@classytic/arc 2.8.5 → 2.10.3

package/dist/dynamic/index.mjs

@@ -1,122 +0,0 @@
-import { t as ArcQueryParser } from "../queryParser-CgCtsjti.mjs";
-import { n as defineResource } from "../defineResource-tcgySDo1.mjs";
-import { C as publicRead, T as readOnly, b as fullPublic, v as adminOnly, w as publicReadAdminWrite, x as ownerWithAdminBypass, y as authenticated } from "../permissions-CH4cNwJi.mjs";
-//#region src/dynamic/ArcDynamicLoader.ts
-const VALID_FIELD_TYPES = new Set([
-	"string",
-	"number",
-	"boolean",
-	"date",
-	"object",
-	"array"
-]);
-function validateSchema(schema) {
-	if (!schema.app || typeof schema.app !== "string") throw new Error("AAS: 'app' name is required");
-	if (!Array.isArray(schema.resources) || schema.resources.length === 0) throw new Error("AAS: 'resources' must be a non-empty array");
-	for (const r of schema.resources) {
-		if (!r.name || typeof r.name !== "string") throw new Error("AAS: each resource must have a 'name' string");
-		if (!r.permissions) throw new Error(`AAS: resource "${r.name}" must have 'permissions'`);
-		if (r.fields) for (const [fieldName, fieldDef] of Object.entries(r.fields)) {
-			const type = typeof fieldDef === "string" ? fieldDef : fieldDef.type;
-			if (!VALID_FIELD_TYPES.has(type)) throw new Error(`AAS: resource "${r.name}" field "${fieldName}" has invalid type "${type}". Valid types: ${[...VALID_FIELD_TYPES].join(", ")}`);
-		}
-	}
-}
-/**
-* Load an Arc Architecture Schema (JSON) and produce fully configured ResourceDefinitions.
-*
-* Each resource gets:
-* - Adapter from the resolver
-* - Permissions from presets or fine-grained map
-* - schemaOptions.fieldRules for validation and MCP tool schemas
-* - ArcQueryParser with allowedFilterFields/allowedSortFields for MCP auto-derive
-* - Presets applied
-*/
-var ArcDynamicLoader = class {
-	context;
-	constructor(context) {
-		this.context = context;
-	}
-	/**
-	* Load an AAS definition and return fully constructed ResourceDefinitions.
-	* Validates the schema before processing — throws on malformed input.
-	*/
-	load(schema) {
-		validateSchema(schema);
-		return schema.resources.map((r) => {
-			const adapter = this.context.adapterResolver(r.name, r.adapterPattern);
-			const fieldRules = this.buildFieldRules(r.fields);
-			const queryParser = this.buildQueryParser(r);
-			return defineResource({
-				name: r.name,
-				displayName: r.displayName,
-				prefix: r.prefix,
-				adapter,
-				queryParser,
-				presets: r.presets,
-				permissions: this.resolvePermissions(r.permissions),
-				disabledRoutes: r.disabledRoutes,
-				tenantField: r.tenantField,
-				schemaOptions: fieldRules ? {
-					fieldRules,
-					filterableFields: r.filterable
-				} : void 0
-			});
-		});
-	}
-	buildFieldRules(fields) {
-		if (!fields) return void 0;
-		const rules = {};
-		for (const [name, def] of Object.entries(fields)) rules[name] = typeof def === "string" ? { type: def } : def;
-		return rules;
-	}
-	buildQueryParser(r) {
-		if (!r.filterable && !r.sortable) return void 0;
-		return new ArcQueryParser({
-			allowedFilterFields: r.filterable,
-			allowedSortFields: r.sortable
-		});
-	}
-	resolvePermissions(policy) {
-		if (typeof policy === "string") return this.resolvePreset(policy);
-		return this.resolveFinGrained(policy);
-	}
-	resolvePreset(preset) {
-		switch (preset) {
-			case "publicRead": return publicRead();
-			case "publicReadAdminWrite": return publicReadAdminWrite();
-			case "authenticated": return authenticated();
-			case "adminOnly": return adminOnly();
-			case "ownerWithAdminBypass": return ownerWithAdminBypass();
-			case "fullPublic": return fullPublic();
-			case "readOnly": return readOnly();
-			default:
-				if (this.context.permissionResolver) {
-					const resolved = this.context.permissionResolver(preset);
-					if (resolved) return resolved;
-				}
-				throw new Error(`Unknown permission preset: "${preset}"`);
-		}
-	}
-	resolveFinGrained(policy) {
-		const pick = (preset, op) => preset[op] ?? authenticated()[op];
-		const map = {
-			public: (op) => pick(publicRead(), op),
-			auth: (op) => pick(authenticated(), op),
-			admin: (op) => pick(adminOnly(), op),
-			owner: (op) => pick(ownerWithAdminBypass(), op)
-		};
-		const permissions = {};
-		const ops = {
-			list: policy.list,
-			get: policy.get,
-			create: policy.create,
-			update: policy.update,
-			delete: policy.delete
-		};
-		for (const [op, level] of Object.entries(ops)) if (level && map[level]) permissions[op] = map[level](op);
-		return permissions;
-	}
-};
-//#endregion
-export { ArcDynamicLoader };

package/dist/fields-DpZQa_Q3.d.mts

@@ -1,109 +0,0 @@
-//#region src/permissions/fields.d.ts
-/**
- * Field-Level Permissions
- *
- * Control field visibility and writability per role.
- * Integrated into the response path (read) and sanitization path (write).
- *
- * @example
- * ```typescript
- * import { fields, defineResource } from '@classytic/arc';
- *
- * const userResource = defineResource({
- *   name: 'user',
- *   adapter: userAdapter,
- *   fields: {
- *     salary: fields.visibleTo(['admin', 'hr']),
- *     internalNotes: fields.writableBy(['admin']),
- *     email: fields.redactFor(['viewer']),
- *     password: fields.hidden(),
- *   },
- * });
- * ```
- */
-type FieldPermissionType = "hidden" | "visibleTo" | "writableBy" | "redactFor";
-interface FieldPermission {
-  readonly _type: FieldPermissionType;
-  readonly roles?: readonly string[];
-  readonly redactValue?: unknown;
-}
-type FieldPermissionMap = Record<string, FieldPermission>;
-declare const fields: {
-  /**
-   * Field is never included in responses. Not writable via API.
-   *
-   * @example
-   * ```typescript
-   * fields: { password: fields.hidden() }
-   * ```
-   */
-  hidden(): FieldPermission;
-  /**
-   * Field is only visible to users with specified roles.
-   * Other users don't see the field at all.
-   *
-   * @example
-   * ```typescript
-   * fields: { salary: fields.visibleTo(['admin', 'hr']) }
-   * ```
-   */
-  visibleTo(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is only writable by users with specified roles.
-   * All users can still read the field. Users without the role
-   * have the field silently stripped from write operations.
-   *
-   * @example
-   * ```typescript
-   * fields: { role: fields.writableBy(['admin']) }
-   * ```
-   */
-  writableBy(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is redacted (replaced with a placeholder) for specified roles.
-   * Other users see the real value.
-   *
-   * @param roles - Roles that see the redacted value
-   * @param redactValue - Replacement value (default: '***')
-   *
-   * @example
-   * ```typescript
-   * fields: {
-   *   email: fields.redactFor(['viewer']),
-   *   ssn: fields.redactFor(['basic'], '***-**-****'),
-   * }
-   * ```
-   */
-  redactFor(roles: readonly string[], redactValue?: unknown): FieldPermission;
-};
-/**
- * Apply field-level READ permissions to a response object.
- * Strips hidden fields, enforces visibility, and applies redaction.
- *
- * @param data - The response object (mutated in place for performance)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles (empty array for unauthenticated)
- * @returns The filtered object
- */
-declare function applyFieldReadPermissions<T extends Record<string, unknown>>(data: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): T;
-/**
- * Apply field-level WRITE permissions to request body.
- * Strips fields that the user doesn't have permission to write.
- *
- * @param body - The request body (returns a new filtered copy)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles
- * @returns Filtered body
- */
-declare function applyFieldWritePermissions<T extends Record<string, unknown>>(body: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): T;
-/**
- * Resolve effective roles by merging global user roles with org-level roles.
- *
- * Global roles come from `req.user.role` (normalized via getUserRoles()).
- * Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
- *
- * When no org context exists, returns global roles only — backward compatible.
- */
-declare function resolveEffectiveRoles(userRoles: readonly string[], orgRoles: readonly string[]): string[];
-//#endregion
-export { applyFieldWritePermissions as a, applyFieldReadPermissions as i, FieldPermissionMap as n, fields as o, FieldPermissionType as r, resolveEffectiveRoles as s, FieldPermission as t };

package/dist/idempotency/mongodb.d.mts

@@ -1,2 +0,0 @@
-import { n as MongoIdempotencyStoreOptions, t as MongoIdempotencyStore } from "../mongodb-CTcp0hQZ.mjs";
-export { MongoIdempotencyStore, type MongoIdempotencyStoreOptions };

package/dist/idempotency/mongodb.mjs

@@ -1,123 +0,0 @@
-//#region src/idempotency/stores/mongodb.ts
-var MongoIdempotencyStore = class {
-	name = "mongodb";
-	connection;
-	collectionName;
-	ttlMs;
-	indexCreated = false;
-	shouldEnsureIndex;
-	logger;
-	constructor(options) {
-		this.connection = options.connection;
-		this.collectionName = options.collection ?? "arc_idempotency";
-		this.ttlMs = options.ttlMs ?? 864e5;
-		this.shouldEnsureIndex = options.createIndex !== false;
-		this.logger = options.logger ?? console;
-		if (this.shouldEnsureIndex) this.ensureIndex().catch(() => {});
-	}
-	get collection() {
-		return this.connection.db.collection(this.collectionName);
-	}
-	async ensureIndex() {
-		if (this.indexCreated) return;
-		try {
-			await this.collection.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 });
-			this.indexCreated = true;
-		} catch (err) {
-			const code = err?.code;
-			if (code === 85 || code === 86) {
-				this.indexCreated = true;
-				return;
-			}
-			this.logger.warn(`[MongoIdempotencyStore] TTL index creation failed (will retry on next write): ${err.message ?? err}`);
-		}
-	}
-	async get(key) {
-		const doc = await this.collection.findOne({ _id: key });
-		if (!doc?.result) return void 0;
-		if (new Date(doc.expiresAt) < /* @__PURE__ */ new Date()) return;
-		return {
-			key,
-			statusCode: doc.result.statusCode,
-			headers: doc.result.headers,
-			body: doc.result.body,
-			createdAt: new Date(doc.createdAt),
-			expiresAt: new Date(doc.expiresAt)
-		};
-	}
-	async set(key, result) {
-		if (this.shouldEnsureIndex && !this.indexCreated) await this.ensureIndex().catch(() => {});
-		await this.collection.updateOne({ _id: key }, {
-			$set: {
-				result: {
-					statusCode: result.statusCode,
-					headers: result.headers,
-					body: result.body
-				},
-				createdAt: result.createdAt,
-				expiresAt: result.expiresAt
-			},
-			$unset: { lock: "" }
-		}, { upsert: true });
-	}
-	async tryLock(key, requestId, ttlMs) {
-		if (this.shouldEnsureIndex && !this.indexCreated) await this.ensureIndex().catch(() => {});
-		const now = /* @__PURE__ */ new Date();
-		const expiresAt = new Date(now.getTime() + ttlMs);
-		try {
-			const result = await this.collection.updateOne({
-				_id: key,
-				$or: [{ lock: { $exists: false } }, { "lock.expiresAt": { $lt: now } }]
-			}, {
-				$set: { lock: {
-					requestId,
-					expiresAt
-				} },
-				$setOnInsert: {
-					createdAt: now,
-					expiresAt: new Date(now.getTime() + this.ttlMs)
-				}
-			}, { upsert: true });
-			return result.matchedCount === 1 || (result.upsertedCount ?? 0) === 1;
-		} catch (err) {
-			if (err?.code === 11e3) return false;
-			throw err;
-		}
-	}
-	async unlock(key, requestId) {
-		await this.collection.updateOne({
-			_id: key,
-			"lock.requestId": requestId
-		}, { $unset: { lock: "" } });
-	}
-	async isLocked(key) {
-		const doc = await this.collection.findOne({ _id: key });
-		if (!doc?.lock) return false;
-		return new Date(doc.lock.expiresAt) > /* @__PURE__ */ new Date();
-	}
-	async delete(key) {
-		await this.collection.deleteOne({ _id: key });
-	}
-	async deleteByPrefix(prefix) {
-		return (await this.collection.deleteMany({ _id: { $regex: `^${prefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}` } })).deletedCount;
-	}
-	async findByPrefix(prefix) {
-		const doc = await this.collection.findOne({
-			_id: { $regex: `^${prefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}` },
-			result: { $exists: true },
-			expiresAt: { $gt: /* @__PURE__ */ new Date() }
-		});
-		if (!doc?.result) return void 0;
-		return {
-			key: doc._id,
-			statusCode: doc.result.statusCode,
-			headers: doc.result.headers,
-			body: doc.result.body,
-			createdAt: new Date(doc.createdAt),
-			expiresAt: new Date(doc.expiresAt)
-		};
-	}
-	async close() {}
-};
-//#endregion
-export { MongoIdempotencyStore };

package/dist/interface-4y979v99.d.mts

@@ -1,54 +0,0 @@
-//#region src/cache/interface.d.ts
-/**
- * Generic Cache Store Interface
- *
- * Shared contract for reusable cache backends (memory, Redis, etc.).
- * Used by runtime systems such as dynamic permission matrices and QueryCache.
- */
-interface CacheLogger {
-  warn(message: string, ...args: unknown[]): void;
-  error(message: string, ...args: unknown[]): void;
-}
-interface CacheSetOptions {
-  /** Time-to-live in milliseconds */
-  ttlMs?: number;
-}
-interface CacheStats {
-  /** Number of entries currently stored */
-  entries: number;
-  /** Estimated memory usage in bytes (-1 if unavailable) */
-  memoryBytes: number;
-  /** Cache hit count since creation */
-  hits: number;
-  /** Cache miss count since creation */
-  misses: number;
-  /** Number of entries evicted since creation */
-  evictions: number;
-}
-interface CacheStore<TValue = unknown> {
-  /** Store name for logs/diagnostics */
-  readonly name: string;
-  /**
-   * Get cached value by key.
-   * Returns undefined when missing or expired.
-   */
-  get(key: string): Promise<TValue | undefined>;
-  /**
-   * Set a cache value.
-   * Store implementation handles TTL and eviction policy.
-   */
-  set(key: string, value: TValue, options?: CacheSetOptions): Promise<void>;
-  /**
-   * Delete a single cache key.
-   */
-  delete(key: string): Promise<void>;
-  /**
-   * Clear all keys in this store namespace.
-   * Optional because distributed stores may not support cheap global clear.
-   */
-  clear?(): Promise<void>;
-  /** Cache statistics for observability. */
-  stats?(): CacheStats;
-}
-//#endregion
-export { CacheStore as i, CacheSetOptions as n, CacheStats as r, CacheLogger as t };

package/dist/mongodb-BsP-WbhN.d.mts

@@ -1,127 +0,0 @@
-import { i as UserBase } from "./types-DZi1aYhm.mjs";
-
-//#region src/audit/stores/interface.d.ts
-type AuditAction = "create" | "update" | "delete" | "restore" | "custom";
-interface AuditEntry {
-  /** Unique audit log ID */
-  id: string;
-  /** Resource name (e.g., 'product', 'user') */
-  resource: string;
-  /** Document/entity ID */
-  documentId: string;
-  /** Action performed */
-  action: AuditAction;
-  /** User who performed the action */
-  userId?: string;
-  /** Organization context */
-  organizationId?: string;
-  /** Previous state (for updates) */
-  before?: Record<string, unknown>;
-  /** New state (for creates/updates) */
-  after?: Record<string, unknown>;
-  /** Changed fields (for updates) */
-  changes?: string[];
-  /** Request ID for tracing */
-  requestId?: string;
-  /** IP address */
-  ipAddress?: string;
-  /** User agent */
-  userAgent?: string;
-  /** Custom metadata */
-  metadata?: Record<string, unknown>;
-  /** When the action occurred */
-  timestamp: Date;
-}
-interface AuditContext {
-  user?: UserBase;
-  organizationId?: string;
-  requestId?: string;
-  ipAddress?: string;
-  userAgent?: string;
-  /** HTTP method + route pattern (e.g., 'PATCH /api/products/:id') */
-  endpoint?: string;
-  /** Request duration in milliseconds */
-  duration?: number;
-}
-interface AuditStoreOptions {
-  /** Store name for logging */
-  name: string;
-}
-/**
- * Abstract audit store interface
- */
-interface AuditStore {
-  /** Store name */
-  readonly name: string;
-  /** Log an audit entry */
-  log(entry: AuditEntry): Promise<void>;
-  /** Query audit logs (optional - not all stores support querying) */
-  query?(options: AuditQueryOptions): Promise<AuditEntry[]>;
-  /** Close/cleanup (optional) */
-  close?(): Promise<void>;
-}
-interface AuditQueryOptions {
-  resource?: string;
-  documentId?: string;
-  userId?: string;
-  organizationId?: string;
-  action?: AuditAction | AuditAction[];
-  from?: Date;
-  to?: Date;
-  limit?: number;
-  offset?: number;
-}
-/**
- * Create audit entry from context
- */
-declare function createAuditEntry(resource: string, documentId: string, action: AuditAction, context: AuditContext, data?: {
-  before?: Record<string, unknown>;
-  after?: Record<string, unknown>;
-  metadata?: Record<string, unknown>;
-}): AuditEntry;
-//#endregion
-//#region src/audit/stores/mongodb.d.ts
-interface MongoAuditStoreOptions {
-  /** MongoDB connection or mongoose instance */
-  connection: MongoConnection;
-  /** Collection name (default: 'audit_logs') */
-  collection?: string;
-  /** TTL in days (default: 90, 0 = no expiry) */
-  ttlDays?: number;
-}
-/**
- * Minimal MongoDB connection interface — DB-agnostic.
- *
- * Accepts:
- * - Native MongoDB `Db` instance (has `.collection()`)
- * - Mongoose `connection.db` (has `.collection()`)
- * - Any object with `.collection(name)` method
- *
- * For Mongoose users: pass `mongoose.connection.db`, not `mongoose.connection`.
- */
-interface MongoConnection {
-  collection: (name: string) => MongoCollection;
-}
-interface MongoCollection {
-  insertOne: (doc: Record<string, unknown>) => Promise<unknown>;
-  find: (query: Record<string, unknown>) => MongoCursor;
-  createIndex: (spec: Record<string, unknown>, options?: Record<string, unknown>) => Promise<unknown>;
-}
-interface MongoCursor {
-  sort: (spec: Record<string, unknown>) => MongoCursor;
-  skip: (n: number) => MongoCursor;
-  limit: (n: number) => MongoCursor;
-  toArray: () => Promise<Record<string, unknown>[]>;
-}
-declare class MongoAuditStore implements AuditStore {
-  readonly name = "mongodb";
-  private collection;
-  private initialized;
-  private ttlDays;
-  constructor(options: MongoAuditStoreOptions);
-  private ensureIndexes;
-  log(entry: AuditEntry): Promise<void>;
-  query(options?: AuditQueryOptions): Promise<AuditEntry[]>;
-}
-//#endregion
-export { AuditContext as a, AuditStore as c, AuditAction as i, AuditStoreOptions as l, MongoAuditStoreOptions as n, AuditEntry as o, MongoConnection as r, AuditQueryOptions as s, MongoAuditStore as t, createAuditEntry as u };

package/dist/mongodb-CTcp0hQZ.d.mts

@@ -1,80 +0,0 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DfLGcus7.mjs";
-
-//#region src/idempotency/stores/mongodb.d.ts
-interface MongoConnection {
-  db: {
-    collection(name: string): MongoCollection;
-  };
-}
-interface MongoCollection {
-  findOne(filter: object): Promise<IdempotencyDocument | null>;
-  insertOne(doc: object): Promise<{
-    acknowledged: boolean;
-  }>;
-  updateOne(filter: object, update: object, options?: object): Promise<{
-    acknowledged: boolean;
-    matchedCount: number;
-    modifiedCount: number;
-    upsertedCount?: number;
-  }>;
-  deleteOne(filter: object): Promise<{
-    deletedCount: number;
-  }>;
-  deleteMany(filter: object): Promise<{
-    deletedCount: number;
-  }>;
-  createIndex(spec: object, options?: object): Promise<string>;
-}
-interface IdempotencyDocument {
-  _id: string;
-  result?: {
-    statusCode: number;
-    headers: Record<string, string>;
-    body: unknown;
-  };
-  lock?: {
-    requestId: string;
-    expiresAt: Date;
-  };
-  createdAt: Date;
-  expiresAt: Date;
-}
-/** Minimal logger interface — compatible with console, pino, fastify.log */
-interface IdempotencyLogger {
-  warn(message: string, ...args: unknown[]): void;
-}
-interface MongoIdempotencyStoreOptions {
-  /** Mongoose connection or MongoDB connection object */
-  connection: MongoConnection;
-  /** Collection name (default: 'arc_idempotency') */
-  collection?: string;
-  /** Create TTL index on startup (default: true) */
-  createIndex?: boolean;
-  /** Default TTL in ms (default: 86400000 = 24 hours) */
-  ttlMs?: number;
-  /** Logger for operational warnings (default: console) */
-  logger?: IdempotencyLogger;
-}
-declare class MongoIdempotencyStore implements IdempotencyStore {
-  readonly name = "mongodb";
-  private connection;
-  private collectionName;
-  private ttlMs;
-  private indexCreated;
-  private shouldEnsureIndex;
-  private logger;
-  constructor(options: MongoIdempotencyStoreOptions);
-  private get collection();
-  private ensureIndex;
-  get(key: string): Promise<IdempotencyResult | undefined>;
-  set(key: string, result: Omit<IdempotencyResult, "key">): Promise<void>;
-  tryLock(key: string, requestId: string, ttlMs: number): Promise<boolean>;
-  unlock(key: string, requestId: string): Promise<void>;
-  isLocked(key: string): Promise<boolean>;
-  delete(key: string): Promise<void>;
-  deleteByPrefix(prefix: string): Promise<number>;
-  findByPrefix(prefix: string): Promise<IdempotencyResult | undefined>;
-  close(): Promise<void>;
-}
-//#endregion
-export { MongoIdempotencyStoreOptions as n, MongoIdempotencyStore as t };