@90soft/parse-server-kit 2.5.3 → 2.8.0

package/dist/transactions/ambientSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ambientSession.js","sourceRoot":"","sources":["../../src/transactions/ambientSession.ts"],"names":[],"mappings":";;;AA8DA,gDA6BC;AA3FD,uCAAyC;AAEzC;;;;;;;;;;;;;;;GAeG;AACU,QAAA,gBAAgB,GAAqC;IAChE,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;IACX,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,CAAC;IACZ,cAAc,EAAE,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,SAAS;IACT,cAAc;IACd,QAAQ;IACR,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAA6B,GAAM;IACnE,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;QACpB,GAAG,CAAC,MAAM,EAAE,QAAQ;YAClB,MAAM,YAAY,GAAG,wBAAgB,CAAC,QAAkB,CAAC,CAAC;YAE1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAkB,CAAC,CAAC;gBACzC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClE,CAAC;YAED,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,OAAO,GAAG,IAAA,wBAAc,GAAE,CAAC;gBACjC,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG;wBACd,GAAG,CAAE,IAAI,CAAC,YAAY,CAA6B,IAAI,EAAE,CAAC;qBAC3D,CAAC;oBACF,OAAO,CAAC,OAAO,KAAf,OAAO,CAAC,OAAO,GAAK,OAAO,EAAC;oBAC5B,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;wBAChC,kEAAkE;wBAClE,OAAO,OAAO,CAAC,cAAc,CAAC;oBAChC,CAAC;oBACD,IAAI,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;gBAC/B,CAAC;gBACD,OAAQ,MAAM,CAAC,QAAkB,CAAkC,CACjE,GAAG,IAAI,CACR,CAAC;YACJ,CAAC,CAAC;QACJ,CAAC;KACF,CAAM,CAAC;AACV,CAAC"}

package/dist/transactions/context.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Transactions that follow the call, not the request.
+ *
+ * Parse Server has a transaction of its own, but it keeps the open session in a
+ * single field on the shared `DatabaseController`, and every write in the
+ * process passes that field to the adapter. One cloud function's transaction
+ * therefore swallows every *unrelated* request running at the same moment, and
+ * two of them collide outright.
+ *
+ * This one lives in an `AsyncLocalStorage` instead. The store follows the chain
+ * of awaits belonging to one call and nothing else, so two callers each get
+ * their own session and neither can see the other's. The database adapter reads
+ * it at the moment it talks to the driver — see `ambientSession.ts` — which is
+ * why a save inside the body joins without being told to.
+ *
+ * **This needs Parse Server's `directAccess`.** With it, a `save()` in cloud
+ * code is handled in the same async context; without it the SDK sends itself an
+ * HTTP request, which arrives in a fresh context with an empty store and writes
+ * outside the transaction. `directAccess` defaults to true and the config pins
+ * it, because that failure has no symptom.
+ *
+ * And it needs MongoDB to be a replica set. A standalone has no transactions
+ * and refuses to open one.
+ */
+/**
+ * One code for every "somebody else got there first".
+ *
+ * A lost optimistic lock and a transaction that lost its race are the same
+ * event to whoever is looking at the screen, so they read the same. Parse has
+ * no code of its own for a write conflict and every code it does have means
+ * something else.
+ */
+type ParseErrorCode = ConstructorParameters<typeof Parse.Error>[0];
+export declare const CONFLICT: ParseErrorCode;
+export declare const CONFLICT_MESSAGE = "Somebody else changed this while you were working on it. Open it again and redo your change.";
+/**
+ * The four things this needs of a storage adapter.
+ *
+ * Deliberately structural and deliberately ignorant: the session is `unknown`
+ * because what a transaction *is* belongs to the adapter, and nothing here
+ * should be able to reach into one.
+ */
+export interface TransactionalAdapter {
+    connect(): Promise<unknown>;
+    createTransactionalSession(): Promise<unknown>;
+    commitTransactionalSession(session: unknown): Promise<unknown>;
+    abortTransactionalSession(session: unknown): Promise<unknown>;
+}
+/** Told once, when the adapter is built. */
+export declare function useTransactionAdapter(value: TransactionalAdapter): void;
+/** The session this call is running under, if it is running under one. */
+export declare function currentSession(): unknown;
+export declare function inTransaction(): boolean;
+/**
+ * Run this, and either everything it wrote lands or none of it does.
+ *
+ * **Nested calls join.** A body already running inside a transaction simply
+ * runs — MongoDB has no nested transactions, and the useful meaning of an inner
+ * one is "take part in the outer". Committing is therefore the outermost
+ * caller's job alone.
+ *
+ * A body may be **re-run** if the transaction lost a race with another one, so
+ * it must be safe to repeat. Ours are: each reads the state it acts on at the
+ * start, and anything it wrote on the failed attempt was rolled back with it.
+ */
+export declare function withTransaction<T>(body: () => Promise<T>): Promise<T>;
+/**
+ * Everything this cloud function writes lands together, or none of it does.
+ *
+ * **Order matters.** `@CloudFunction` reads the method off the descriptor when
+ * it is applied, and decorators apply bottom-up — so this must sit *below* it,
+ * or the registry keeps the unwrapped method and the transaction silently never
+ * opens:
+ *
+ * ```ts
+ * @CloudFunction({...})   // sees the wrapped method
+ * @Transactional()        // wraps it
+ * async submitJob(req) {}
+ * ```
+ *
+ * `withTransaction` is exported beside this for anything that is not a cloud
+ * function, or for wrapping part of one by hand.
+ */
+export declare function Transactional(): (_target: object, _propertyKey: string | symbol, descriptor: PropertyDescriptor) => PropertyDescriptor;
+export {};
+//# sourceMappingURL=context.d.ts.map

package/dist/transactions/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/transactions/context.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;GAOG;AACH,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnE,eAAO,MAAM,QAAQ,EAAW,cAAc,CAAC;AAE/C,eAAO,MAAM,gBAAgB,iGACmE,CAAC;AASjG;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/D;AAKD,4CAA4C;AAC5C,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAEvE;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAmCD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAkC3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,KAEzB,SAAS,MAAM,EACf,cAAc,MAAM,GAAG,MAAM,EAC7B,YAAY,kBAAkB,KAC7B,kBAAkB,CAWtB"}

package/dist/transactions/context.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFLICT_MESSAGE = exports.CONFLICT = void 0;
+exports.useTransactionAdapter = useTransactionAdapter;
+exports.currentSession = currentSession;
+exports.inTransaction = inTransaction;
+exports.withTransaction = withTransaction;
+exports.Transactional = Transactional;
+const node_async_hooks_1 = require("node:async_hooks");
+exports.CONFLICT = 5001;
+exports.CONFLICT_MESSAGE = 'Somebody else changed this while you were working on it. Open it again and redo your change.';
+const storage = new node_async_hooks_1.AsyncLocalStorage();
+let adapter = null;
+let warnedWithoutAdapter = false;
+/** Told once, when the adapter is built. */
+function useTransactionAdapter(value) {
+    adapter = value;
+}
+/** The session this call is running under, if it is running under one. */
+function currentSession() {
+    return storage.getStore()?.session;
+}
+function inTransaction() {
+    return storage.getStore() !== undefined;
+}
+/**
+ * A write that lost a race with another transaction and may simply be retried.
+ *
+ * MongoDB labels these itself, and a write inside a transaction reports code
+ * 251. Neither survives the trip up, though: the Mongo adapter classifies the
+ * error first and rethrows it as a bare `INTERNAL_SERVER_ERROR` with the message
+ * `Database error`, dropping the label and the code.
+ *
+ * So that message is the third thing checked. It reads like a guess and is not:
+ * Parse Server produces that exact string in exactly one place, and only for an
+ * error its own `isTransientError` has already classified — which is the same
+ * question being asked here.
+ */
+const PARSE_TRANSIENT_MESSAGE = 'Database error';
+function isTransient(error) {
+    const failure = error;
+    if (failure?.hasErrorLabel?.('TransientTransactionError') === true)
+        return true;
+    if (failure?.code === 251)
+        return true;
+    return (failure?.code === Parse.Error.INTERNAL_SERVER_ERROR &&
+        failure?.message === PARSE_TRANSIENT_MESSAGE);
+}
+/** How many times a body may be re-run after losing a race. */
+const MAX_ATTEMPTS = 3;
+/**
+ * Run this, and either everything it wrote lands or none of it does.
+ *
+ * **Nested calls join.** A body already running inside a transaction simply
+ * runs — MongoDB has no nested transactions, and the useful meaning of an inner
+ * one is "take part in the outer". Committing is therefore the outermost
+ * caller's job alone.
+ *
+ * A body may be **re-run** if the transaction lost a race with another one, so
+ * it must be safe to repeat. Ours are: each reads the state it acts on at the
+ * start, and anything it wrote on the failed attempt was rolled back with it.
+ */
+async function withTransaction(body) {
+    // Already inside one — take part in it rather than opening a second.
+    if (inTransaction())
+        return body();
+    if (!adapter) {
+        if (!warnedWithoutAdapter) {
+            warnedWithoutAdapter = true;
+            console.warn('[Transactions] No storage adapter registered — running without one. ' +
+                'Writes will not be rolled back together.');
+        }
+        return body();
+    }
+    // `createTransactionalSession` reaches straight for the driver's client, so
+    // the very first transaction of the process has to wait for the connection.
+    await adapter.connect();
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+        const session = await adapter.createTransactionalSession();
+        try {
+            const result = await storage.run({ session }, body);
+            await adapter.commitTransactionalSession(session);
+            return result;
+        }
+        catch (error) {
+            await adapter.abortTransactionalSession(session).catch(() => undefined);
+            if (!isTransient(error))
+                throw error;
+        }
+    }
+    // Out of attempts, still losing. The caller is not interested in which lock
+    // it was — only that somebody else is working on the same thing.
+    throw new Parse.Error(exports.CONFLICT, exports.CONFLICT_MESSAGE);
+}
+/**
+ * Everything this cloud function writes lands together, or none of it does.
+ *
+ * **Order matters.** `@CloudFunction` reads the method off the descriptor when
+ * it is applied, and decorators apply bottom-up — so this must sit *below* it,
+ * or the registry keeps the unwrapped method and the transaction silently never
+ * opens:
+ *
+ * ```ts
+ * @CloudFunction({...})   // sees the wrapped method
+ * @Transactional()        // wraps it
+ * async submitJob(req) {}
+ * ```
+ *
+ * `withTransaction` is exported beside this for anything that is not a cloud
+ * function, or for wrapping part of one by hand.
+ */
+function Transactional() {
+    return (_target, _propertyKey, descriptor) => {
+        const body = descriptor.value;
+        if (typeof body !== 'function') {
+            throw new Error('@Transactional can only be applied to methods.');
+        }
+        descriptor.value = function (...args) {
+            return withTransaction(() => body.apply(this, args));
+        };
+        return descriptor;
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/transactions/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/transactions/context.ts"],"names":[],"mappings":";;;AAmEA,sDAEC;AAGD,wCAEC;AAED,sCAEC;AA+CD,0CAkCC;AAmBD,sCAgBC;AAlMD,uDAAmD;AAqCtC,QAAA,QAAQ,GAAG,IAAsB,CAAC;AAElC,QAAA,gBAAgB,GAC3B,8FAA8F,CAAC;AAOjG,MAAM,OAAO,GAAG,IAAI,oCAAiB,EAAoB,CAAC;AAgB1D,IAAI,OAAO,GAAgC,IAAI,CAAC;AAChD,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,4CAA4C;AAC5C,SAAgB,qBAAqB,CAAC,KAA2B;IAC/D,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,cAAc;IAC5B,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;AACrC,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,OAAO,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAEjD,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,OAAO,GAAG,KAIf,CAAC;IACF,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC,2BAA2B,CAAC,KAAK,IAAI;QAChE,OAAO,IAAI,CAAC;IACd,IAAI,OAAO,EAAE,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CACL,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,qBAAqB;QACnD,OAAO,EAAE,OAAO,KAAK,uBAAuB,CAC7C,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,eAAe,CAAI,IAAsB;IAC7D,qEAAqE;IACrE,IAAI,aAAa,EAAE;QAAE,OAAO,IAAI,EAAE,CAAC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,oBAAoB,GAAG,IAAI,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,sEAAsE;gBACpE,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAExB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,0BAA0B,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAC,OAAO,EAAC,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACvC,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAQ,EAAE,wBAAgB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,aAAa;IAC3B,OAAO,CACL,OAAe,EACf,YAA6B,EAC7B,UAA8B,EACV,EAAE;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,UAAU,CAAC,KAAK,GAAG,UAAyB,GAAG,IAAe;YAC5D,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/utils/dynamicImport.d.ts

@@ -1,2 +1,23 @@
-export declare const importFiles: (directoryPath: string) => void;
+export interface ImportFilesOptions {
+    /**
+     * Which file extensions to load. Defaults to `['.js']` — the compiled output
+     * a production server runs.
+     *
+     * Pass `['.js', '.ts']` when running straight from source under ts-node or
+     * tsx. Without it nothing is imported at all: no models register, no cloud
+     * functions exist, and the server starts perfectly happily with an empty
+     * schema. It is not the kind of failure you want to debug from the symptoms.
+     *
+     * Point this at a source directory only. A directory holding *both* compiled
+     * and source copies would register every class twice.
+     */
+    extensions?: string[];
+    /** Log each file as it is imported. Defaults to true, as it always has. */
+    verbose?: boolean;
+}
+/**
+ * Recursively import every matching file in a directory, for the side effect of
+ * running its decorators.
+ */
+export declare const importFiles: (directoryPath: string, options?: ImportFilesOptions) => void;
 //# sourceMappingURL=dynamicImport.d.ts.map

package/dist/utils/dynamicImport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamicImport.d.ts","sourceRoot":"","sources":["../../src/utils/dynamicImport.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,WAAW,GAAI,eAAe,MAAM,SAWhD,CAAC"}
+{"version":3,"file":"dynamicImport.d.ts","sourceRoot":"","sources":["../../src/utils/dynamicImport.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,GACtB,eAAe,MAAM,EACrB,UAAS,kBAAuB,SAkBjC,CAAC"}

package/dist/utils/dynamicImport.js

@@ -4,15 +4,24 @@ exports.importFiles = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const isDirectory = (path) => (0, fs_1.statSync)(path).isDirectory();
-const importFiles = (directoryPath) => {
+/**
+ * Recursively import every matching file in a directory, for the side effect of
+ * running its decorators.
+ */
+const importFiles = (directoryPath, options = {}) => {
+    const { extensions = ['.js'], verbose = true } = options;
+    // `.d.ts` is a declaration, never a module to execute — importing one under
+    // ts-node is at best a no-op and at worst a crash.
+    const wanted = new Set(extensions.map(e => (e.startsWith('.') ? e : `.${e}`)));
     const files = (0, fs_1.readdirSync)(directoryPath);
     files.forEach(file => {
         const filePath = (0, path_1.join)(directoryPath, file);
         if (isDirectory(filePath)) {
-            (0, exports.importFiles)(filePath);
+            (0, exports.importFiles)(filePath, options);
         }
-        else if ((0, path_1.extname)(filePath) === '.js') {
-            console.log(filePath);
+        else if (wanted.has((0, path_1.extname)(filePath)) && !file.endsWith('.d.ts')) {
+            if (verbose)
+                console.log(filePath);
             require(filePath);
         }
     });

package/dist/utils/dynamicImport.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamicImport.js","sourceRoot":"","sources":["../../src/utils/dynamicImport.ts"],"names":[],"mappings":";;;AAAA,2BAAyC;AACzC,+BAAmC;AAEnC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,aAAQ,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAE5D,MAAM,WAAW,GAAG,CAAC,aAAqB,EAAE,EAAE;IACnD,MAAM,KAAK,GAAG,IAAA,gBAAW,EAAC,aAAa,CAAC,CAAC;IACzC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAA,mBAAW,EAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,IAAA,cAAO,EAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAXW,QAAA,WAAW,eAWtB"}
+{"version":3,"file":"dynamicImport.js","sourceRoot":"","sources":["../../src/utils/dynamicImport.ts"],"names":[],"mappings":";;;AAAA,2BAAyC;AACzC,+BAAmC;AAEnC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,aAAQ,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAoBnE;;;GAGG;AACI,MAAM,WAAW,GAAG,CACzB,aAAqB,EACrB,UAA8B,EAAE,EAChC,EAAE;IACF,MAAM,EAAC,UAAU,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,EAAC,GAAG,OAAO,CAAC;IAEvD,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,IAAA,gBAAW,EAAC,aAAa,CAAC,CAAC;IACzC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAA,mBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,CAAC,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AApBW,QAAA,WAAW,eAoBtB"}

package/dist/utils/helper.d.ts

@@ -9,7 +9,16 @@ export declare function catchError<T>(promise: Promise<T>): Promise<[undefined,
  */
 export declare function getUserRoles(user: Parse.User): Promise<string[]>;
 /**
- * Get role names for multiple users (batch — avoids N+1)
+ * Get role names for multiple users.
+ *
+ * Costs one query per *role*, not one per user — which is the half that
+ * matters, since the role list is a fixed property of the deployment (and
+ * capped at 100 here) while the user list is whatever the caller passed. A page
+ * of 500 users costs the same as a page of 5.
+ *
+ * It is not a single query: Parse relations cannot be filtered across roles in
+ * one go. If the role count ever grows past a few dozen, this is the place to
+ * look.
  */
 export declare function getUsersRoles(users: Parse.User[]): Promise<Map<string, string[]>>;
 //# sourceMappingURL=helper.d.ts.map

package/dist/utils/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/utils/helper.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,SAAO,UAMlD;AAED,wBAAgB,sBAAsB,CACpC,MAAM,SAAI,EACV,cAAc,UAAO,EACrB,cAAc,UAAO,UAiBtB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,UAInD;AAED,wBAAgB,oBAAoB,CAAC,MAAM,SAAI,GAAG,MAAM,CAOvD;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,oBAE/B;AAED,wBAAsB,UAAU,CAAC,CAAC,EAChC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAQnC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKtE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAmBvF"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/utils/helper.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,SAAO,UAMlD;AAED,wBAAgB,sBAAsB,CACpC,MAAM,SAAI,EACV,cAAc,UAAO,EACrB,cAAc,UAAO,UAiBtB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,UAInD;AAED,wBAAgB,oBAAoB,CAAC,MAAM,SAAI,GAAG,MAAM,CAOvD;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,oBAE/B;AAED,wBAAsB,UAAU,CAAC,CAAC,EAChC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAQnC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAmBvF"}

package/dist/utils/helper.js

@@ -67,7 +67,16 @@ async function getUserRoles(user) {
     return roles.map(r => r.get('name'));
 }
 /**
- * Get role names for multiple users (batch — avoids N+1)
+ * Get role names for multiple users.
+ *
+ * Costs one query per *role*, not one per user — which is the half that
+ * matters, since the role list is a fixed property of the deployment (and
+ * capped at 100 here) while the user list is whatever the caller passed. A page
+ * of 500 users costs the same as a page of 5.
+ *
+ * It is not a single query: Parse relations cannot be filtered across roles in
+ * one go. If the role count ever grows past a few dozen, this is the place to
+ * look.
  */
 async function getUsersRoles(users) {
     if (users.length === 0)

package/dist/utils/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/utils/helper.ts"],"names":[],"mappings":";;AAAA,kCAMC;AAED,wDAoBC;AAED,sDAIC;AAED,oDAOC;AAED,sBAEC;AAED,gCAUC;AAKD,oCAKC;AAKD,sCAmBC;AA7FD,SAAgB,WAAW,CAAC,GAAQ,EAAE,MAAM,GAAG,IAAI;IACjD,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE,OAAO;QACvB,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAM,GAAG,CAAC,EACV,cAAc,GAAG,IAAI,EACrB,cAAc,GAAG,IAAI;IAErB,MAAM,cAAc,GAAG,4BAA4B,CAAC;IACpD,MAAM,cAAc,GAAG,4BAA4B,CAAC;IACpD,MAAM,WAAW,GAAG,YAAY,CAAC;IACjC,MAAM,WAAW,GAAG,4BAA4B,CAAC;IAEjD,IAAI,OAAO,GAAG,cAAc,GAAG,cAAc,CAAC;IAC9C,IAAI,cAAc;QAAE,OAAO,IAAI,WAAW,CAAC;IAC3C,IAAI,cAAc;QAAE,OAAO,IAAI,WAAW,CAAC;IAE3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAc;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAM,GAAG,CAAC;IAC7C,MAAM,KAAK,GAAG,gEAAgE,CAAC;IAC/E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,OAAmB;IAEnB,OAAO,OAAO;SACX,IAAI,CAAC,IAAI,CAAC,EAAE;QACX,OAAO,CAAC,SAAS,EAAE,IAAI,CAAmB,CAAC;IAC7C,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,IAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CAAC,KAAmB;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAG,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAI,IAAmB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9D,aAAa,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAG,CAAC,IAAI,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/utils/helper.ts"],"names":[],"mappings":";;AAAA,kCAMC;AAED,wDAoBC;AAED,sDAIC;AAED,oDAOC;AAED,sBAEC;AAED,gCAUC;AAKD,oCAKC;AAcD,sCAmBC;AAtGD,SAAgB,WAAW,CAAC,GAAQ,EAAE,MAAM,GAAG,IAAI;IACjD,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;QACnC,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE,OAAO;QACvB,qBAAqB,EAAE,CAAC;KACzB,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAM,GAAG,CAAC,EACV,cAAc,GAAG,IAAI,EACrB,cAAc,GAAG,IAAI;IAErB,MAAM,cAAc,GAAG,4BAA4B,CAAC;IACpD,MAAM,cAAc,GAAG,4BAA4B,CAAC;IACpD,MAAM,WAAW,GAAG,YAAY,CAAC;IACjC,MAAM,WAAW,GAAG,4BAA4B,CAAC;IAEjD,IAAI,OAAO,GAAG,cAAc,GAAG,cAAc,CAAC;IAC9C,IAAI,cAAc;QAAE,OAAO,IAAI,WAAW,CAAC;IAC3C,IAAI,cAAc;QAAE,OAAO,IAAI,WAAW,CAAC;IAE3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAc;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAM,GAAG,CAAC;IAC7C,MAAM,KAAK,GAAG,gEAAgE,CAAC;IAC/E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,OAAmB;IAEnB,OAAO,OAAO;SACX,IAAI,CAAC,IAAI,CAAC,EAAE;QACX,OAAO,CAAC,SAAS,EAAE,IAAI,CAAmB,CAAC;IAC7C,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE;QACX,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,IAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,aAAa,CAAC,KAAmB;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAG,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAI,IAAmB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9D,aAAa,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAC,YAAY,EAAE,IAAI,EAAC,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAG,CAAC,IAAI,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/utils/imageAcl.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Make a parent's nested image(s) FOLLOW the parent's per-record ACL, so an
+ * image is visible to exactly whoever can see its parent (an active record →
+ * Member/public-readable image; a hidden one → hidden image).
+ *
+ * `handleImageLogic` stamps a new image with the parent CLASS's static ACL
+ * template, and nothing re-stamps it on later transitions — so without this,
+ * catalogues render blank images and hidden parents leak readable images.
+ *
+ * Call `syncImageAcl(parent, [fields])` AFTER setting the parent's per-record ACL
+ * and BEFORE saving the parent. It copies the parent's ACL onto each nested image
+ * (single Pointer or Array-of-Pointer, e.g. `images`), dirtying it so the
+ * parent's save cascades the change:
+ *   - a NEW image (no id) is created with the ACL;
+ *   - an EXISTING image gets an ACL-ONLY update (no file rewrite / re-process).
+ *
+ * The parent ACL must already carry its FINAL read grants when this is called.
+ * For collections whose visibility is derived from a status in a `beforeSave`
+ * trigger (e.g. `publicRead = status === 'active'`), pass that `publicRead` into
+ * `implementACL` at the call site — the trigger runs AFTER this helper.
+ *
+ * @param acl Optional ACL source override, for callers that hold the images on a
+ *            PARTIAL save object (where `parent.getACL()` isn't the live ACL).
+ */
+export declare function syncImageAcl(parent: Parse.Object, fields: string[], acl?: Parse.ACL): void;
+/** Deep-copy a Parse.ACL (role, public `*`, and per-user grants). */
+export declare function cloneAcl(acl: Parse.ACL): Parse.ACL;
+//# sourceMappingURL=imageAcl.d.ts.map

package/dist/utils/imageAcl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imageAcl.d.ts","sourceRoot":"","sources":["../../src/utils/imageAcl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,GACd,IAAI,CAeN;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAqBlD"}

package/dist/utils/imageAcl.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncImageAcl = syncImageAcl;
+exports.cloneAcl = cloneAcl;
+/**
+ * Make a parent's nested image(s) FOLLOW the parent's per-record ACL, so an
+ * image is visible to exactly whoever can see its parent (an active record →
+ * Member/public-readable image; a hidden one → hidden image).
+ *
+ * `handleImageLogic` stamps a new image with the parent CLASS's static ACL
+ * template, and nothing re-stamps it on later transitions — so without this,
+ * catalogues render blank images and hidden parents leak readable images.
+ *
+ * Call `syncImageAcl(parent, [fields])` AFTER setting the parent's per-record ACL
+ * and BEFORE saving the parent. It copies the parent's ACL onto each nested image
+ * (single Pointer or Array-of-Pointer, e.g. `images`), dirtying it so the
+ * parent's save cascades the change:
+ *   - a NEW image (no id) is created with the ACL;
+ *   - an EXISTING image gets an ACL-ONLY update (no file rewrite / re-process).
+ *
+ * The parent ACL must already carry its FINAL read grants when this is called.
+ * For collections whose visibility is derived from a status in a `beforeSave`
+ * trigger (e.g. `publicRead = status === 'active'`), pass that `publicRead` into
+ * `implementACL` at the call site — the trigger runs AFTER this helper.
+ *
+ * @param acl Optional ACL source override, for callers that hold the images on a
+ *            PARTIAL save object (where `parent.getACL()` isn't the live ACL).
+ */
+function syncImageAcl(parent, fields, acl) {
+    const parentAcl = acl ?? parent.getACL();
+    if (!parentAcl)
+        return;
+    for (const field of fields) {
+        const value = parent.get(field);
+        const images = Array.isArray(value)
+            ? value
+            : value
+                ? [value]
+                : [];
+        for (const img of images) {
+            if (img)
+                img.setACL(cloneAcl(parentAcl));
+        }
+    }
+}
+/** Deep-copy a Parse.ACL (role, public `*`, and per-user grants). */
+function cloneAcl(acl) {
+    const json = acl.toJSON();
+    const clone = new Parse.ACL();
+    for (const id of Object.keys(json)) {
+        const perms = json[id];
+        if (id === '*') {
+            if (perms.read)
+                clone.setPublicReadAccess(true);
+            if (perms.write)
+                clone.setPublicWriteAccess(true);
+        }
+        else if (id.startsWith('role:')) {
+            const role = id.slice(5);
+            if (perms.read)
+                clone.setRoleReadAccess(role, true);
+            if (perms.write)
+                clone.setRoleWriteAccess(role, true);
+        }
+        else {
+            if (perms.read)
+                clone.setReadAccess(id, true);
+            if (perms.write)
+                clone.setWriteAccess(id, true);
+        }
+    }
+    return clone;
+}
+//# sourceMappingURL=imageAcl.js.map

package/dist/utils/imageAcl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imageAcl.js","sourceRoot":"","sources":["../../src/utils/imageAcl.ts"],"names":[],"mappings":";;AAwBA,oCAmBC;AAGD,4BAqBC;AAnED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,YAAY,CAC1B,MAAoB,EACpB,MAAgB,EAChB,GAAe;IAEf,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAmB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACjD,CAAC,CAAE,KAAwB;YAC3B,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,CAAC,KAAqB,CAAC;gBACzB,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG;gBAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAgB,QAAQ,CAAC,GAAc;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAGtB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,IAAI;gBAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,KAAK;gBAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,IAAI;gBAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,KAAK;gBAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,IAAI;gBAAE,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,KAAK;gBAAE,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,54 +1,75 @@
-{
-  "name": "@90soft/parse-server-kit",
-  "version": "2.5.3",
-  "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "parse-server",
-    "decorators",
-    "typescript",
-    "backend",
-    "cloud-functions",
-    "mongodb",
-    "acl",
-    "swagger",
-    "cron"
-  ],
-  "author": "90Soft",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://git.90-soft.com/90_soft/parse-server-kit.git"
-  },
-  "peerDependencies": {
-    "parse": ">=5.0.0",
-    "reflect-metadata": ">=0.1.13",
-    "express": ">=4.0.0"
-  },
-  "peerDependenciesMeta": {
-    "node-cron": {
-      "optional": true
-    },
-    "swagger-ui-express": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "typescript": "^5.5.0",
-    "@types/node": "^20.0.0",
-    "@types/express": "^5.0.0",
-    "parse": "^5.3.0",
-    "reflect-metadata": "^0.2.2",
-    "express": "^5.0.0",
-    "swagger-ui-express": "^5.0.1",
-    "node-cron": "^4.0.0"
-  }
-}
+{
+  "name": "@90soft/parse-server-kit",
+  "version": "2.8.0",
+  "description": "Complete decorator-driven development kit for Parse Server — models, cloud functions, triggers, cron, routing, ACL, Swagger, and more.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "jest",
+    "test:integration": "NODE_OPTIONS=--experimental-vm-modules jest --config jest.integration.config.js",
+    "test:all": "npm test && npm run test:integration",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "parse-server",
+    "decorators",
+    "typescript",
+    "backend",
+    "cloud-functions",
+    "mongodb",
+    "acl",
+    "swagger",
+    "cron"
+  ],
+  "author": "90Soft",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://git.90-soft.com/90_soft/parse-server-kit.git"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "peerDependencies": {
+    "@types/parse": ">=3.0.0",
+    "express": ">=4.0.0",
+    "node-cron": ">=3.0.0",
+    "parse": ">=5.0.0",
+    "parse-server": ">=8.3.0",
+    "reflect-metadata": ">=0.1.13",
+    "swagger-ui-express": ">=4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@types/parse": {
+      "optional": true
+    },
+    "node-cron": {
+      "optional": true
+    },
+    "swagger-ui-express": {
+      "optional": true
+    },
+    "parse-server": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.0.0",
+    "express": "^5.0.0",
+    "jest": "^29.7.0",
+    "mongodb-memory-server": "^11.2.0",
+    "node-cron": "^4.0.0",
+    "parse": "^5.3.0",
+    "parse-server": "^9.10.0",
+    "reflect-metadata": "^0.2.2",
+    "swagger-ui-express": "^5.0.1",
+    "ts-jest": "^29.2.0",
+    "typescript": "^5.5.0"
+  }
+}