@classytic/arc 2.16.0 → 2.17.0

package/dist/{permissions-CTxMrreC.mjs → permissions-B1Qy55fg.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 import { C as isService, S as isOrgInScope, a as getDPoPJkt, b as isElevated, d as getScopeContext, f as getScopeContextMap, g as getUserId, m as getTeamId, o as getMandate, p as getServiceScopes, u as getRequestScope, v as hasOrgAccess, x as isMember } from "./types-Bi0r0vjG.mjs";
-import { t as getUserRoles } from "./types-D57iXYb8.mjs";
+import { t as getUserRoles } from "./types-DV9WDfeg.mjs";
 import { t as MemoryCacheStore } from "./memory-QOLe11D5.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/permissions/applyPermissionResult.ts
@@ -99,6 +99,173 @@ async function evaluateAndApplyPermission(check, context, request, reply, opts)
 	return true;
 }
 //#endregion
+//#region src/permissions/fields.ts
+/**
+* Field-Level Permissions
+*
+* Control field visibility and writability per role.
+* Integrated into the response path (read) and sanitization path (write).
+*
+* @example
+* ```typescript
+* import { fields, defineResource } from '@classytic/arc';
+*
+* const userResource = defineResource({
+*   name: 'user',
+*   adapter: userAdapter,
+*   fields: {
+*     salary: fields.visibleTo(['admin', 'hr']),
+*     internalNotes: fields.writableBy(['admin']),
+*     email: fields.redactFor(['viewer']),
+*     password: fields.hidden(),
+*   },
+* });
+* ```
+*/
+/** Type guard for Mongoose-like documents with toObject() */
+function isMongooseDoc(obj) {
+	return !!obj && typeof obj === "object" && "toObject" in obj && typeof obj.toObject === "function";
+}
+const fields = {
+	/**
+	* Field is never included in responses. Not writable via API.
+	*
+	* @example
+	* ```typescript
+	* fields: { password: fields.hidden() }
+	* ```
+	*/
+	hidden() {
+		return { _type: "hidden" };
+	},
+	/**
+	* Field is only visible to users with specified roles.
+	* Other users don't see the field at all.
+	*
+	* @example
+	* ```typescript
+	* fields: { salary: fields.visibleTo(['admin', 'hr']) }
+	* ```
+	*/
+	visibleTo(roles) {
+		return {
+			_type: "visibleTo",
+			roles
+		};
+	},
+	/**
+	* Field is only writable by users with specified roles.
+	* All users can still read the field. Users without the role
+	* have the field silently stripped from write operations.
+	*
+	* @example
+	* ```typescript
+	* fields: { role: fields.writableBy(['admin']) }
+	* ```
+	*/
+	writableBy(roles) {
+		return {
+			_type: "writableBy",
+			roles
+		};
+	},
+	/**
+	* Field is redacted (replaced with a placeholder) for specified roles.
+	* Other users see the real value.
+	*
+	* @param roles - Roles that see the redacted value
+	* @param redactValue - Replacement value (default: '***')
+	*
+	* @example
+	* ```typescript
+	* fields: {
+	*   email: fields.redactFor(['viewer']),
+	*   ssn: fields.redactFor(['basic'], '***-**-****'),
+	* }
+	* ```
+	*/
+	redactFor(roles, redactValue = "***") {
+		return {
+			_type: "redactFor",
+			roles,
+			redactValue
+		};
+	}
+};
+/**
+* Apply field-level READ permissions to a response object.
+* Strips hidden fields, enforces visibility, and applies redaction.
+*
+* @param data - The response object (mutated in place for performance)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles (empty array for unauthenticated)
+* @returns The filtered object
+*/
+function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
+	if (!data || typeof data !== "object") return data;
+	const result = { ...isMongooseDoc(data) ? data.toObject() : data };
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			delete result[field];
+			break;
+		case "visibleTo":
+			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
+			break;
+		case "redactFor":
+			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
+			break;
+		case "writableBy": break;
+	}
+	return result;
+}
+/**
+* Apply field-level WRITE permissions to request body.
+*
+* Returns both the filtered body and the list of denied fields. Callers are
+* expected to reject the request when `deniedFields.length > 0` — silently
+* stripping fields hides misconfigurations and real attacks. See
+* `BodySanitizer` for the default policy.
+*
+* @param body - The request body (returns a new filtered copy)
+* @param fieldPermissions - Field permission map from resource config
+* @param userRoles - Current user's roles
+*/
+function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
+	const result = { ...body };
+	const deniedFields = [];
+	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
+		case "hidden":
+			if (field in result) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+		case "writableBy":
+			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
+				deniedFields.push(field);
+				delete result[field];
+			}
+			break;
+	}
+	return {
+		body: result,
+		deniedFields
+	};
+}
+/**
+* Resolve effective roles by merging global user roles with org-level roles.
+*
+* Global roles come from `req.user.role` (normalized via getUserRoles()).
+* Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
+*
+* When no org context exists, returns global roles only — backward compatible.
+*/
+function resolveEffectiveRoles(userRoles, orgRoles) {
+	if (orgRoles.length === 0) return [...userRoles];
+	if (userRoles.length === 0) return [...orgRoles];
+	return [...new Set([...userRoles, ...orgRoles])];
+}
+//#endregion
 //#region src/permissions/agent.ts
 /**
 * Agent-Auth Permission Helpers — DPoP + capability mandates for AI-agent flows
@@ -1148,173 +1315,6 @@ function createDynamicPermissionMatrix(config) {
 	};
 }
 //#endregion
-//#region src/permissions/fields.ts
-/**
-* Field-Level Permissions
-*
-* Control field visibility and writability per role.
-* Integrated into the response path (read) and sanitization path (write).
-*
-* @example
-* ```typescript
-* import { fields, defineResource } from '@classytic/arc';
-*
-* const userResource = defineResource({
-*   name: 'user',
-*   adapter: userAdapter,
-*   fields: {
-*     salary: fields.visibleTo(['admin', 'hr']),
-*     internalNotes: fields.writableBy(['admin']),
-*     email: fields.redactFor(['viewer']),
-*     password: fields.hidden(),
-*   },
-* });
-* ```
-*/
-/** Type guard for Mongoose-like documents with toObject() */
-function isMongooseDoc(obj) {
-	return !!obj && typeof obj === "object" && "toObject" in obj && typeof obj.toObject === "function";
-}
-const fields = {
-	/**
-	* Field is never included in responses. Not writable via API.
-	*
-	* @example
-	* ```typescript
-	* fields: { password: fields.hidden() }
-	* ```
-	*/
-	hidden() {
-		return { _type: "hidden" };
-	},
-	/**
-	* Field is only visible to users with specified roles.
-	* Other users don't see the field at all.
-	*
-	* @example
-	* ```typescript
-	* fields: { salary: fields.visibleTo(['admin', 'hr']) }
-	* ```
-	*/
-	visibleTo(roles) {
-		return {
-			_type: "visibleTo",
-			roles
-		};
-	},
-	/**
-	* Field is only writable by users with specified roles.
-	* All users can still read the field. Users without the role
-	* have the field silently stripped from write operations.
-	*
-	* @example
-	* ```typescript
-	* fields: { role: fields.writableBy(['admin']) }
-	* ```
-	*/
-	writableBy(roles) {
-		return {
-			_type: "writableBy",
-			roles
-		};
-	},
-	/**
-	* Field is redacted (replaced with a placeholder) for specified roles.
-	* Other users see the real value.
-	*
-	* @param roles - Roles that see the redacted value
-	* @param redactValue - Replacement value (default: '***')
-	*
-	* @example
-	* ```typescript
-	* fields: {
-	*   email: fields.redactFor(['viewer']),
-	*   ssn: fields.redactFor(['basic'], '***-**-****'),
-	* }
-	* ```
-	*/
-	redactFor(roles, redactValue = "***") {
-		return {
-			_type: "redactFor",
-			roles,
-			redactValue
-		};
-	}
-};
-/**
-* Apply field-level READ permissions to a response object.
-* Strips hidden fields, enforces visibility, and applies redaction.
-*
-* @param data - The response object (mutated in place for performance)
-* @param fieldPermissions - Field permission map from resource config
-* @param userRoles - Current user's roles (empty array for unauthenticated)
-* @returns The filtered object
-*/
-function applyFieldReadPermissions(data, fieldPermissions, userRoles) {
-	if (!data || typeof data !== "object") return data;
-	const result = { ...isMongooseDoc(data) ? data.toObject() : data };
-	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
-		case "hidden":
-			delete result[field];
-			break;
-		case "visibleTo":
-			if (!perm.roles?.some((r) => userRoles.includes(r))) delete result[field];
-			break;
-		case "redactFor":
-			if (perm.roles?.some((r) => userRoles.includes(r))) result[field] = perm.redactValue ?? "***";
-			break;
-		case "writableBy": break;
-	}
-	return result;
-}
-/**
-* Apply field-level WRITE permissions to request body.
-*
-* Returns both the filtered body and the list of denied fields. Callers are
-* expected to reject the request when `deniedFields.length > 0` — silently
-* stripping fields hides misconfigurations and real attacks. See
-* `BodySanitizer` for the default policy.
-*
-* @param body - The request body (returns a new filtered copy)
-* @param fieldPermissions - Field permission map from resource config
-* @param userRoles - Current user's roles
-*/
-function applyFieldWritePermissions(body, fieldPermissions, userRoles) {
-	const result = { ...body };
-	const deniedFields = [];
-	for (const [field, perm] of Object.entries(fieldPermissions)) switch (perm._type) {
-		case "hidden":
-			if (field in result) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
-		case "writableBy":
-			if (field in result && !perm.roles?.some((r) => userRoles.includes(r))) {
-				deniedFields.push(field);
-				delete result[field];
-			}
-			break;
-	}
-	return {
-		body: result,
-		deniedFields
-	};
-}
-/**
-* Resolve effective roles by merging global user roles with org-level roles.
-*
-* Global roles come from `req.user.role` (normalized via getUserRoles()).
-* Org roles come from `req.context.orgRoles` (set by BA adapter's org bridge).
-*
-* When no org context exists, returns global roles only — backward compatible.
-*/
-function resolveEffectiveRoles(userRoles, orgRoles) {
-	if (orgRoles.length === 0) return [...userRoles];
-	if (userRoles.length === 0) return [...orgRoles];
-	return [...new Set([...userRoles, ...orgRoles])];
-}
-//#endregion
 //#region src/permissions/roleHierarchy.ts
 /**
 * Create a role hierarchy from a parent → children map.
@@ -1490,4 +1490,4 @@ function readOnly(overrides) {
 	}, overrides);
 }
 //#endregion
-export { roles as A, allowPublic as C, requireAuth as D, not as E, applyPermissionResult as F, evaluateAndApplyPermission as I, normalizePermissionResult as L, requireAgentScope as M, requireDPoP as N, requireOwnership as O, requireMandate as P, allOf as S, denyAll as T, requireOrgMembership as _, presets_exports as a, requireServiceScope as b, readOnly as c, applyFieldWritePermissions as d, fields as f, requireOrgInScope as g, createOrgPermissions as h, ownerWithAdminBypass as i, when as j, requireRoles as k, createRoleHierarchy as l, createDynamicPermissionMatrix as m, authenticated as n, publicRead as o, resolveEffectiveRoles as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, applyFieldReadPermissions as u, requireOrgRole as v, anyOf as w, requireTeamMembership as x, requireScopeContext as y };
+export { requireMandate as A, requireAuth as C, when as D, roles as E, applyPermissionResult as F, evaluateAndApplyPermission as I, normalizePermissionResult as L, applyFieldWritePermissions as M, fields as N, requireAgentScope as O, resolveEffectiveRoles as P, not as S, requireRoles as T, requireTeamMembership as _, presets_exports as a, anyOf as b, readOnly as c, createOrgPermissions as d, requireOrgInScope as f, requireServiceScope as g, requireScopeContext as h, ownerWithAdminBypass as i, applyFieldReadPermissions as j, requireDPoP as k, createRoleHierarchy as l, requireOrgRole as m, authenticated as n, publicRead as o, requireOrgMembership as p, fullPublic as r, publicReadAdminWrite as s, adminOnly as t, createDynamicPermissionMatrix as u, allOf as v, requireOwnership as w, denyAll as x, allowPublic as y };

package/dist/pipeline/index.d.mts

@@ -1,4 +1,4 @@
-import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-CkW0flkU.mjs";
+import { Ft as OperationFilter, It as PipelineConfig, Lt as PipelineContext, Mt as Guard, Nt as Interceptor, Pt as NextFunction, Rt as PipelineStep, yt as IControllerResponse, zt as Transform } from "../index-C1JSBan-.mjs";
 
 //#region src/pipeline/guard.d.ts
 interface GuardOptions {

package/dist/plugins/index.d.mts

@@ -1,66 +1,12 @@
-import { An as HookSystem, Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook, z as ResourceRegistry } from "../index-CkW0flkU.mjs";
-import { t as ExternalOpenApiPaths } from "../externalPaths-DFg-2KTp.mjs";
-import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-ZwX9tmbS.mjs";
-import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-mHuyWzZE.mjs";
-import { t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
+import { Kt as AnyRecord, Q as MiddlewareConfig, dt as RouteDefinition, mt as RouteSchemaOptions, nt as PresetHook } from "../index-C1JSBan-.mjs";
+import { a as arcCorePlugin, i as _default, n as ArcCorePluginOptions, r as PluginMeta, t as ArcCore } from "../fastify-augmentation-7LIR0nDv.mjs";
+import { _ as HealthOptions, a as MetricsCollector, c as metricsPlugin, d as ssePlugin, f as CachingOptions, g as HealthCheck, h as cachingPlugin, i as MetricEntry, l as SSEOptions, m as _default$1, n as _default$7, o as MetricsOptions, p as CachingRule, r as versioningPlugin, s as _default$4, t as VersioningOptions, u as _default$6, v as _default$3, y as healthPlugin } from "../versioning-5H4930tj.mjs";
+import { i as errorHandlerPlugin, n as ErrorMapper, r as defaultIsDuplicateKeyError, t as ErrorHandlerOptions } from "../errorHandler-DuqTqeqn.mjs";
+import { t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 import { PaginatedResult } from "@classytic/repo-core/pagination";
 import { FastifyInstance, FastifyPluginAsync } from "fastify";
 import * as _$node_stream0 from "node:stream";
 
-//#region src/core/arcCorePlugin.d.ts
-interface ArcCorePluginOptions {
-  /** Enable event emission for CRUD operations (requires eventPlugin) */
-  emitEvents?: boolean;
-  /** Hook system instance (for testing/custom setup) */
-  hookSystem?: HookSystem;
-  /** Resource registry instance (for testing/custom setup) */
-  registry?: ResourceRegistry;
-}
-interface PluginMeta {
-  name: string;
-  version?: string;
-  options?: Record<string, unknown>;
-  registeredAt: string;
-}
-interface ArcCore {
-  /** Instance-scoped hook system */
-  hooks: HookSystem;
-  /** Instance-scoped resource registry */
-  registry: ResourceRegistry;
-  /** Whether event emission is enabled */
-  emitEvents: boolean;
-  /** External OpenAPI paths contributed by auth adapters or third-party integrations */
-  externalOpenApiPaths: ExternalOpenApiPaths[];
-  /** Registered plugins for introspection */
-  plugins: Map<string, PluginMeta>;
-}
-declare module "fastify" {
-  interface FastifyInstance {
-    /**
-     * Arc core decorator. Optional because:
-     *
-     * 1. Consumers who import any `@classytic/arc/*` subpath get this module
-     *    augmentation merged into every `FastifyInstance` they see — even
-     *    instances on apps that never register {@link arcCorePlugin}. Making
-     *    it required would force those apps to assert or guard every
-     *    property access.
-     * 2. Hosts that extend `FastifyInstance` to narrow `arc` to their own
-     *    type (`interface X extends FastifyInstance { arc?: MyArc }`) were
-     *    previously blocked because non-optional `arc: ArcCore` conflicts
-     *    with the re-declaration. An optional field lets hosts re-declare
-     *    with a compatible subtype without fighting TS.
-     *
-     * Inside Arc's own code, any call site that runs *after* `arcCorePlugin`
-     * has registered treats this as non-null — see the call sites in
-     * `factory/registerAuth.ts` and `factory/createApp.ts` which assert
-     * with `fastify.arc!` or narrow explicitly.
-     */
-    arc?: ArcCore;
-  }
-}
-declare const arcCorePlugin: FastifyPluginAsync<ArcCorePluginOptions>;
-declare const _default: FastifyPluginAsync<ArcCorePluginOptions>;
-//#endregion
 //#region src/plugins/createPlugin.d.ts
 interface PluginResourceResult {
   /** Additional routes to add to the resource (v2.8 `RouteDefinition` shape) */

package/dist/plugins/index.mjs

@@ -3,13 +3,13 @@ import { c as getOrgId } from "../types-Bi0r0vjG.mjs";
 import { t as requestContext } from "../requestContext-SSaaTgW8.mjs";
 import { t as hasEvents } from "../typeGuards-BzkXkvVv.mjs";
 import { t as HookSystem } from "../HookSystem-Cmf7-Etp.mjs";
-import { t as ResourceRegistry } from "../ResourceRegistry-f48hFk3m.mjs";
-import { n as caching_default, t as cachingPlugin } from "../caching-TeHE8G-v.mjs";
-import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-DpoXQHZ9.mjs";
-import { n as metrics_default, t as metricsPlugin } from "../metrics-TuOmguhi.mjs";
-import { t as replyHelpersPlugin } from "../replyHelpers-C-gD32oF.mjs";
-import { n as sse_default, t as ssePlugin } from "../sse-BY6sTy4P.mjs";
-import { n as versioning_default, t as versioningPlugin } from "../versioning-B6mimogM.mjs";
+import { t as ResourceRegistry } from "../ResourceRegistry-CzSzVK1m.mjs";
+import { n as caching_default, t as cachingPlugin } from "../caching-8MfrrUYU.mjs";
+import { n as errorHandlerPlugin, t as defaultIsDuplicateKeyError } from "../errorHandler-wQejMBT3.mjs";
+import { n as metrics_default, t as metricsPlugin } from "../metrics-B-PU4-Yu.mjs";
+import { t as replyHelpersPlugin } from "../replyHelpers-boS5Rx26.mjs";
+import { n as sse_default, t as ssePlugin } from "../sse-jh5OqFjR.mjs";
+import { n as versioning_default, t as versioningPlugin } from "../versioning-CuIwUQZ2.mjs";
 import { randomUUID } from "node:crypto";
 import fp from "fastify-plugin";
 //#region src/core/arcCorePlugin.ts

package/dist/plugins/tracing-entry.d.mts

@@ -1,2 +1,2 @@
-import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-Dm8n7Cnn.mjs";
+import { a as traced, i as isTracingAvailable, n as _default, r as createSpan, t as TracingOptions } from "../tracing-bRqqUxFO.mjs";
 export { type TracingOptions, createSpan, isTracingAvailable, traced, _default as tracingPlugin };

package/dist/plugins/tracing-entry.mjs

@@ -58,7 +58,7 @@ try {
 function createTracerProvider(options) {
 	if (!isAvailable || !NodeTracerProvider || !BatchSpanProcessor || !OTLPTraceExporter) return null;
 	const { serviceName = "@classytic/arc", serviceVersion, exporterUrl = "http://localhost:4318/v1/traces" } = options;
-	const resolvedVersion = serviceVersion ?? "2.16.0";
+	const resolvedVersion = serviceVersion ?? "2.17.0";
 	const exporter = new OTLPTraceExporter({ url: exporterUrl });
 	const provider = new NodeTracerProvider({ resource: { attributes: {
 		"service.name": serviceName,

package/dist/preloadResources-BOXzPhKU.mjs

@@ -0,0 +1,45 @@
+//#region src/testing/preloadResources.ts
+/**
+* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
+*
+* Accepts either:
+* - `{ import: 'default' }` form: values are the resource directly
+* - default form: values are the full module — picks first export with `toPlugin()`
+*
+* Throws if any module doesn't yield a valid `ResourceLike`.
+*/
+function preloadResources(globResult) {
+	const resources = [];
+	for (const [path, value] of Object.entries(globResult)) {
+		const resource = pickResource(value);
+		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		resources.push(resource);
+	}
+	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+/**
+* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
+*
+* Use this when resources depend on prior bootstrap (e.g., engine init) and
+* cannot be evaluated at import time of the preload file.
+*/
+async function preloadResourcesAsync(globResult) {
+	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
+		const resource = pickResource(await loader());
+		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
+		return resource;
+	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
+}
+function pickResource(value) {
+	if (!value || typeof value !== "object") return void 0;
+	if (typeof value.toPlugin === "function") return value;
+	const mod = value;
+	const candidates = [
+		mod.default,
+		mod.resource,
+		...Object.values(mod)
+	];
+	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
+}
+//#endregion
+export { preloadResourcesAsync as n, preloadResources as t };

package/dist/presets/filesUpload.d.mts

@@ -1,7 +1,7 @@
-import { rt as PresetResult } from "../index-CkW0flkU.mjs";
-import { i as RequestScope } from "../types-DVfpSfx2.mjs";
-import { c as PermissionCheck } from "../fields-Anj0xdih.mjs";
-import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-D2KZJAmn.mjs";
+import { rt as PresetResult } from "../index-C1JSBan-.mjs";
+import { i as RequestScope } from "../types-CfapW2t8.mjs";
+import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
+import { a as StorageReadResult, i as StorageReadRange, n as StorageContext, o as StorageUploadInput, r as StorageFile, t as Storage } from "../storage-HcAgP5Ni.mjs";
 
 //#region src/presets/filesUpload.d.ts
 interface FilesUploadPresetRoutes {

package/dist/presets/filesUpload.mjs

@@ -1,7 +1,7 @@
 import { i as NotFoundError, u as ValidationError } from "../errors-j4aJm1Wg.mjs";
 import { c as getOrgId, g as getUserId } from "../types-Bi0r0vjG.mjs";
-import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
-import { t as multipartBody } from "../multipartBody-BOvVSVCD.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-B1Qy55fg.mjs";
+import { t as multipartBody } from "../multipartBody-VjVWmZl8.mjs";
 //#region src/presets/filesUpload.ts
 const DEFAULT_FIELD_NAME = "file";
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/presets/index.d.mts

@@ -1,4 +1,4 @@
-import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-CkW0flkU.mjs";
+import { Kt as AnyRecord, bt as IRequestContext, d as PaginationResult, rt as PresetResult, st as ResourceConfig, yt as IControllerResponse } from "../index-C1JSBan-.mjs";
 import { FilesUploadPresetOptions, FilesUploadPresetPermissions, FilesUploadPresetRoutes, filesUploadPreset } from "./filesUpload.mjs";
 import { MultiTenantOptions, TenantFieldSpec, multiTenantPreset } from "./multiTenant.mjs";
 import { SearchHandler, SearchPresetOptions, SearchRouteConfig, searchPreset } from "./search.mjs";

package/dist/presets/index.mjs

@@ -1,5 +1,5 @@
 import { multiTenantPreset } from "./multiTenant.mjs";
-import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-C9BE6WaZ.mjs";
+import { a as registerPreset, c as auditedPreset, d as ownedByUserPreset, i as getPreset, l as softDeletePreset, n as flexibleMultiTenantPreset, o as treePreset, r as getAvailablePresets, s as bulkPreset, t as applyPresets, u as slugLookupPreset } from "../presets-BYbPobbF.mjs";
 import { filesUploadPreset } from "./filesUpload.mjs";
 import { searchPreset } from "./search.mjs";
 export { applyPresets, auditedPreset, bulkPreset, filesUploadPreset, flexibleMultiTenantPreset, getAvailablePresets, getPreset, multiTenantPreset, ownedByUserPreset, registerPreset, searchPreset, slugLookupPreset, softDeletePreset, treePreset };

package/dist/presets/multiTenant.d.mts

@@ -1,4 +1,4 @@
-import { J as CrudRouteKey, rt as PresetResult } from "../index-CkW0flkU.mjs";
+import { J as CrudRouteKey, rt as PresetResult } from "../index-C1JSBan-.mjs";
 
 //#region src/presets/multiTenant.d.ts
 /**

package/dist/presets/search.d.mts

@@ -1,5 +1,5 @@
-import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-CkW0flkU.mjs";
-import { c as PermissionCheck } from "../fields-Anj0xdih.mjs";
+import { dt as RouteDefinition, ft as RouteMcpConfig, ht as ControllerHandler, rt as PresetResult } from "../index-C1JSBan-.mjs";
+import { c as PermissionCheck } from "../fields-DqZLp5d6.mjs";
 
 //#region src/presets/search.d.ts
 /**

package/dist/presets/search.mjs

@@ -1,4 +1,4 @@
-import { C as allowPublic, D as requireAuth } from "../permissions-CTxMrreC.mjs";
+import { C as requireAuth, y as allowPublic } from "../permissions-B1Qy55fg.mjs";
 //#region src/presets/search.ts
 const BUILTINS = [
 	{

package/dist/{presets-C9BE6WaZ.mjs → presets-BYbPobbF.mjs}

@@ -1,5 +1,5 @@
 import { b as isElevated, n as PUBLIC_SCOPE } from "./types-Bi0r0vjG.mjs";
-import { C as allowPublic, D as requireAuth, k as requireRoles } from "./permissions-CTxMrreC.mjs";
+import { C as requireAuth, T as requireRoles, y as allowPublic } from "./permissions-B1Qy55fg.mjs";
 import { multiTenantPreset } from "./presets/multiTenant.mjs";
 //#region src/presets/ownedByUser.ts
 /**
@@ -70,14 +70,16 @@ function softDeletePreset() {
 			handler: "getDeleted",
 			summary: "Get soft-deleted items",
 			permissions: permissions.list ?? requireRoles(["admin"]),
-			operation: "listDeleted"
+			operation: "listDeleted",
+			_presetSource: "softDelete"
 		}, {
 			method: "POST",
 			path: "/:id/restore",
 			handler: "restore",
 			summary: "Restore soft-deleted item",
 			permissions: permissions.update ?? requireRoles(["admin"]),
-			operation: "restore"
+			operation: "restore",
+			_presetSource: "softDelete"
 		}]
 	};
 }

package/dist/{queryCachePlugin-Biqzfbi5.d.mts → queryCachePlugin-Do4P_WBC.d.mts}

@@ -1,5 +1,5 @@
-import { r as CacheStore } from "./interface-CH0OQudo.mjs";
-import { i as QueryCache } from "./QueryCache-SvmT_9ti.mjs";
+import { r as CacheStore } from "./interface-BVkZsvEe.mjs";
+import { i as QueryCache } from "./QueryCache-8YmAQ-zW.mjs";
 import { FastifyPluginAsync } from "fastify";
 
 //#region src/cache/queryCachePlugin.d.ts

package/dist/{redis-Cyzrz6SX.d.mts → redis-cpqVb85w.d.mts}

@@ -1,4 +1,4 @@
-import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-NwJ_qPlY.mjs";
+import { n as IdempotencyResult, r as IdempotencyStore } from "./interface-DoE6UoC2.mjs";
 
 //#region src/idempotency/stores/redis.d.ts
 interface RedisClient {

package/dist/{redis-stream-DT-YjzrB.d.mts → redis-stream-BuiAS3aE.d.mts}

@@ -1,4 +1,4 @@
-import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-C-2oAHtw.mjs";
+import { a as EventTransport, i as EventLogger, n as DomainEvent, r as EventHandler } from "./EventTransport-B1GFiYUy.mjs";
 
 //#region src/events/transports/redis-stream.d.ts
 interface RedisStreamLike {