@classytic/arc 2.9.1 → 2.10.3

package/dist/dynamic/index.mjs

@@ -1,122 +0,0 @@
-import { t as ArcQueryParser } from "../queryParser-Cs-6SHQK.mjs";
-import { n as defineResource } from "../defineResource-C__jkwvs.mjs";
-import { C as publicRead, T as readOnly, b as fullPublic, v as adminOnly, w as publicReadAdminWrite, x as ownerWithAdminBypass, y as authenticated } from "../permissions-oNZawnkR.mjs";
-//#region src/dynamic/ArcDynamicLoader.ts
-const VALID_FIELD_TYPES = new Set([
-	"string",
-	"number",
-	"boolean",
-	"date",
-	"object",
-	"array"
-]);
-function validateSchema(schema) {
-	if (!schema.app || typeof schema.app !== "string") throw new Error("AAS: 'app' name is required");
-	if (!Array.isArray(schema.resources) || schema.resources.length === 0) throw new Error("AAS: 'resources' must be a non-empty array");
-	for (const r of schema.resources) {
-		if (!r.name || typeof r.name !== "string") throw new Error("AAS: each resource must have a 'name' string");
-		if (!r.permissions) throw new Error(`AAS: resource "${r.name}" must have 'permissions'`);
-		if (r.fields) for (const [fieldName, fieldDef] of Object.entries(r.fields)) {
-			const type = typeof fieldDef === "string" ? fieldDef : fieldDef.type;
-			if (!VALID_FIELD_TYPES.has(type)) throw new Error(`AAS: resource "${r.name}" field "${fieldName}" has invalid type "${type}". Valid types: ${[...VALID_FIELD_TYPES].join(", ")}`);
-		}
-	}
-}
-/**
-* Load an Arc Architecture Schema (JSON) and produce fully configured ResourceDefinitions.
-*
-* Each resource gets:
-* - Adapter from the resolver
-* - Permissions from presets or fine-grained map
-* - schemaOptions.fieldRules for validation and MCP tool schemas
-* - ArcQueryParser with allowedFilterFields/allowedSortFields for MCP auto-derive
-* - Presets applied
-*/
-var ArcDynamicLoader = class {
-	context;
-	constructor(context) {
-		this.context = context;
-	}
-	/**
-	* Load an AAS definition and return fully constructed ResourceDefinitions.
-	* Validates the schema before processing — throws on malformed input.
-	*/
-	load(schema) {
-		validateSchema(schema);
-		return schema.resources.map((r) => {
-			const adapter = this.context.adapterResolver(r.name, r.adapterPattern);
-			const fieldRules = this.buildFieldRules(r.fields);
-			const queryParser = this.buildQueryParser(r);
-			return defineResource({
-				name: r.name,
-				displayName: r.displayName,
-				prefix: r.prefix,
-				adapter,
-				queryParser,
-				presets: r.presets,
-				permissions: this.resolvePermissions(r.permissions),
-				disabledRoutes: r.disabledRoutes,
-				tenantField: r.tenantField,
-				schemaOptions: fieldRules ? {
-					fieldRules,
-					filterableFields: r.filterable
-				} : void 0
-			});
-		});
-	}
-	buildFieldRules(fields) {
-		if (!fields) return void 0;
-		const rules = {};
-		for (const [name, def] of Object.entries(fields)) rules[name] = typeof def === "string" ? { type: def } : def;
-		return rules;
-	}
-	buildQueryParser(r) {
-		if (!r.filterable && !r.sortable) return void 0;
-		return new ArcQueryParser({
-			allowedFilterFields: r.filterable,
-			allowedSortFields: r.sortable
-		});
-	}
-	resolvePermissions(policy) {
-		if (typeof policy === "string") return this.resolvePreset(policy);
-		return this.resolveFinGrained(policy);
-	}
-	resolvePreset(preset) {
-		switch (preset) {
-			case "publicRead": return publicRead();
-			case "publicReadAdminWrite": return publicReadAdminWrite();
-			case "authenticated": return authenticated();
-			case "adminOnly": return adminOnly();
-			case "ownerWithAdminBypass": return ownerWithAdminBypass();
-			case "fullPublic": return fullPublic();
-			case "readOnly": return readOnly();
-			default:
-				if (this.context.permissionResolver) {
-					const resolved = this.context.permissionResolver(preset);
-					if (resolved) return resolved;
-				}
-				throw new Error(`Unknown permission preset: "${preset}"`);
-		}
-	}
-	resolveFinGrained(policy) {
-		const pick = (preset, op) => preset[op] ?? authenticated()[op];
-		const map = {
-			public: (op) => pick(publicRead(), op),
-			auth: (op) => pick(authenticated(), op),
-			admin: (op) => pick(adminOnly(), op),
-			owner: (op) => pick(ownerWithAdminBypass(), op)
-		};
-		const permissions = {};
-		const ops = {
-			list: policy.list,
-			get: policy.get,
-			create: policy.create,
-			update: policy.update,
-			delete: policy.delete
-		};
-		for (const [op, level] of Object.entries(ops)) if (level && map[level]) permissions[op] = map[level](op);
-		return permissions;
-	}
-};
-//#endregion
-export { ArcDynamicLoader };

package/dist/fields-BC7zcmI9.d.mts

@@ -1,121 +0,0 @@
-//#region src/permissions/fields.d.ts
-/**
- * Field-Level Permissions
- *
- * Control field visibility and writability per role.
- * Integrated into the response path (read) and sanitization path (write).
- *
- * @example
- * ```typescript
- * import { fields, defineResource } from '@classytic/arc';
- *
- * const userResource = defineResource({
- *   name: 'user',
- *   adapter: userAdapter,
- *   fields: {
- *     salary: fields.visibleTo(['admin', 'hr']),
- *     internalNotes: fields.writableBy(['admin']),
- *     email: fields.redactFor(['viewer']),
- *     password: fields.hidden(),
- *   },
- * });
- * ```
- */
-type FieldPermissionType = "hidden" | "visibleTo" | "writableBy" | "redactFor";
-interface FieldPermission {
-  readonly _type: FieldPermissionType;
-  readonly roles?: readonly string[];
-  readonly redactValue?: unknown;
-}
-type FieldPermissionMap = Record<string, FieldPermission>;
-declare const fields: {
-  /**
-   * Field is never included in responses. Not writable via API.
-   *
-   * @example
-   * ```typescript
-   * fields: { password: fields.hidden() }
-   * ```
-   */
-  hidden(): FieldPermission;
-  /**
-   * Field is only visible to users with specified roles.
-   * Other users don't see the field at all.
-   *
-   * @example
-   * ```typescript
-   * fields: { salary: fields.visibleTo(['admin', 'hr']) }
-   * ```
-   */
-  visibleTo(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is only writable by users with specified roles.
-   * All users can still read the field. Users without the role
-   * have the field silently stripped from write operations.
-   *
-   * @example
-   * ```typescript
-   * fields: { role: fields.writableBy(['admin']) }
-   * ```
-   */
-  writableBy(roles: readonly string[]): FieldPermission;
-  /**
-   * Field is redacted (replaced with a placeholder) for specified roles.
-   * Other users see the real value.
-   *
-   * @param roles - Roles that see the redacted value
-   * @param redactValue - Replacement value (default: '***')
-   *
-   * @example
-   * ```typescript
-   * fields: {
-   *   email: fields.redactFor(['viewer']),
-   *   ssn: fields.redactFor(['basic'], '***-**-****'),
-   * }
-   * ```
-   */
-  redactFor(roles: readonly string[], redactValue?: unknown): FieldPermission;
-};
-/**
- * Apply field-level READ permissions to a response object.
- * Strips hidden fields, enforces visibility, and applies redaction.
- *
- * @param data - The response object (mutated in place for performance)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles (empty array for unauthenticated)
- * @returns The filtered object
- */
-declare function applyFieldReadPermissions<T extends Record<string, unknown>>(data: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): T;
-/**
- * Result of applying write permissions — includes both the filtered body
- * and the list of fields that were stripped so callers can decide whether
- * to reject the request (secure default) or silently strip (legacy).
- */
-interface FieldWritePermissionResult<T extends Record<string, unknown>> {
-  readonly body: T;
-  readonly deniedFields: readonly string[];
-}
-/**
- * Apply field-level WRITE permissions to request body.
- *
- * Returns both the filtered body and the list of denied fields. Callers are
- * expected to reject the request when `deniedFields.length > 0` — silently
- * stripping fields hides misconfigurations and real attacks. See
- * `BodySanitizer` for the default policy.
- *
- * @param body - The request body (returns a new filtered copy)
- * @param fieldPermissions - Field permission map from resource config
- * @param userRoles - Current user's roles
- */
-declare function applyFieldWritePermissions<T extends Record<string, unknown>>(body: T, fieldPermissions: FieldPermissionMap, userRoles: readonly string[]): FieldWritePermissionResult<T>;
-/**
- * Resolve effective roles by merging global user roles with org-level roles.
- *
- * Global roles come from `req.user.role` (normalized via getUserRoles()).
- * Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
- *
- * When no org context exists, returns global roles only — backward compatible.
- */
-declare function resolveEffectiveRoles(userRoles: readonly string[], orgRoles: readonly string[]): string[];
-//#endregion
-export { applyFieldWritePermissions as a, applyFieldReadPermissions as i, FieldPermissionMap as n, fields as o, FieldPermissionType as r, resolveEffectiveRoles as s, FieldPermission as t };

package/dist/interface-DplgQO2e.d.mts

@@ -1,54 +0,0 @@
-//#region src/cache/interface.d.ts
-/**
- * Generic Cache Store Interface
- *
- * Shared contract for reusable cache backends (memory, Redis, etc.).
- * Used by runtime systems such as dynamic permission matrices and QueryCache.
- */
-interface CacheLogger {
-  warn(message: string, ...args: unknown[]): void;
-  error(message: string, ...args: unknown[]): void;
-}
-interface CacheSetOptions {
-  /** Time-to-live in milliseconds */
-  ttlMs?: number;
-}
-interface CacheStats {
-  /** Number of entries currently stored */
-  entries: number;
-  /** Estimated memory usage in bytes (-1 if unavailable) */
-  memoryBytes: number;
-  /** Cache hit count since creation */
-  hits: number;
-  /** Cache miss count since creation */
-  misses: number;
-  /** Number of entries evicted since creation */
-  evictions: number;
-}
-interface CacheStore<TValue = unknown> {
-  /** Store name for logs/diagnostics */
-  readonly name: string;
-  /**
-   * Get cached value by key.
-   * Returns undefined when missing or expired.
-   */
-  get(key: string): Promise<TValue | undefined>;
-  /**
-   * Set a cache value.
-   * Store implementation handles TTL and eviction policy.
-   */
-  set(key: string, value: TValue, options?: CacheSetOptions): Promise<void>;
-  /**
-   * Delete a single cache key.
-   */
-  delete(key: string): Promise<void>;
-  /**
-   * Clear all keys in this store namespace.
-   * Optional because distributed stores may not support cheap global clear.
-   */
-  clear?(): Promise<void>;
-  /** Cache statistics for observability. */
-  stats?(): CacheStats;
-}
-//#endregion
-export { CacheStore as i, CacheSetOptions as n, CacheStats as r, CacheLogger as t };