@dyrected/core 2.6.3 → 2.7.0

package/dist/__tests__/observability.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=observability.test.d.ts.map

package/dist/__tests__/observability.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/observability.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/observability.test.js

@@ -0,0 +1,233 @@
+import { Writable } from "node:stream";
+import pino from "pino";
+import { describe, expect, it } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { captureRequestBody, createObservabilityRuntime, redactBody, redactHeaders, resolveObservabilityConfig, shouldSampleRequest, } from "../observability.js";
+import { defineConfig } from "../index.js";
+import { MockDatabaseAdapter } from "./mocks.js";
+process.env.DYRECTED_JWT_SECRET ??= "test-secret";
+class LogCollector extends Writable {
+    lines = [];
+    _write(chunk, _encoding, callback) {
+        this.lines.push(chunk.toString());
+        callback();
+    }
+    entries() {
+        return this.lines
+            .join("")
+            .split("\n")
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+    }
+}
+function baseConfig() {
+    return defineConfig({
+        collections: [],
+        globals: [],
+        db: new MockDatabaseAdapter(),
+    });
+}
+describe("Observability", () => {
+    it("applies the documented defaults", () => {
+        const resolved = resolveObservabilityConfig();
+        expect(resolved.requestLogging.enabled).toBe(true);
+        expect(resolved.requestLogging.logBodies).toBe(false);
+        expect(resolved.requestLogging.maxBodyBytes).toBe(8192);
+        expect(resolved.sampling.successRate).toBe(0.1);
+        expect(resolved.sampling.traceSuccessRate).toBe(0.1);
+        expect(resolved.sampling.bodySuccessRate).toBe(0.02);
+        expect(resolved.sampling.alwaysKeep4xx).toBe(true);
+        expect(resolved.sampling.alwaysKeep5xx).toBe(true);
+        expect(resolved.tracing.enabled).toBe(false);
+        expect(resolved.metrics.enabled).toBe(false);
+        expect(resolved.requestLogging.redactHeaders).toEqual(expect.arrayContaining(["authorization", "cookie", "set-cookie", "x-api-key"]));
+        expect(resolved.requestLogging.redactPaths).toEqual(expect.arrayContaining(["password", "token", "secret", "apiKey"]));
+    });
+    it("passes through an instantiated logger", () => {
+        const collector = new LogCollector();
+        const logger = pino({}, collector);
+        const runtime = createObservabilityRuntime({
+            ...baseConfig(),
+            logger,
+        });
+        expect(runtime.logger).toBe(logger);
+    });
+    it("redacts headers and nested body fields", () => {
+        const observability = resolveObservabilityConfig({
+            requestLogging: {
+                includeHeaders: ["authorization", "x-request-id"],
+                redactPaths: ["profile.secret", "tokens.*.value"],
+            },
+        });
+        expect(redactHeaders({
+            Authorization: "Bearer secret",
+            "X-Request-Id": "req_123",
+            "Content-Type": "application/json",
+        }, observability)).toEqual({
+            authorization: "[REDACTED]",
+            "x-request-id": "req_123",
+        });
+        expect(redactBody({
+            password: "super-secret",
+            profile: { secret: "nested-secret" },
+            tokens: [{ value: "first" }, { value: "second" }],
+        }, observability.requestLogging.redactPaths)).toEqual({
+            password: "[REDACTED]",
+            profile: { secret: "[REDACTED]" },
+            tokens: [{ value: "[REDACTED]" }, { value: "[REDACTED]" }],
+        });
+    });
+    it("samples deterministically and always keeps failures", () => {
+        const sampling = resolveObservabilityConfig().sampling;
+        expect(shouldSampleRequest("req-1", 200, sampling, "log")).toBe(shouldSampleRequest("req-1", 200, sampling, "log"));
+        expect(shouldSampleRequest("req-1", 404, sampling, "log")).toBe(true);
+        expect(shouldSampleRequest("req-1", 500, sampling, "trace")).toBe(true);
+    });
+    it("captures only supported request bodies and reports truncated parse failures", async () => {
+        const observability = resolveObservabilityConfig({
+            requestLogging: {
+                logBodies: true,
+                maxBodyBytes: 16,
+            },
+        });
+        const multipartCapture = await captureRequestBody(new Request("http://localhost/upload", {
+            method: "POST",
+            headers: {
+                "content-type": "multipart/form-data; boundary=abc",
+            },
+            body: "--abc",
+        }), observability);
+        expect(multipartCapture).toEqual({
+            attempted: false,
+            contentType: "multipart/form-data; boundary=abc",
+            contentLength: undefined,
+        });
+        const jsonCapture = await captureRequestBody(new Request("http://localhost/echo", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ password: "very-secret", payload: "x".repeat(64) }),
+        }), observability);
+        expect(jsonCapture.attempted).toBe(true);
+        expect(jsonCapture.truncated).toBe(true);
+        expect(jsonCapture.parseFailed).toBe(true);
+        expect(jsonCapture.body).toBeUndefined();
+    });
+    it("logs structured request events with redaction and preserves request bodies for handlers", async () => {
+        const collector = new LogCollector();
+        const config = defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            logger: {
+                options: { level: "info" },
+                destination: collector,
+            },
+            observability: {
+                requestLogging: {
+                    logBodies: true,
+                    redactPaths: ["profile.secret"],
+                    includeHeaders: ["authorization", "content-type"],
+                },
+                sampling: {
+                    successRate: 1,
+                    bodySuccessRate: 1,
+                },
+            },
+        });
+        const app = await createDyrectedApp(config);
+        app.post("/echo", async (c) => c.json(await c.req.json()));
+        const response = await app.request("/echo", {
+            method: "POST",
+            headers: {
+                authorization: "Bearer super-secret",
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                password: "top-secret",
+                profile: { secret: "nested-secret" },
+                safe: "value",
+            }),
+        });
+        expect(response.status).toBe(200);
+        expect(await response.json()).toEqual({
+            password: "top-secret",
+            profile: { secret: "nested-secret" },
+            safe: "value",
+        });
+        const requestLog = collector
+            .entries()
+            .find((entry) => entry.msg === "HTTP request completed");
+        expect(requestLog).toMatchObject({
+            msg: "HTTP request completed",
+            method: "POST",
+            path: "/echo",
+            statusCode: 200,
+            sampled: true,
+            headers: {
+                authorization: "[REDACTED]",
+                "content-type": "application/json",
+            },
+            body: {
+                password: "[REDACTED]",
+                profile: { secret: "[REDACTED]" },
+                safe: "value",
+            },
+        });
+    });
+    it("uses warn and error levels for 4xx and 5xx request logs", async () => {
+        const collector = new LogCollector();
+        const app = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            logger: {
+                options: { level: "info" },
+                destination: collector,
+            },
+            observability: {
+                sampling: {
+                    successRate: 1,
+                },
+            },
+        }));
+        app.get("/bad-request", (c) => c.json({ error: true }, 400));
+        app.get("/boom", () => {
+            throw new Error("boom");
+        });
+        expect((await app.request("/bad-request")).status).toBe(400);
+        expect((await app.request("/boom")).status).toBe(500);
+        const requestLogs = collector
+            .entries()
+            .filter((entry) => entry.msg === "HTTP request completed");
+        expect(requestLogs.find((entry) => entry.path === "/bad-request")?.level).toBe(40);
+        expect(requestLogs.find((entry) => entry.path === "/boom")?.level).toBe(50);
+    });
+    it("only exposes the Prometheus metrics route when configured", async () => {
+        const enabledApp = await createDyrectedApp(defineConfig({
+            collections: [],
+            globals: [],
+            db: new MockDatabaseAdapter(),
+            observability: {
+                metrics: {
+                    enabled: true,
+                    exporter: "prometheus",
+                    path: "/metricsz",
+                },
+                sampling: {
+                    successRate: 1,
+                },
+            },
+        }));
+        await enabledApp.request("/health");
+        const metricsResponse = await enabledApp.request("/metricsz");
+        expect(metricsResponse.status).toBe(200);
+        expect(await metricsResponse.text()).toContain("dyrected_http_requests_total");
+        const disabledApp = await createDyrectedApp(baseConfig());
+        const missingMetricsResponse = await disabledApp.request("/metrics");
+        expect(missingMetricsResponse.status).toBe(404);
+    });
+});
+//# sourceMappingURL=observability.test.js.map

package/dist/__tests__/observability.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.test.js","sourceRoot":"","sources":["../../src/__tests__/observability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,UAAU,EACV,aAAa,EACb,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,aAAa,CAAC;AAElD,MAAM,YAAa,SAAQ,QAAQ;IACxB,KAAK,GAAa,EAAE,CAAC;IAErB,MAAM,CACb,KAAsB,EACtB,SAAyB,EACzB,QAAwC;QAExC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,CAAC;IACb,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK;aACd,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAC;IAChE,CAAC;CACF;AAED,SAAS,UAAU;IACjB,OAAO,YAAY,CAAC;QAClB,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,OAAO,CACnD,MAAM,CAAC,eAAe,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAC/E,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CACjD,MAAM,CAAC,eAAe,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,SAAS,GAAG,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,0BAA0B,CAAC;YACzC,GAAG,UAAU,EAAE;YACf,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,aAAa,GAAG,0BAA0B,CAAC;YAC/C,cAAc,EAAE;gBACd,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;gBACjD,WAAW,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,CACJ,aAAa,CACX;YACE,aAAa,EAAE,eAAe;YAC9B,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,kBAAkB;SACnC,EACD,aAAa,CACd,CACF,CAAC,OAAO,CAAC;YACR,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE,SAAS;SAC1B,CAAC,CAAC;QAEH,MAAM,CACJ,UAAU,CACR;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;YACpC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAClD,EACD,aAAa,CAAC,cAAc,CAAC,WAAW,CACzC,CACF,CAAC,OAAO,CAAC;YACR,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;YACjC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC,QAAQ,CAAC;QAEvD,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAC7D,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CACnD,CAAC;QACF,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,aAAa,GAAG,0BAA0B,CAAC;YAC/C,cAAc,EAAE;gBACd,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,EAAE;aACjB;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAC/C,IAAI,OAAO,CAAC,yBAAyB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,OAAO;SACd,CAAC,EACF,aAAa,CACd,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,mCAAmC;YAChD,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C,IAAI,OAAO,CAAC,uBAAuB,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;SAC3E,CAAC,EACF,aAAa,CACd,CAAC;QAEF,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,SAAS,GAAG,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC1B,WAAW,EAAE,SAAS;aACvB;YACD,aAAa,EAAE;gBACb,cAAc,EAAE;oBACd,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,CAAC,gBAAgB,CAAC;oBAC/B,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;iBAClD;gBACD,QAAQ,EAAE;oBACR,WAAW,EAAE,CAAC;oBACd,eAAe,EAAE,CAAC;iBACnB;aACF;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE5C,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,qBAAqB;gBACpC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;gBACpC,IAAI,EAAE,OAAO;aACd,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACpC,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;YACpC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,SAAS;aACzB,OAAO,EAAE;aACT,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAE3D,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC;YAC/B,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,YAAY;gBAC3B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE;gBACJ,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;gBACjC,IAAI,EAAE,OAAO;aACd;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,SAAS,GAAG,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CACjC,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,MAAM,EAAE;gBACN,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;gBAC1B,WAAW,EAAE,SAAS;aACvB;YACD,aAAa,EAAE;gBACb,QAAQ,EAAE;oBACR,WAAW,EAAE,CAAC;iBACf;aACF;SACF,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAG,SAAS;aAC1B,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAE7D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,YAAY,CAAC;YACX,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,IAAI,mBAAmB,EAAE;YAC7B,aAAa,EAAE;gBACb,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,YAAY;oBACtB,IAAI,EAAE,WAAW;iBAClB;gBACD,QAAQ,EAAE;oBACR,WAAW,EAAE,CAAC;iBACf;aACF;SACF,CAAC,CACH,CAAC;QAEF,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAE9D,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QAE/E,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,sBAAsB,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErE,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/openapi.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=openapi.test.d.ts.map

package/dist/__tests__/openapi.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/openapi.test.js

@@ -0,0 +1,105 @@
+import { describe, expect, it } from "vitest";
+import { defineCollection, defineConfig, defineGlobal } from "../index.js";
+import { generateOpenApi } from "../utils/openapi.js";
+import { publishingWorkflow } from "../workflows.js";
+const config = defineConfig({
+    collections: [
+        defineCollection({
+            slug: "users",
+            auth: true,
+            fields: [{ name: "name", type: "text", label: "Name" }],
+        }),
+        defineCollection({
+            slug: "media",
+            upload: true,
+            fields: [{ name: "alt", type: "text", label: "Alternative text" }],
+        }),
+        defineCollection({
+            slug: "posts",
+            audit: true,
+            workflow: publishingWorkflow(),
+            fields: [{ name: "title", type: "text", label: "Title" }],
+        }),
+    ],
+    globals: [
+        defineGlobal({
+            slug: "settings",
+            fields: [{ name: "siteName", type: "text", label: "Site name" }],
+        }),
+    ],
+    storage: {
+        upload: async ({ filename, mimeType }) => ({
+            filename,
+            mimeType,
+            url: filename,
+        }),
+        delete: async () => { },
+        getURL: ({ filename }) => filename,
+    },
+});
+describe("OpenAPI generation", () => {
+    it("covers every public route family for a maximal config", () => {
+        const spec = generateOpenApi(config);
+        const paths = Object.keys(spec.paths);
+        expect(paths).toEqual(expect.arrayContaining([
+            "/api/schemas",
+            "/api/openapi.json",
+            "/api/docs",
+            "/api/dyrected/options/{collection}/{field}",
+            "/api/preferences/{key}",
+            "/api/preview-token",
+            "/api/preview-data",
+            "/api/audit",
+            "/api/collections/posts",
+            "/api/collections/posts/__audit",
+            "/api/collections/posts/{id}",
+            "/api/collections/posts/delete-many",
+            "/api/collections/posts/{id}/transitions/{transition}",
+            "/api/collections/posts/{id}/workflow-history",
+            "/api/collections/users/login",
+            "/api/collections/users/accept-invite",
+            "/api/collections/users/{id}/change-password",
+            "/api/collections/media/media",
+            "/api/collections/media/media/{filename}",
+            "/api/globals/settings",
+            "/api/media/{filename}",
+        ]));
+        expect(spec.paths["/api/collections/posts"]?.get?.tags).toEqual(["Collection: posts"]);
+        expect(spec.paths["/api/collections/posts"]?.get?.parameters).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                name: "search",
+                in: "query",
+            }),
+        ]));
+        expect(spec.paths["/api/collections/users/login"]?.post?.tags).toEqual(["Collection: users"]);
+        expect(spec.paths["/api/globals/settings"]?.get?.tags).toEqual(["Global: settings"]);
+    });
+    it("describes all FieldType variants used by the schema generator", () => {
+        const spec = generateOpenApi(defineConfig({
+            collections: [
+                defineCollection({
+                    slug: "fields",
+                    fields: [
+                        { name: "when", type: "datetime", label: "When" },
+                        { name: "clock", type: "time", label: "Clock" },
+                        { name: "icon", type: "icon", label: "Icon" },
+                        {
+                            name: "images",
+                            type: "image",
+                            label: "Images",
+                            relationTo: "media",
+                            hasMany: true,
+                        },
+                    ],
+                }),
+            ],
+            globals: [],
+        }));
+        const properties = spec.components.schemas.fields.properties;
+        expect(properties.when.format).toBe("date-time");
+        expect(properties.clock.format).toBe("time");
+        expect(properties.icon.type).toBe("string");
+        expect(properties.images.type).toBe("array");
+    });
+});
+//# sourceMappingURL=openapi.test.js.map

package/dist/__tests__/openapi.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.test.js","sourceRoot":"","sources":["../../src/__tests__/openapi.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,MAAM,GAAG,YAAY,CAAC;IAC1B,WAAW,EAAE;QACX,gBAAgB,CAAC;YACf,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACxD,CAAC;QACF,gBAAgB,CAAC;YACf,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;SACnE,CAAC;QACF,gBAAgB,CAAC;YACf,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,kBAAkB,EAAE;YAC9B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SAC1D,CAAC;KACH;IACD,OAAO,EAAE;QACP,YAAY,CAAC;YACX,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;SACjE,CAAC;KACH;IACD,OAAO,EAAE;QACP,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACzC,QAAQ;YACR,QAAQ;YACR,GAAG,EAAE,QAAQ;SACd,CAAC;QACF,MAAM,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACtB,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ;KACnC;CACF,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CACnB,MAAM,CAAC,eAAe,CAAC;YACrB,cAAc;YACd,mBAAmB;YACnB,WAAW;YACX,4CAA4C;YAC5C,wBAAwB;YACxB,oBAAoB;YACpB,mBAAmB;YACnB,YAAY;YACZ,wBAAwB;YACxB,gCAAgC;YAChC,6BAA6B;YAC7B,oCAAoC;YACpC,sDAAsD;YACtD,8CAA8C;YAC9C,8BAA8B;YAC9B,sCAAsC;YACtC,6CAA6C;YAC7C,8BAA8B;YAC9B,yCAAyC;YACzC,uBAAuB;YACvB,uBAAuB;SACxB,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,OAAO,CACnE,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,OAAO;aACZ,CAAC;SACH,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,eAAe,CAC1B,YAAY,CAAC;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;wBACjD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;wBAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;wBAC7C;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,QAAQ;4BACf,UAAU,EAAE,OAAO;4BACnB,OAAO,EAAE,IAAI;yBACd;qBACF;iBACF,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CACH,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/parse-sort.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=parse-sort.test.d.ts.map

package/dist/__tests__/parse-sort.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-sort.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/parse-sort.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/parse-sort.test.js

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { parseSort } from '../utils/parse-sort.js';
+describe('parseSort', () => {
+    it('parses leading dash as descending sort direction', () => {
+        expect(parseSort('-updatedAt')).toEqual([{ field: 'updatedAt', direction: 'DESC' }]);
+    });
+    it('parses explicit SQL-style sort directions', () => {
+        expect(parseSort('updatedAt DESC')).toEqual([{ field: 'updatedAt', direction: 'DESC' }]);
+        expect(parseSort('title ASC')).toEqual([{ field: 'title', direction: 'ASC' }]);
+    });
+    it('defaults bare fields to ascending order', () => {
+        expect(parseSort('title')).toEqual([{ field: 'title', direction: 'ASC' }]);
+    });
+    it('supports comma-separated sort clauses', () => {
+        expect(parseSort('title,-updatedAt')).toEqual([
+            { field: 'title', direction: 'ASC' },
+            { field: 'updatedAt', direction: 'DESC' },
+        ]);
+    });
+    it('falls back when the sort string is not in the supported grammar', () => {
+        expect(parseSort('updatedAt; DROP TABLE posts')).toEqual([{ field: 'createdAt', direction: 'DESC' }]);
+    });
+});
+//# sourceMappingURL=parse-sort.test.js.map

package/dist/__tests__/parse-sort.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-sort.test.js","sourceRoot":"","sources":["../../src/__tests__/parse-sort.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;YACpC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/preferences.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=preferences.test.d.ts.map

package/dist/__tests__/preferences.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preferences.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/preferences.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/preferences.test.js

@@ -0,0 +1,168 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { defineConfig, defineCollection } from "../index.js";
+import { InMemoryAdapter } from "./mocks.js";
+import { signCollectionToken } from "../auth/token.js";
+describe("Preferences API Scopes", async () => {
+    process.env.DYRECTED_JWT_SECRET = "my-test-secret-that-is-at-least-32-chars-long";
+    const db = new InMemoryAdapter();
+    const config = defineConfig({
+        collections: [
+            defineCollection({
+                slug: "users",
+                auth: true,
+                fields: [
+                    { name: "email", type: "email", label: "Email" },
+                    { name: "roles", type: "json", label: "Roles" },
+                ],
+            }),
+        ],
+        globals: [],
+        db,
+    });
+    const app = await createDyrectedApp(config);
+    let editorToken;
+    let adminToken;
+    beforeEach(async () => {
+        // Clear in-memory DB
+        db.store = {};
+        // Seed users
+        const editor = await db.create({
+            collection: "users",
+            data: { id: "user-editor", email: "editor@test.com", roles: ["editor"] },
+        });
+        const admin = await db.create({
+            collection: "users",
+            data: { id: "user-admin", email: "admin@test.com", roles: ["admin"] },
+        });
+        editorToken = await signCollectionToken({
+            sub: editor.id,
+            email: editor.email,
+            collection: "users",
+            roles: ["editor"],
+        });
+        adminToken = await signCollectionToken({
+            sub: admin.id,
+            email: admin.email,
+            collection: "users",
+            roles: ["admin"],
+        });
+    });
+    it("should return null if no personal or global preference exists", async () => {
+        const res = await app.request("/api/preferences/test-key", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.value).toBeNull();
+    });
+    it("should set and get personal preference successfully", async () => {
+        const putRes = await app.request("/api/preferences/test-key?scope=personal", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${editorToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["fieldA", "fieldB"] }),
+        });
+        expect(putRes.status).toBe(200);
+        const getRes = await app.request("/api/preferences/test-key", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(getRes.status).toBe(200);
+        const getData = await getRes.json();
+        expect(getData.value).toEqual(["fieldA", "fieldB"]);
+    });
+    it("should block non-admins from saving global preferences", async () => {
+        const putRes = await app.request("/api/preferences/test-key?scope=global", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${editorToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["fieldA", "fieldB"] }),
+        });
+        expect(putRes.status).toBe(403);
+    });
+    it("should allow admins to save global preferences and fallback for editors", async () => {
+        const putRes = await app.request("/api/preferences/test-key?scope=global", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${adminToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["fieldA", "fieldB"] }),
+        });
+        expect(putRes.status).toBe(200);
+        // Editor should fall back to global preference
+        const editorGetRes = await app.request("/api/preferences/test-key", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(editorGetRes.status).toBe(200);
+        const editorData = await editorGetRes.json();
+        expect(editorData.value).toEqual(["fieldA", "fieldB"]);
+    });
+    it("should allow retrieving only global preferences bypassing personal override when scope=global", async () => {
+        // 1. Save global default
+        await app.request("/api/preferences/test-key?scope=global", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${adminToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["globalField"] }),
+        });
+        // 2. Editor overrides personally
+        await app.request("/api/preferences/test-key?scope=personal", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${editorToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["personalField"] }),
+        });
+        // 3. GET with scope=personal/default should return personal
+        const resPersonal = await app.request("/api/preferences/test-key", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(await resPersonal.json()).toEqual({ key: "test-key", value: ["personalField"] });
+        // 4. GET with scope=global should return global
+        const resGlobal = await app.request("/api/preferences/test-key?scope=global", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(await resGlobal.json()).toEqual({ key: "test-key", value: ["globalField"] });
+    });
+    it("should support DELETE personal preference falling back to global", async () => {
+        // Save global
+        await app.request("/api/preferences/test-key?scope=global", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${adminToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["globalField"] }),
+        });
+        // Save personal
+        await app.request("/api/preferences/test-key?scope=personal", {
+            method: "PUT",
+            headers: {
+                Authorization: `Bearer ${editorToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ value: ["personalField"] }),
+        });
+        // Delete personal
+        const delRes = await app.request("/api/preferences/test-key?scope=personal", {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(delRes.status).toBe(200);
+        // Get (should fall back to global)
+        const getRes = await app.request("/api/preferences/test-key", {
+            headers: { Authorization: `Bearer ${editorToken}` },
+        });
+        expect(getRes.status).toBe(200);
+        expect(await getRes.json()).toEqual({ key: "test-key", value: ["globalField"] });
+    });
+});
+//# sourceMappingURL=preferences.test.js.map

package/dist/__tests__/preferences.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preferences.test.js","sourceRoot":"","sources":["../../src/__tests__/preferences.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,QAAQ,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;IAC5C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,+CAA+C,CAAC;IAElF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,WAAW,EAAE;YACX,gBAAgB,CAAC;gBACf,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;oBAChD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;iBAChD;aACF,CAAC;SACH;QACD,OAAO,EAAE,EAAE;QACX,EAAE;KACH,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,WAAmB,CAAC;IACxB,IAAI,UAAkB,CAAC;IAEvB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,qBAAqB;QACpB,EAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAEvB,aAAa;QACb,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC7B,UAAU,EAAE,OAAO;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;SACzE,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;YAC5B,UAAU,EAAE,OAAO;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;SACtE,CAAC,CAAC;QAEH,WAAW,GAAG,MAAM,mBAAmB,CAAC;YACtC,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,CAAC,QAAQ,CAAC;SAClB,CAAC,CAAC;QAEH,UAAU,GAAG,MAAM,mBAAmB,CAAC;YACrC,GAAG,EAAE,KAAK,CAAC,EAAE;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,CAAC,OAAO,CAAC;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE;YACzD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE;YAC3E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE;YACzE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE;YACzE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,+CAA+C;QAC/C,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE;YAClE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,yBAAyB;QACzB,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC1D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,iCAAiC;QACjC,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE;YAC5D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,4DAA4D;QAC5D,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE;YACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAExF,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC5E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,cAAc;QACd,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC1D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,EAAE;gBACrC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,gBAAgB;QAChB,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE;YAC5D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,kBAAkB;QAClB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE;YAC3E,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,2BAA2B,EAAE;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/router.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=router.test.d.ts.map

package/dist/__tests__/router.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/router.test.ts"],"names":[],"mappings":""}