@classytic/arc 2.41.1 → 2.43.0

package/dist/core/index.mjs

@@ -1,8 +1,8 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-D5Ubn1fe.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as BodySanitizer, h as nativePolicyFilter, i as SlugMixin, l as isFieldReadable, m as AccessControl, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController } from "../BaseController-CYEwjyjN.mjs";
-import { t as defineAggregation } from "../defineAggregation-D_eJjm5A.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-BoPGQ5-4.mjs";
-import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-DxkMTjRn.mjs";
-import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-5lazhva9.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { a as DEFAULT_SORT, c as DEFAULT_VERSION_FIELD, d as MAX_FILTER_DEPTH, f as MAX_REGEX_LENGTH, g as SYSTEM_FIELDS, h as RESERVED_QUERY_PARAMS, i as DEFAULT_MAX_LIMIT, l as HOOK_OPERATIONS, m as MUTATION_OPERATIONS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MAX_SEARCH_LENGTH, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as HOOK_PHASES } from "../constants-Cu7Mx7_U.mjs";
+import { S as nativePolicyFilter, b as BodySanitizer, c as BaseController, d as SlugMixin, f as BulkMixin, g as isFieldReadable, h as collectReadBlockedFields, l as TreeMixin, m as QueryResolver, o as createCrudRouter, p as BaseCrudController, s as createPermissionMiddleware, u as SoftDeleteMixin, x as AccessControl } from "../plugin-BccET1tL.mjs";
+import { t as defineAggregation } from "../defineAggregation-Bm8RjMbq.mjs";
+import { C as sendControllerResponse, S as getControllerScope, b as createRequestContext, x as getControllerContext, y as createFastifyHandler } from "../actionPermissions-BotX1YOa.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, t as getEntityId } from "../core-Cb0LjccA.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, r as formatValidationErrors, t as defineResource } from "../defineResource-DIC7JZGU.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, DEFAULT_VERSION_FIELD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, nativePolicyFilter, sendControllerResponse, validateResourceConfig };

package/dist/{core-5lazhva9.mjs → core-Cb0LjccA.mjs}

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import "./constants-D5Ubn1fe.mjs";
-import { t as defineResource } from "./defineResource-DxkMTjRn.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import "./constants-Cu7Mx7_U.mjs";
+import { t as defineResource } from "./defineResource-DIC7JZGU.mjs";
 //#region src/core/defineAction.ts
 /**
 * Build an `ActionDefinition` with a typed handler. The literal schema
@@ -19,7 +19,8 @@ function defineAction(config) {
 		schema: config.schema,
 		description: config.description,
 		id: config.id,
-		mcp: config.mcp
+		mcp: config.mcp,
+		...config.idempotency ? { idempotency: config.idempotency } : {}
 	};
 }
 //#endregion

package/dist/{createActionRouter-DNqoaK81.mjs → createActionRouter-xjqonMRO.mjs}

@@ -1,16 +1,34 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-eysyzFAF.mjs";
-import "./constants-D5Ubn1fe.mjs";
-import { f as createError } from "./errors-BH7YU_9O.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-BoPGQ5-4.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-Bsnk6NiZ.mjs";
-import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-CTvPDoPB.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+import "./constants-Cu7Mx7_U.mjs";
+import { f as createError, i as NotFoundError, u as ValidationError } from "./errors-CtrywMHP.mjs";
+import { C as sendControllerResponse, _ as buildArcDecorator, a as resolveRouterPluginMw, f as buildRouteHooks, g as buildAuthMiddlewareForPermissions, i as buildRouteConfig, l as resolvePipelineSteps, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, r as buildRateLimitConfig, s as buildActionPipelineHandler, u as buildActionPermissionMw } from "./actionPermissions-BotX1YOa.mjs";
+import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-C7Vbp71I.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 	buildActionBodySchema: () => buildActionBodySchema,
 	createActionRouter: () => createActionRouter
 });
 /**
+* Record a successful action. The actor and organization come from the request's
+* validated scope (`auditContext`); a failed write is logged, never turned into a 500
+* after the action has already happened.
+*/
+async function auditAction(req, resource, id, action) {
+	const audit = req.server.audit;
+	if (!audit?.custom || audit._noop === true) return;
+	try {
+		await audit.custom(resource, id, action, { ...req.auditMetadata ?? {} }, req.auditContext);
+	} catch (err) {
+		req.log.error({
+			err,
+			resource,
+			id,
+			action
+		}, "[arc] action audit write failed");
+	}
+}
+/**
 * Register the unified action endpoint: `POST /:id/action`.
 *
 * Shares every lifecycle primitive with the CRUD router — the preHandler
@@ -19,7 +37,8 @@ var createActionRouter_exports = /* @__PURE__ */ __exportAll({
 * (keyed by `body.action` at request time).
 */
 function createActionRouter(fastify, config) {
-	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], pipeline, rateLimit, idLessActionNames = [], extensions } = config;
+	const { tag, resourceName = tag ?? "action", actions, actionPermissions = {}, actionSchemas = {}, globalAuth, onError, fields: fieldPermissions, schemaOptions, idField = "_id", permissions: resourcePermissions, routeGuards = [], tenantMiddlewares = [], pipeline, rateLimit, idLessActionNames = [], extensions, isTargetVisible, handlerScopedActionNames = [], idempotentActionNames = [], handlerDedupOwners = {}, auditActions = false } = config;
+	const handlerScoped = new Set(handlerScopedActionNames);
 	const allActionNames = Object.keys(actions);
 	if (allActionNames.length === 0) {
 		fastify.log.warn("[createActionRouter] No actions defined, skipping route creation");
@@ -82,23 +101,26 @@ function createActionRouter(fastify, config) {
 			} },
 			required: ["id"]
 		};
+		const actionDispatchCheck = async (req, _reply) => {
+			if (!req.validationError) return;
+			const body = req.body;
+			const submitted = typeof body?.action === "string" ? body.action : void 0;
+			if (submitted && subsetSet.has(submitted)) return;
+			const wrongMount = submitted && allActionNames.includes(submitted) ? submitted : void 0;
+			const otherMount = hasId ? "/action" : "/:id/action";
+			const message = wrongMount ? `Action '${wrongMount}' on '${resourceName}' is mounted at 'POST ${otherMount}', not 'POST ${urlPath}'` : submitted ? `Unknown action '${submitted}' on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}` : `Missing 'action' field on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}`;
+			throw createError(400, message, {
+				code: "arc.invalid_action",
+				validActions: actionSubset,
+				mount: urlPath,
+				...submitted ? { submitted } : {},
+				...wrongMount ? { mountedAt: otherMount } : {}
+			});
+		};
 		const actionValidationFormatter = async (req, _reply) => {
 			const validationError = req.validationError;
 			if (!validationError) return;
-			const body = req.body;
-			const submitted = typeof body?.action === "string" ? body.action : void 0;
-			if (!submitted || !subsetSet.has(submitted)) {
-				const wrongMount = submitted && allActionNames.includes(submitted) ? submitted : void 0;
-				const otherMount = hasId ? "/action" : "/:id/action";
-				const message = wrongMount ? `Action '${wrongMount}' on '${resourceName}' is mounted at 'POST ${otherMount}', not 'POST ${urlPath}'` : submitted ? `Unknown action '${submitted}' on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}` : `Missing 'action' field on '${resourceName}'. Valid at 'POST ${urlPath}': ${actionSubset.join(", ")}`;
-				throw createError(400, message, {
-					code: "arc.invalid_action",
-					validActions: actionSubset,
-					mount: urlPath,
-					...submitted ? { submitted } : {},
-					...wrongMount ? { mountedAt: otherMount } : {}
-				});
-			}
+			const submitted = req.body.action;
 			const branchPath = `/oneOf/${actionSubset.indexOf(submitted)}/`;
 			const ajvErrors = validationError.validation ?? [];
 			const scoped = ajvErrors.filter((e) => e.keyword !== "oneOf" && (e.schemaPath?.includes(branchPath) || !e.schemaPath?.includes("/oneOf/")));
@@ -111,24 +133,30 @@ function createActionRouter(fastify, config) {
 			scopedError.meta = { action: submitted };
 			throw scopedError;
 		};
+		const requiredActions = actionSubset.filter((name) => idempotentActionNames.includes(name));
+		const handlerDedup = Object.fromEntries(requiredActions.flatMap((name) => {
+			const owner = handlerDedupOwners[name];
+			return owner === void 0 ? [] : [[name, owner]];
+		}));
 		const hooks = buildRouteHooks({
 			arcDecorator,
 			authMw,
+			prePermission: actionDispatchCheck,
 			permissionMw,
+			validationFormatter: actionValidationFormatter,
 			pluginMw: selectPluginMw("POST", pluginMw),
-			routeGuards
+			routeGuards,
+			customMws: tenantMiddlewares
 		});
-		const preHandler = [actionValidationFormatter, ...hooks.preHandler];
 		tryRegisterRoute(fastify, {
 			method: "POST",
 			url: urlPath,
 			schema: routeSchema,
-			attachValidation: true,
-			...routeHookOptions({
-				onRequest: hooks.onRequest,
-				preHandler
-			}),
-			...buildRouteConfig(rateLimitConfig, extensions),
+			...routeHookOptions(hooks),
+			...buildRouteConfig(rateLimitConfig, extensions, void 0, requiredActions.length > 0 ? {
+				requiredActions,
+				...Object.keys(handlerDedup).length > 0 ? { handlerDedup } : {}
+			} : void 0),
 			handler: async (req, reply) => {
 				const { action, ...data } = req.body;
 				const id = hasId ? req.params.id : "";
@@ -141,8 +169,10 @@ function createActionRouter(fastify, config) {
 				}
 				const handler = wrappedHandlers.get(action);
 				if (!handler) throw createError(400, `Invalid action '${action}'. Valid actions: ${actionSubset.join(", ")}`, { validActions: actionSubset });
+				if (hasId && isTargetVisible && !handlerScoped.has(action) && !await isTargetVisible(id, req)) throw new NotFoundError(resourceName);
 				try {
 					const response = await handler(id, data, req);
+					if (auditActions && (response.status ?? 200) < 400) await auditAction(req, resourceName, id, action);
 					sendControllerResponse(reply, response, req);
 					return reply;
 				} catch (error) {
@@ -150,6 +180,8 @@ function createActionRouter(fastify, config) {
 						const { statusCode, error: errorMsg, code } = onError(error, action, id);
 						throw createError(statusCode, errorMsg, code ? { code } : void 0);
 					}
+					const validation = zodIssues(error);
+					if (validation) throw new ValidationError(`Invalid '${action}' payload`, validation);
 					const err = error;
 					const statusCode = err.statusCode || err.status || 500;
 					const errorCode = err.code || "ACTION_FAILED";
@@ -190,7 +222,7 @@ function createActionRouter(fastify, config) {
 * `action: { const }` and carrying its own `required`.
 *
 * EVERY BRANCH LISTS THE FULL PROPERTY UNION — the non-obvious part. AJV's
-* `removeAdditional: 'all'` (Fastify's default) strips a field during a
+* `removeAdditional` (Fastify's default strips) strips a field during a
 * branch's evaluation when that branch's `properties` omits it, EVEN IF
 * another branch would have allowed it. The strip mutates the body before
 * `oneOf` finishes discriminating, so the winning branch receives a body that
@@ -199,11 +231,10 @@ function createActionRouter(fastify, config) {
 * every branch makes each walk see every field as its own, so nothing is
 * stripped; `required` stays per-action, so dispatch still gates correctly.
 *
-* Per-branch `additionalProperties: false` survives but cannot reject
-* sibling-action fields under host `removeAdditional: 'all'` — those strip at
-* top level instead. That is the host's opt-in; arc's job is only to stop
-* losing an action's OWN declared fields. Under arc's `createApp`
-* (`removeAdditional: false`) strict rejection works normally.
+* Arc compiles this route with its own validator (`removeAdditional: false`, see
+* `./routeValidator.ts`), whatever the host's AJV says — so per-branch
+* `additionalProperties: false` rejects unknown fields on every host. The full
+* property union stays because a host-supplied `validatorCompiler` may still strip.
 *
 * Pinned by `tests/core/action-discriminator-strip.test.ts` and
 * `action-strict-schema-parity.test.ts`. Exported so OpenAPI and MCP tool
@@ -211,6 +242,7 @@ function createActionRouter(fastify, config) {
 */
 function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 	const unionProperties = {};
+	const conflicting = /* @__PURE__ */ new Set();
 	const irs = [];
 	for (const actionName of actionEnum) {
 		const ir = normalizeSchemaIR(actionSchemas[actionName]);
@@ -218,13 +250,19 @@ function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 			name: actionName,
 			ir
 		});
-		for (const [key, val] of Object.entries(ir.properties)) unionProperties[key] = val;
+		for (const [key, val] of Object.entries(ir.properties)) {
+			const prior = unionProperties[key];
+			if (prior !== void 0 && JSON.stringify(prior) !== JSON.stringify(val)) conflicting.add(key);
+			unionProperties[key] = val;
+		}
 	}
+	const topLevelProperties = { ...unionProperties };
+	for (const key of conflicting) topLevelProperties[key] = {};
 	const branches = [];
 	for (const { name, ir } of irs) branches.push(schemaIRToJsonSchemaBranch({
 		...ir,
 		properties: {
-			...unionProperties,
+			...topLevelProperties,
 			...ir.properties
 		}
 	}, {
@@ -242,7 +280,7 @@ function buildActionBodySchema(actionEnum, actionSchemas = {}) {
 				type: "string",
 				enum: [...actionEnum]
 			},
-			...unionProperties
+			...topLevelProperties
 		},
 		oneOf: branches
 	};
@@ -261,5 +299,15 @@ function buildActionDescription(actions, actionPermissions) {
 	}
 	return lines.join("\n");
 }
+/** A ZodError's issues as `{ field, message }`, or `undefined` for any other error. */
+function zodIssues(error) {
+	if (!(error instanceof Error) || error.name !== "ZodError" || !("issues" in error)) return void 0;
+	const issues = error.issues;
+	if (!Array.isArray(issues)) return void 0;
+	return issues.map((issue) => ({
+		field: Array.isArray(issue.path) ? issue.path.map(String).join(".") || "(payload)" : "(payload)",
+		message: typeof issue.message === "string" ? issue.message : "invalid"
+	}));
+}
 //#endregion
 export { createActionRouter_exports as n, buildActionBodySchema as t };

package/dist/{createAggregationRouter-BcbQJf10.mjs → createAggregationRouter-zRYWw_5D.mjs}

@@ -1,10 +1,10 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { n as evaluateAndApplyPermission } from "./authorizationDecision-DawKGoXb.mjs";
-import { f as createError } from "./errors-BH7YU_9O.mjs";
-import { u as getRequestScope } from "./types-CgenB1gv.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-Bsnk6NiZ.mjs";
-import { n as validateAggregations } from "./validate-DrYWnOzI.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-CvxKOc0m.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { f as createError } from "./errors-CtrywMHP.mjs";
+import { u as getRequestScope } from "./types-Bk9NOgOC.mjs";
+import { _ as buildArcDecorator, a as resolveRouterPluginMw, f as buildRouteHooks, h as buildAuthMiddleware, m as routeHookOptions, n as tryRegisterRoute, o as selectPluginMw, r as buildRateLimitConfig } from "./actionPermissions-BotX1YOa.mjs";
+import { n as evaluateAndApplyPermission } from "./authorizationDecision-DQYrkl5f.mjs";
+import { n as validateAggregations } from "./validate-9yzHC1e2.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-CRQ8EcX5.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is
@@ -68,7 +68,7 @@ function registerOne(fastify, normalized, ctx) {
 		summary: config.summary ?? `Aggregation: ${name}`,
 		description: config.description ?? "Portable aggregation generated by arc. Filters from query string compose with the declaration's base filter + tenant scope."
 	};
-	fastify.route({
+	tryRegisterRoute(fastify, {
 		method: "GET",
 		url: `/aggregations/${name}`,
 		schema: routeSchema,
@@ -86,6 +86,9 @@ function registerOne(fastify, normalized, ctx) {
 				throw createError(500, `Aggregation "${name}" failed: ${message}`);
 			}
 		}
+	}, {
+		resourceName: tag ?? name,
+		op: `aggregation:${name}`
 	});
 }
 /**