@classytic/arc 2.34.0 → 2.35.0

package/dist/actionPermissions-CUeCmpUd.mjs

@@ -1,25 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/core/actionPermissions.ts
-/**
-* Return the effective `PermissionCheck` for a single action, or `undefined`
-* when the resource declares no gate at any level.
-*
-* Callers decide what "no gate" means:
-*   - HTTP: boot-time throw in `normalizeActionsToRouterConfig`.
-*   - MCP: tool-generation throw in `resourceToTools` (mirrors HTTP — the
-*     two surfaces fail closed identically so MCP can't expose an
-*     unauthenticated mutating tool when the HTTP plugin lifecycle hasn't
-*     run).
-*   - OpenAPI: docs advertise the endpoint as unauthenticated.
-*/
-function resolveActionPermission(input) {
-	const { action, resourcePermissions, resourceActionPermissions, globalAuth } = input;
-	const explicit = typeof action !== "function" && action.permissions ? action.permissions : void 0;
-	if (explicit) return explicit;
-	if (resourceActionPermissions) return resourceActionPermissions;
-	if (globalAuth) return globalAuth;
-	const updateFallback = resourcePermissions?.update;
-	if (updateFallback) return updateFallback;
-}
-//#endregion
-export { resolveActionPermission as t };

package/dist/defineAggregation-Nv-DwfOf.mjs

@@ -1,48 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/core/aggregation/defineAggregation.ts
-/**
-* Declare a single resource aggregation. Exported configs flow into
-* `defineResource({ aggregations: { ... } })` either as named keys or
-* via auto-discovery patterns (loadAggregations — future).
-*
-* @example Inline
-* ```ts
-* defineResource({
-*   name: 'order',
-*   aggregations: {
-*     revenueByStatus: defineAggregation({
-*       groupBy: 'status',
-*       measures: { count: 'count', revenue: 'sum:totalPrice' },
-*       permissions: requireRoles(['admin']),
-*     }),
-*   },
-* });
-* ```
-*
-* @example Multi-file
-* ```ts
-* // orders/aggregations/revenue-by-status.ts
-* import { defineAggregation } from '@classytic/arc';
-*
-* export const revenueByStatus = defineAggregation({
-*   groupBy: 'status',
-*   measures: { count: 'count', revenue: 'sum:totalPrice' },
-*   permissions: requireRoles(['admin']),
-*   timeout: 5000,
-*   cache: { staleTime: 60 },
-* });
-*
-* // orders/order.resource.ts
-* import * as aggregations from './aggregations/index.js';
-*
-* defineResource({
-*   name: 'order',
-*   aggregations,                                  // 30+ entries flow in
-* });
-* ```
-*/
-function defineAggregation(config) {
-	return config;
-}
-//#endregion
-export { defineAggregation as t };

package/dist/preloadResources-BkyqeTDz.mjs

@@ -1,46 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/factory/preloadResources.ts
-/**
-* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
-*
-* Accepts either:
-* - `{ import: 'default' }` form: values are the resource directly
-* - default form: values are the full module — picks first export with `toPlugin()`
-*
-* Throws if any module doesn't yield a valid `ResourceLike`.
-*/
-function preloadResources(globResult) {
-	const resources = [];
-	for (const [path, value] of Object.entries(globResult)) {
-		const resource = pickResource(value);
-		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		resources.push(resource);
-	}
-	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-/**
-* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
-*
-* Use this when resources depend on prior bootstrap (e.g., engine init) and
-* cannot be evaluated at import time of the preload file.
-*/
-async function preloadResourcesAsync(globResult) {
-	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
-		const resource = pickResource(await loader());
-		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		return resource;
-	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-function pickResource(value) {
-	if (!value || typeof value !== "object") return void 0;
-	if (typeof value.toPlugin === "function") return value;
-	const mod = value;
-	const candidates = [
-		mod.default,
-		mod.resource,
-		...Object.values(mod)
-	];
-	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
-}
-//#endregion
-export { preloadResourcesAsync as n, preloadResources as t };

package/dist/registerRoute-Ba8v0PCa.mjs

@@ -1,113 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-CMMLWmuZ.mjs";
-import { f as createError } from "./errors-Cd_yy7aW.mjs";
-import { u as getRequestScope } from "./types-CoqIRrkY.mjs";
-//#region src/core/middlewares/permissions.ts
-/**
-* Build a PermissionContext from a Fastify request. Extracted so the CRUD
-* permission middleware and the dynamic action-permission check use the same
-* field layout — divergence here silently broke policy filters for actions.
-*/
-function buildPermissionContext(req, opts) {
-	const reqWithExtras = req;
-	const params = req.params;
-	return {
-		user: reqWithExtras.user ?? null,
-		scope: getRequestScope(req),
-		request: req,
-		resource: opts.resource,
-		action: opts.action,
-		resourceId: opts.resourceId ?? params?.id,
-		params,
-		data: opts.data ?? req.body
-	};
-}
-/**
-* Static per-route CRUD permission gate. The permission and action are known
-* at route-registration time, so the gate is a plain preHandler.
-*
-* Actions use the dynamic counterpart `buildActionPermissionMw` — their
-* permission is resolved from `body.action` at request time.
-*/
-function buildCrudPermissionMw(permissionCheck, resourceName, action) {
-	if (!permissionCheck) return null;
-	return async (req, reply) => {
-		const context = buildPermissionContext(req, {
-			resource: resourceName,
-			action
-		});
-		await evaluateAndApplyPermission(permissionCheck, context, req, reply);
-	};
-}
-/**
-* Dynamic per-action permission gate for the action router.
-*
-* Resolves the permission from `body.action` at request time and runs
-* `evaluateAndApplyPermission` from the canonical `permissionMw` slot — so
-* `_policyFilters` and `request.scope` are installed BEFORE `pluginMw`
-* (idempotency) and `routeGuards` run. Previously this check lived inside
-* the main action handler, which meant idempotency recorded unauthorized
-* requests and route guards saw unfiltered scope — the very divergence
-* routerShared exists to prevent.
-*
-* Also acts as a defensive fallback for invalid action names — the
-* `oneOf` body schema normally rejects these at AJV validation, but
-* hosts that disable schema validation still get a 400 here.
-*/
-function buildActionPermissionMw(actionEnum, actionPermissions, globalAuth, resourceName) {
-	const enumSet = new Set(actionEnum);
-	const validActions = [...actionEnum];
-	return async (req, reply) => {
-		const body = req.body ?? {};
-		const action = body.action;
-		if (!action || !enumSet.has(action)) throw createError(400, `Invalid action '${action ?? ""}'. Valid actions: ${validActions.join(", ")}`, { validActions });
-		const permissionCheck = actionPermissions[action] ?? globalAuth;
-		if (!permissionCheck) return;
-		const { action: _discard, ...data } = body;
-		const params = req.params;
-		const context = buildPermissionContext(req, {
-			resource: resourceName,
-			action,
-			resourceId: params?.id,
-			data
-		});
-		await evaluateAndApplyPermission(permissionCheck, context, req, reply, { defaultDenialMessage: (user) => user ? `Permission denied for '${action}'` : "Authentication required" });
-	};
-}
-//#endregion
-//#region src/core/middlewares/registerRoute.ts
-/**
-* Register a route with friendly handling of `FST_ERR_DUPLICATED_ROUTE`.
-*
-* Boot-time `validateRouteCrudCollisions()` catches custom-route → auto-CRUD
-* overlaps before Fastify ever runs, but a few cases still slip through to
-* Fastify itself: two presets contributing the same `routes` entry, hosts
-* mounting two resources at the same prefix, custom routes that share a
-* URL with another plugin. Fastify's default message ("Method 'GET'
-* already declared for route '/'") gives no hint at the resource-shaped
-* fix — `disabledRoutes: ['list']` — so wrap it with one.
-*/
-function tryRegisterRoute(fastify, opts, context) {
-	try {
-		fastify.route(opts);
-	} catch (err) {
-		const fastifyErr = err;
-		if (fastifyErr?.code !== "FST_ERR_DUPLICATED_ROUTE") throw err;
-		const method = opts.method;
-		const url = opts.url;
-		const opHint = context.op ? ` (op: ${context.op})` : "";
-		const fixHint = context.op && [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		].includes(context.op) ? ` Suppress the auto-CRUD route with \`disabledRoutes: ['${context.op}']\`.` : " If a custom route in `routes:` collides with auto-CRUD, add `disabledRoutes: ['list' | 'get' | 'create' | 'update' | 'delete']` to `defineResource()` to suppress the matching auto-CRUD route.";
-		const enhanced = /* @__PURE__ */ new Error(`[arc] Duplicate route ${method} ${url} on resource "${context.resourceName}"${opHint}.${fixHint} Original: ${fastifyErr.message ?? "FST_ERR_DUPLICATED_ROUTE"}`);
-		enhanced.code = "FST_ERR_DUPLICATED_ROUTE";
-		enhanced.cause = err;
-		throw enhanced;
-	}
-}
-//#endregion
-export { buildActionPermissionMw as n, buildCrudPermissionMw as r, tryRegisterRoute as t };

package/dist/repositoryFilter-BANpz6BX.mjs

@@ -1,78 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-import { arcLog } from "./logger/index.mjs";
-import { policyRecordToFilter } from "@classytic/repo-core/filter";
-//#region src/core/repositoryFilter.ts
-const NATIVE_FILTER_DIALECT = Symbol.for("@classytic/arc/native-filter-dialect");
-/**
-* Mark a server-owned policy as intentionally adapter-native. This is an
-* explicit escape hatch for semantics absent from repo-core's universal IR
-* (for example MongoDB `$elemMatch`). Never apply it to client input.
-*/
-function nativePolicyFilter(dialect, record) {
-	return Object.freeze({
-		...record,
-		[NATIVE_FILTER_DIALECT]: dialect
-	});
-}
-function nativeDialects(value, found = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value !== "object") return found;
-	const dialect = value[NATIVE_FILTER_DIALECT];
-	if (typeof dialect === "string") found.add(dialect);
-	if (Array.isArray(value)) for (const entry of value) nativeDialects(entry, found);
-	else for (const entry of Object.values(value)) nativeDialects(entry, found);
-	return found;
-}
-function stripNativeMarkers(value) {
-	if (Array.isArray(value)) return value.map(stripNativeMarkers);
-	if (value === null || typeof value !== "object" || value instanceof Date) return value;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) out[key] = stripNativeMarkers(entry);
-	return out;
-}
-const log = arcLog("repository-filter");
-let warnedUnconvertible = false;
-/** True for a `{ $op: ... }` operator object (all keys `$`-prefixed). */
-function isOperatorObject(value) {
-	if (value === null || typeof value !== "object") return false;
-	if (Array.isArray(value) || value instanceof Date) return false;
-	const keys = Object.keys(value);
-	return keys.length > 0 && keys.some((k) => k.startsWith("$"));
-}
-/**
-* Does this compound filter contain any `$`-operator (top-level logical like
-* `$and`/`$or`, or a field operator object like `{ $in: [...] }`)? If not, it is
-* pure flat equality and portable as-is.
-*/
-function filterHasDollarOperator(record) {
-	for (const [key, value] of Object.entries(record)) {
-		if (key.startsWith("$")) return true;
-		if (isOperatorObject(value)) return true;
-	}
-	return false;
-}
-/**
-* Normalize a compound query/policy filter for the repository layer. Flat
-* equality records pass through unchanged; anything carrying `$`-operators is
-* converted to repo-core {@link Filter} IR so semantics stay explicit. Common
-* operators compile identically across kits; capability-specific operators
-* such as array-element matching fail loudly on adapters that cannot model them.
-*/
-function toRepositoryFilter(record) {
-	const dialects = nativeDialects(record);
-	if (dialects.size > 0) {
-		if (dialects.size > 1) throw new Error(`Cannot compose native policy-filter dialects: ${[...dialects].sort().join(", ")}`);
-		return stripNativeMarkers(record);
-	}
-	if (!filterHasDollarOperator(record)) return record;
-	try {
-		return policyRecordToFilter(record);
-	} catch (err) {
-		if (!warnedUnconvertible) {
-			warnedUnconvertible = true;
-			log.warn(`A \`\$\`-operator filter could not be normalized to portable Filter IR (operator outside arc's policy dialect). Passing the raw record to the repository — MongoKit handles it; non-Mongo kits may not. (${err instanceof Error ? err.message : String(err)})`);
-		}
-		return record;
-	}
-}
-//#endregion
-export { toRepositoryFilter as n, nativePolicyFilter as t };

package/dist/simpleEqualityMatcher-Se8VrsaP.mjs

@@ -1,69 +0,0 @@
-/*! @classytic/arc v2.34.0 | MIT | https://classytic.com */
-//#region src/utils/simpleEqualityMatcher.ts
-/**
-* `simpleEqualityMatcher` — a minimal, dialect-agnostic flat-key equality
-* matcher for `DataAdapter.matchesFilter` / `BaseController({ matchesFilter })`.
-*
-* **What it does:** for each `[key, expected]` in the filter, compares
-* `item[key]` to `expected` via string coercion (so Mongo `ObjectId` values
-* match their string representation) and returns `true` only if every
-* filter entry matches. Array item values are matched implicitly (contains).
-*
-* **What it does NOT do:**
-* - No `$eq` / `$ne` / `$in` / `$nin` / `$gt` / `$lt` / `$regex` / `$exists`
-* - No `$and` / `$or`
-* - No dot-path traversal (`"owner.id"`)
-* - No schema-specific coercion
-*
-* **Why it exists:** 95%+ of arc's `_policyFilters` are produced by built-in
-* permission helpers and are shaped like `{ ownerId: "u1" }` or
-* `{ organizationId: "org_x" }` — flat equality. For that common shape,
-* this helper is a safe, tested, 15-line defense-in-depth matcher that
-* hosts using minimal repos (no `getOne(compoundFilter)` DB path) can opt
-* into without arc shipping a full Mongo-syntax engine.
-*
-* **When to use:**
-* - Your adapter/repo doesn't natively filter on `getOne(compoundFilter)`
-* - Your `_policyFilters` are flat equality (from arc's built-in permission helpers)
-* - You want defense-in-depth on `validateItemAccess` / `fetchDetailed`'s `getById` fallback
-*
-* **When NOT to use:**
-* - Your `_policyFilters` use operators (`$in`, `$ne`, etc.) — supply a
-*   native matcher (mongokit's repo does the filter at the DB layer; for
-*   custom repos, wrap the kit's own predicate engine).
-* - You're a mongokit / sqlitekit / Prisma user — the DB-level filter
-*   applied by `getOne(compoundFilter)` already covers this.
-*
-* @example
-* ```ts
-* import { simpleEqualityMatcher } from '@classytic/arc/utils';
-*
-* // On a custom adapter
-* const adapter: DataAdapter = {
-*   repository,
-*   type: 'custom',
-*   name: 'in-memory',
-*   matchesFilter: simpleEqualityMatcher,
-* };
-*
-* // Or directly on BaseController for ad-hoc controllers
-* new BaseController(repo, { matchesFilter: simpleEqualityMatcher });
-* ```
-*/
-function simpleEqualityMatcher(item, filters) {
-	if (!item || typeof item !== "object") return false;
-	const obj = item;
-	for (const [key, expected] of Object.entries(filters)) {
-		if (expected && typeof expected === "object" && !Array.isArray(expected) && Object.getPrototypeOf(expected) === Object.prototype && Object.keys(expected).some((k) => k.startsWith("$"))) return false;
-		const actual = obj[key];
-		if (Array.isArray(actual)) {
-			const expectedStr = String(expected);
-			if (!actual.some((v) => String(v) === expectedStr)) return false;
-			continue;
-		}
-		if (String(actual) !== String(expected)) return false;
-	}
-	return true;
-}
-//#endregion
-export { simpleEqualityMatcher as t };