as hasEvents } from "./typeGuards-B_5-hKjJ.mjs";
+import { i as versionKey, r as tagVersionKey } from "./keys-B-HBTGXl.mjs";
+import { t as MemoryCacheStore } from "./memory-DsuWnj4T.mjs";
 import fp from "fastify-plugin";
 //#region src/cache/QueryCache.ts
 var QueryCache = class {
@@ -100,7 +100,7 @@ var QueryCache = class {
 	}
 };
 /** See `bumpVersion` — effectively non-expiring, refreshed on every bump. */
-const VERSION_TTL_SECONDS = 365 * 24 * 60 * 60;
+const VERSION_TTL_SECONDS = 31536e3;
 //#endregion
 //#region src/cache/queryCachePlugin.ts
 var queryCachePlugin_exports = /* @__PURE__ */ __exportAll({ queryCachePlugin: () => queryCachePlugin });

package/dist/{rateLimit-CMPY5Qms.mjs → rateLimit-C7mmAGs3.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as requestContext } from "./requestContext-2TxXOJ7T.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as requestContext } from "./requestContext-B6vQF-sy.mjs";
 //#region src/core/middlewares/arcDecorator.ts
 /**
 * Build the `arcDecorator` preHandler for a resource.

package/dist/{rateLimitKey-Dn5JNmkj.mjs → rateLimitKey-CccEFBfk.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/scope/rateLimitKey.ts
 function createTenantKeyGenerator(opts) {
 	if (opts?.strategy) return opts.strategy;

package/dist/{realtime-C5NoxWFY.mjs → realtime-DVvVZZFz.mjs}

@@ -1,13 +1,13 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { arcLog } from "./logger/index.mjs";
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-ChvUQGG1.mjs";
-import { n as getUserRoles } from "./userHelpers-ChYJ6CdK.mjs";
-import { c as getOrgId } from "./types-Cys0ko9Z.mjs";
-import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-DjQJ7FKA.mjs";
-import { t as applyFieldReadPermissions } from "./fields-CB5Cuzk9.mjs";
-import { a as promoteStreamTokenToHeader } from "./streaming-PSZwi8JV.mjs";
-import { t as openSseStream } from "./sseStream-B_5XcVVd.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-__T3EJDA.mjs";
+import { n as getUserRoles } from "./userHelpers-BNsOXzOd.mjs";
+import { c as getOrgId } from "./types-DXYX7dIR.mjs";
+import { t as simpleEqualityMatcher } from "./simpleEqualityMatcher-C4KiMWUa.mjs";
+import { t as applyFieldReadPermissions } from "./fields-DEi65pGj.mjs";
+import { a as promoteStreamTokenToHeader } from "./streaming-DPZdQmDz.mjs";
+import { t as openSseStream } from "./sseStream-B3zb_d1h.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/realtime.ts
 var realtime_exports = /* @__PURE__ */ __exportAll({
@@ -47,7 +47,7 @@ const MAX_TIMER_MS = 2147483647;
 * churning connections. A host that truly wants a longer-lived feed sets
 * `maxConnectionMs` explicitly (up to `MAX_TIMER_MS`).
 */
-const DEFAULT_MAX_CONNECTION_MS = 30 * 6e4;
+const DEFAULT_MAX_CONNECTION_MS = 18e5;
 /**
 * Milliseconds from `now` until the feed should force-close to bound
 * permission staleness — `min(auth-token exp, maxConnectionMs)`. Returns

package/dist/{registerRoute-CBN84fc7.mjs → registerRoute-B_QrjYZS.mjs}

@@ -1,7 +1,7 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-ChvUQGG1.mjs";
-import { f as createError } from "./errors-Cj42AntO.mjs";
-import { u as getRequestScope } from "./types-Cys0ko9Z.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-__T3EJDA.mjs";
+import { f as createError } from "./errors-Bh1KK5ps.mjs";
+import { u as getRequestScope } from "./types-DXYX7dIR.mjs";
 //#region src/core/middlewares/permissions.ts
 /**
 * Build a PermissionContext from a Fastify request. Extracted so the CRUD
@@ -32,10 +32,11 @@ function buildPermissionContext(req, opts) {
 function buildCrudPermissionMw(permissionCheck, resourceName, action) {
 	if (!permissionCheck) return null;
 	return async (req, reply) => {
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+		const context = buildPermissionContext(req, {
 			resource: resourceName,
 			action
-		}), req, reply);
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
 	};
 }
 /**
@@ -64,12 +65,13 @@ function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, reso
 		if (!permissionCheck) return;
 		const { action: _discard, ...data } = body;
 		const params = req.params;
-		await evaluateAndApplyPermission(permissionCheck, buildPermissionContext(req, {
+		const context = buildPermissionContext(req, {
 			resource: resourceName,
 			action,
 			resourceId: params?.id,
 			data
-		}), req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
+		});
+		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
 	};
 }
 //#endregion

package/dist/registry/index.d.mts

@@ -1,6 +1,6 @@
 
 import { K as ResolvedTenantPurge, R as RegisterOptions, V as ResourceDefinition, X as CrudRouteKey, k as IntrospectionPluginOptions, p as RegistryEntry, z as ResourceRegistry } from "../index-CpzxqePp.mjs";
-import "../fastify-augmentation-zh0_AYHa.mjs";
+import "../fastify-augmentation-BppG5bMT.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { TenantPurgeProgress, TenantPurgeStrategy } from "@classytic/repo-core/repository";
 //#region src/registry/assertNoTenantData.d.ts

package/dist/registry/index.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-4213U4zb.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-qq0mn2s9.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { a as cascadeDeleteForOrganization, c as assertNoTenantData, i as introspectionPlugin_default, n as buildResourceManifestFromRegistry, o as getCascadingResources, r as introspectionPlugin, s as getCascadingResourcesWithMetadata, t as buildResourceManifest } from "../registry-DqUmzA9W.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-BVr7PgA0.mjs";
 export { ResourceRegistry, assertNoTenantData, buildResourceManifest, buildResourceManifestFromRegistry, cascadeDeleteForOrganization, getCascadingResources, getCascadingResourcesWithMetadata, introspectionPlugin_default as introspectionPlugin, introspectionPlugin as introspectionPluginFn };

package/dist/{registry-4213U4zb.mjs → registry-DqUmzA9W.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "./constants-D3Dv4LAV.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "./constants-J99LGTJI.mjs";
 import fp from "fastify-plugin";
 //#region src/registry/assertNoTenantData.ts
 /**

package/dist/{renewingLease-Dll8mGgc.mjs → renewingLease-BpP9wwj7.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 //#region src/lock/renewingLease.ts
 /**
 * Start renewing an ALREADY-ACQUIRED lease. The caller performed the

package/dist/{replyHelpers-DIiZKGUt.mjs → replyHelpers-DS-P0b32.mjs}

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-CUsjNX9R.mjs";
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-BhflRrBs.mjs";
 import { toCanonicalList } from "@classytic/repo-core/pagination";
 import fp from "fastify-plugin";
 //#region src/plugins/replyHelpers.ts

package/dist/{repositoryFilter-f9eAfq_l.mjs → repositoryFilter-DotlxG3L.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { arcLog } from "./logger/index.mjs";
 import { policyRecordToFilter } from "@classytic/repo-core/filter";
 //#region src/core/repositoryFilter.ts

package/dist/{requestContext-2TxXOJ7T.mjs → requestContext-B6vQF-sy.mjs}

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.31.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.32.0 | MIT | https://classytic.com */
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/context/requestContext.ts
 /**