@forklaunch/core 1.0.9 → 1.0.10

package/lib/http/index.d.mts

@@ -3,8 +3,8 @@ export { ParsedQs } from 'qs';
 import { Prettify, SanitizePathSlashes, PrettyCamelCase, TypeSafeFunction, UnionToIntersection, EmptyObject } from '@forklaunch/common';
 import { AnySchemaValidator } from '@forklaunch/validator';
 import { ServerOptions, IncomingMessage, ServerResponse } from 'node:http';
-import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, O as OpenTelemetryCollector, i as MetricsDefinition, j as ExpressLikeApplicationOptions, k as ParamsDictionary, l as VersionedRequests, m as AuthMethods, D as DecodeResource, n as BasicAuthMethods, F as ForklaunchRequest, o as MiddlewareContractDetails, p as ExpressLikeSchemaAuthMapper, q as ForklaunchNextFunction, r as ForklaunchResponse, s as ForklaunchResHeaders, t as ForklaunchStatusResponse, u as ForklaunchSendableData, T as TelemetryOptions, v as LoggerMeta, w as LogFn } from '../apiDefinition.types-Br0fDuBQ.mjs';
-export { x as AccessLevel, y as BodyObject, z as DefaultSubscriptionData, G as DocsConfiguration, I as ErrorContainer, J as ExpressLikeAuthMapper, K as ExpressLikeGlobalAuthOptions, N as ExpressLikeHandler, U as ExpressLikeSchemaGlobalAuthOptions, W as ExtractBody, X as ExtractContentType, Y as ExtractResponseBody, Z as ExtractedParamsObject, _ as FileBody, $ as ForklaunchBaseRequest, a0 as ForklaunchResErrors, a1 as HmacMethods, a2 as HttpMethod, a3 as JsonBody, a4 as JwtAuthMethods, a5 as LiveTypeFunctionRequestInit, a6 as MapParamsSchema, a7 as MapReqBodySchema, a8 as MapReqHeadersSchema, a9 as MapReqQuerySchema, aa as MapResBodyMapSchema, ab as MapResHeadersSchema, ac as MapSchema, ad as MapSessionSchema, ae as MapVersionedReqsSchema, af as MapVersionedRespsSchema, ag as MetricType, ah as MultipartForm, ai as NumberOnlyObject, aj as PathParamMethod, ak as PermissionSet, al as RawTypedResponseBody, am as RequestContext, an as ResolvedForklaunchAuthRequest, ao as ResolvedForklaunchRequest, ap as ResolvedForklaunchResponse, aq as ResponseBody, ar as ResponseCompiledSchema, as as ResponseShape, at as RoleSet, au as ServerSentEventBody, S as StringOnlyObject, av as TextBody, aw as TypedBody, ax as TypedRequestBody, ay as TypedResponseBody, az as UnknownBody, aA as UnknownResponseBody, aB as UrlEncodedForm, aC as VersionedResponses, aD as httpRequestsTotalCounter, aE as httpServerDurationHistogram } from '../apiDefinition.types-Br0fDuBQ.mjs';
+import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, O as OpenTelemetryCollector, i as MetricsDefinition, j as ExpressLikeApplicationOptions, k as ParamsDictionary, l as VersionedRequests, m as AuthMethods, D as DecodeResource, n as BasicAuthMethods, F as ForklaunchRequest, o as MiddlewareContractDetails, p as ExpressLikeSchemaAuthMapper, q as ForklaunchNextFunction, r as ForklaunchResponse, s as ForklaunchResHeaders, t as ForklaunchStatusResponse, u as ForklaunchSendableData, T as TelemetryOptions, v as LoggerMeta, w as LogFn } from '../contractDetails.types-BgnK-dCg.mjs';
+export { x as AccessLevel, y as BodyObject, z as DefaultSubscriptionData, G as DocsConfiguration, I as ErrorContainer, J as ExpressLikeAuthMapper, K as ExpressLikeGlobalAuthOptions, N as ExpressLikeHandler, U as ExpressLikeSchemaGlobalAuthOptions, W as ExtractBody, X as ExtractContentType, Y as ExtractResponseBody, Z as ExtractedParamsObject, _ as FileBody, $ as ForklaunchBaseRequest, a0 as ForklaunchResErrors, a1 as HmacMethods, a2 as HttpMethod, a3 as JsonBody, a4 as JwtAuthMethods, a5 as LiveTypeFunctionRequestInit, a6 as MapParamsSchema, a7 as MapReqBodySchema, a8 as MapReqHeadersSchema, a9 as MapReqQuerySchema, aa as MapResBodyMapSchema, ab as MapResHeadersSchema, ac as MapSchema, ad as MapSessionSchema, ae as MapVersionedReqsSchema, af as MapVersionedRespsSchema, ag as MetricType, ah as MultipartForm, ai as NumberOnlyObject, aj as PathParamMethod, ak as PermissionSet, al as RawTypedResponseBody, am as RequestContext, an as ResolvedForklaunchAuthRequest, ao as ResolvedForklaunchRequest, ap as ResolvedForklaunchResponse, aq as ResponseBody, ar as ResponseCompiledSchema, as as ResponseShape, at as RoleSet, au as ServerSentEventBody, S as StringOnlyObject, av as TextBody, aw as TypedBody, ax as TypedRequestBody, ay as TypedResponseBody, az as UnknownBody, aA as UnknownResponseBody, aB as UrlEncodedForm, aC as VersionedResponses, aD as httpRequestsTotalCounter, aE as httpServerDurationHistogram } from '../contractDetails.types-BgnK-dCg.mjs';
 import { JWTPayload, JWK } from 'jose';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { FastMCP } from 'fastmcp';

package/lib/http/index.d.ts

@@ -3,8 +3,8 @@ export { ParsedQs } from 'qs';
 import { Prettify, SanitizePathSlashes, PrettyCamelCase, TypeSafeFunction, UnionToIntersection, EmptyObject } from '@forklaunch/common';
 import { AnySchemaValidator } from '@forklaunch/validator';
 import { ServerOptions, IncomingMessage, ServerResponse } from 'node:http';
-import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, O as OpenTelemetryCollector, i as MetricsDefinition, j as ExpressLikeApplicationOptions, k as ParamsDictionary, l as VersionedRequests, m as AuthMethods, D as DecodeResource, n as BasicAuthMethods, F as ForklaunchRequest, o as MiddlewareContractDetails, p as ExpressLikeSchemaAuthMapper, q as ForklaunchNextFunction, r as ForklaunchResponse, s as ForklaunchResHeaders, t as ForklaunchStatusResponse, u as ForklaunchSendableData, T as TelemetryOptions, v as LoggerMeta, w as LogFn } from '../apiDefinition.types-Br0fDuBQ.js';
-export { x as AccessLevel, y as BodyObject, z as DefaultSubscriptionData, G as DocsConfiguration, I as ErrorContainer, J as ExpressLikeAuthMapper, K as ExpressLikeGlobalAuthOptions, N as ExpressLikeHandler, U as ExpressLikeSchemaGlobalAuthOptions, W as ExtractBody, X as ExtractContentType, Y as ExtractResponseBody, Z as ExtractedParamsObject, _ as FileBody, $ as ForklaunchBaseRequest, a0 as ForklaunchResErrors, a1 as HmacMethods, a2 as HttpMethod, a3 as JsonBody, a4 as JwtAuthMethods, a5 as LiveTypeFunctionRequestInit, a6 as MapParamsSchema, a7 as MapReqBodySchema, a8 as MapReqHeadersSchema, a9 as MapReqQuerySchema, aa as MapResBodyMapSchema, ab as MapResHeadersSchema, ac as MapSchema, ad as MapSessionSchema, ae as MapVersionedReqsSchema, af as MapVersionedRespsSchema, ag as MetricType, ah as MultipartForm, ai as NumberOnlyObject, aj as PathParamMethod, ak as PermissionSet, al as RawTypedResponseBody, am as RequestContext, an as ResolvedForklaunchAuthRequest, ao as ResolvedForklaunchRequest, ap as ResolvedForklaunchResponse, aq as ResponseBody, ar as ResponseCompiledSchema, as as ResponseShape, at as RoleSet, au as ServerSentEventBody, S as StringOnlyObject, av as TextBody, aw as TypedBody, ax as TypedRequestBody, ay as TypedResponseBody, az as UnknownBody, aA as UnknownResponseBody, aB as UrlEncodedForm, aC as VersionedResponses, aD as httpRequestsTotalCounter, aE as httpServerDurationHistogram } from '../apiDefinition.types-Br0fDuBQ.js';
+import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, O as OpenTelemetryCollector, i as MetricsDefinition, j as ExpressLikeApplicationOptions, k as ParamsDictionary, l as VersionedRequests, m as AuthMethods, D as DecodeResource, n as BasicAuthMethods, F as ForklaunchRequest, o as MiddlewareContractDetails, p as ExpressLikeSchemaAuthMapper, q as ForklaunchNextFunction, r as ForklaunchResponse, s as ForklaunchResHeaders, t as ForklaunchStatusResponse, u as ForklaunchSendableData, T as TelemetryOptions, v as LoggerMeta, w as LogFn } from '../contractDetails.types-BgnK-dCg.js';
+export { x as AccessLevel, y as BodyObject, z as DefaultSubscriptionData, G as DocsConfiguration, I as ErrorContainer, J as ExpressLikeAuthMapper, K as ExpressLikeGlobalAuthOptions, N as ExpressLikeHandler, U as ExpressLikeSchemaGlobalAuthOptions, W as ExtractBody, X as ExtractContentType, Y as ExtractResponseBody, Z as ExtractedParamsObject, _ as FileBody, $ as ForklaunchBaseRequest, a0 as ForklaunchResErrors, a1 as HmacMethods, a2 as HttpMethod, a3 as JsonBody, a4 as JwtAuthMethods, a5 as LiveTypeFunctionRequestInit, a6 as MapParamsSchema, a7 as MapReqBodySchema, a8 as MapReqHeadersSchema, a9 as MapReqQuerySchema, aa as MapResBodyMapSchema, ab as MapResHeadersSchema, ac as MapSchema, ad as MapSessionSchema, ae as MapVersionedReqsSchema, af as MapVersionedRespsSchema, ag as MetricType, ah as MultipartForm, ai as NumberOnlyObject, aj as PathParamMethod, ak as PermissionSet, al as RawTypedResponseBody, am as RequestContext, an as ResolvedForklaunchAuthRequest, ao as ResolvedForklaunchRequest, ap as ResolvedForklaunchResponse, aq as ResponseBody, ar as ResponseCompiledSchema, as as ResponseShape, at as RoleSet, au as ServerSentEventBody, S as StringOnlyObject, av as TextBody, aw as TypedBody, ax as TypedRequestBody, ay as TypedResponseBody, az as UnknownBody, aA as UnknownResponseBody, aB as UrlEncodedForm, aC as VersionedResponses, aD as httpRequestsTotalCounter, aE as httpServerDurationHistogram } from '../contractDetails.types-BgnK-dCg.js';
 import { JWTPayload, JWK } from 'jose';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { FastMCP } from 'fastmcp';

package/lib/persistence/index.d.mts

@@ -1,9 +1,8 @@
-import { PropertyBuilders, UniversalPropertyOptionsBuilder, PropertyChain, EmptyOptions, EntityMetadataWithProperties, EntitySchemaWithMeta, InferEntityFromProperties, EventSubscriber, EventArgs, FilterDef, EntityManager, MikroORM } from '@mikro-orm/core';
+import { PropertyChain, PropertyBuilders, UniversalPropertyOptionsBuilder, EmptyOptions, EntityMetadataWithProperties, EntitySchemaWithMeta, InferEntityFromProperties, EventSubscriber, EventArgs, FilterDef, EntityManager, MikroORM } from '@mikro-orm/core';
 export { InferEntity } from '@mikro-orm/core';
 
 /**
  * Classification levels for entity field compliance.
- * Drives encryption (phi/pci), audit log redaction (all non-none), and compliance reporting.
  */
 declare const ComplianceLevel: {
     readonly pii: "pii";
@@ -16,56 +15,40 @@ declare function getComplianceMetadata(entityName: string, fieldName: string): C
 declare function getEntityComplianceFields(entityName: string): Map<string, ComplianceLevel> | undefined;
 declare function entityHasEncryptedFields(entityName: string): boolean;
 /**
- * Brand symbol on unclassified scalar properties. Properties with this brand
- * are rejected by `defineComplianceEntity`. Calling `.compliance()` strips
- * the brand and returns raw `PropertyChain<V, O>`.
- */
-declare const NEEDS_CLASSIFICATION: unique symbol;
-interface NeedsClassification {
-    readonly [NEEDS_CLASSIFICATION]: true;
-}
-/**
- * Brand on classified scalar properties. Added by `.compliance()`.
- * Uses a regular string property (not unique symbol) so it survives
- * .d.ts boundaries across packages without identity divergence.
- * MikroORM's InferBuilderValue only checks ~type and ~options — it
- * ignores this property.
+ * A wrapper object that holds the raw MikroORM PropertyChain in `__inner`
+ * and the compliance classification in `__compliance`.
+ *
+ * This is what `.compliance()` returns. `defineComplianceEntity` requires
+ * this wrapper for scalar properties, extracts `__inner` for the return
+ * type (so InferEntity sees pure PropertyChain), and reads `__compliance`
+ * for the metadata registry.
+ *
+ * At runtime this is still a Proxy wrapping the MikroORM builder —
+ * the `__inner`/`__compliance` are type-level only.
  */
-interface ClassifiedProperty {
-    readonly __forklaunch_classified: true;
+interface ClassifiedProperty<Value = unknown, Options = unknown> {
+    readonly __inner: PropertyChain<Value, Options>;
+    readonly __compliance: ComplianceLevel;
 }
 /**
- * An unclassified scalar property builder. Has all `PropertyChain` methods
- * (remapped to preserve `.compliance()` through chaining) plus the
- * `.compliance()` method itself.
- *
- * Carries the `NEEDS_CLASSIFICATION` brand — `defineComplianceEntity`
- * rejects properties with this brand.
+ * An unclassified scalar property builder. All PropertyChain methods
+ * are remapped to return ForklaunchPropertyChain (preserving .compliance()
+ * through chains). `.compliance(level)` returns a ClassifiedProperty wrapper.
  *
- * `.compliance(level)` returns the raw `PropertyChain<Value, Options>`
- * from MikroORM (no brand) — which `defineEntity` and `InferEntity`
- * understand natively.
+ * NOT assignable to ClassifiedProperty — defineComplianceEntity rejects it.
  */
-type ForklaunchPropertyChain<Value, Options> = RemapReturns<Value, Options> & NeedsClassification & {
-    /**
-     * Classify this field's compliance level. Returns the raw MikroORM
-     * `PropertyChain` so `InferEntity` works without interference.
-     */
-    compliance(level: ComplianceLevel): PropertyChain<Value, Options> & ClassifiedProperty;
+type ForklaunchPropertyChain<Value, Options> = RemapReturns<Value, Options> & {
+    compliance(level: ComplianceLevel): ClassifiedProperty<Value, Options>;
 };
 type RemapReturns<Value, Options> = {
     [K in keyof PropertyChain<Value, Options>]: PropertyChain<Value, Options>[K] extends (...args: infer A) => PropertyChain<infer V2, infer O2> ? (...args: A) => ForklaunchPropertyChain<V2, O2> : PropertyChain<Value, Options>[K];
 };
 type RelationBuilderKeys = 'manyToOne' | 'oneToMany' | 'manyToMany' | 'oneToOne' | 'embedded';
-/**
- * Generic methods on PropertyBuilders that need explicit signatures
- * because mapped types collapse their type parameters.
- */
 type GenericBuilderKeys = 'json' | 'formula' | 'type' | 'bigint' | 'array' | 'decimal' | 'enum';
 /**
  * The type of `fp`:
- * - Scalar methods → `ForklaunchPropertyChain` (must call `.compliance()`)
- * - Relation methods → raw `PropertyChain` (auto-classified at runtime, no brand)
+ * - Scalar methods → ForklaunchPropertyChain (must call .compliance())
+ * - Relation methods → raw PropertyChain (auto-classified at runtime)
  * - Generic methods → explicit signatures preserving type parameters
  */
 type ForklaunchPropertyBuilders = {
@@ -81,6 +64,15 @@ type ForklaunchPropertyBuilders = {
     decimal: <Mode extends 'number' | 'string' = 'string'>(mode?: Mode) => ForklaunchPropertyChain<Mode extends 'number' ? number : string, EmptyOptions>;
     enum: <const T extends (number | string)[] | (() => Record<string, unknown>)>(items?: T) => ForklaunchPropertyChain<T extends () => Record<string, unknown> ? T extends () => infer R ? R[keyof R] : never : T extends (infer Value)[] ? Value : T, EmptyOptions>;
 };
+/**
+ * For each property in T:
+ * - ClassifiedProperty<V,O> → PropertyChain<V,O> (extract __inner)
+ * - Functions (lazy relations) → pass through unchanged
+ * - Raw PropertyChain (relations from fp.manyToOne) → pass through
+ */
+type ExtractInner<T> = {
+    [K in keyof T]: T[K] extends ClassifiedProperty<infer V, infer O> ? PropertyChain<V, O> : T[K];
+};
 
 /**
  * ForkLaunch property builder. Drop-in replacement for MikroORM's `p`
@@ -108,53 +100,27 @@ type ForklaunchPropertyBuilders = {
 declare const fp: ForklaunchPropertyBuilders;
 
 /**
- * Rejects properties with the NeedsClassification brand
- * (fp.string() without .compliance()). All other properties pass.
- */
-type RejectUnclassified$1<T> = {
-    [K in keyof T]: T[K] extends NeedsClassification ? never : T[K];
-};
-/**
- * Call signature: enforces ClassifiedProperty brand on input properties.
- * Return type: uses StripClassified to remove the brand so InferEntity
- * sees pure PropertyChain types across package boundaries.
- */
-declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & RejectUnclassified$1<TProperties>, TPK, TBase, TRepository, TForceObject>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject>, TBase, TProperties>;
-
-/**
- * Rejects properties with NeedsClassification brand (same check
- * as defineComplianceEntity).
+ * Validates each property:
+ * - ClassifiedProperty (from .compliance()) → accepted
+ * - Functions (lazy relations) → pass through (no return type eval)
+ * - Raw PropertyChain (relations from fp.manyToOne) → accepted
+ * - ForklaunchPropertyChain (fp.string() without .compliance()) → rejected
+ *   (it has .compliance method, which ClassifiedProperty doesn't)
+ * - Plain p.string() → rejected (not ClassifiedProperty, not a function)
+ *
+ * Uses ClassifiedProperty as the required type for non-function scalars.
  */
-type RejectUnclassified<T> = {
-    [K in keyof T]: T[K] extends NeedsClassification ? never : T[K];
+type ValidateProperties<T> = {
+    [K in keyof T]: T[K] extends ClassifiedProperty ? T[K] : T[K] extends (...args: never[]) => unknown ? T[K] : ClassifiedProperty;
 };
 /**
- * Strips the ClassifiedProperty brand from a property type,
- * returning the underlying PropertyChain.
- */
-type StripBrand<T> = T extends PropertyChain<infer V, infer O> & ClassifiedProperty ? PropertyChain<V, O> : T;
-/**
- * Wraps shared base properties to:
- * 1. Validate all properties have `.compliance()` called (compile check)
- * 2. Strip the ClassifiedProperty brand from the output types
- *
- * Without this wrapper, spreading base properties into entities
- * leaks the ClassifiedProperty brand across package boundaries,
- * causing type identity mismatches.
+ * Wrapper around MikroORM's `defineEntity` that enforces compliance.
  *
- * @example
- * ```typescript
- * export const sqlBaseProperties = defineBaseProperties({
- *   id: fp.uuid().primary().onCreate(() => v4()).compliance('none'),
- *   createdAt: fp.datetime().onCreate(() => new Date()).compliance('none'),
- *   updatedAt: fp.datetime().onCreate(() => new Date())
- *     .onUpdate(() => new Date()).compliance('none')
- * });
- * ```
+ * Input: requires ClassifiedProperty wrappers on scalar properties.
+ * Output: extracts the inner PropertyChain from each wrapper so
+ * InferEntity sees pure MikroORM types — no brand, no interference.
  */
-declare function defineBaseProperties<T extends Record<string, unknown>>(properties: T & RejectUnclassified<T>): {
-    [K in keyof T]: StripBrand<T[K]>;
-};
+declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & ValidateProperties<TProperties>, TPK, TBase, TRepository, TForceObject>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<ExtractInner<TProperties>, TPK, TBase, TRepository, TForceObject>, TBase, ExtractInner<TProperties>>;
 
 declare class FieldEncryptor {
     private readonly masterKey;
@@ -303,4 +269,4 @@ declare class RlsEventSubscriber implements EventSubscriber {
  */
 declare function setupRls(orm: MikroORM, config?: RlsConfig): void;
 
-export { type ClassifiedProperty, ComplianceEventSubscriber, ComplianceLevel, ComplianceLevel as ComplianceLevelType, type ForklaunchPropertyBuilders, type ForklaunchPropertyChain, type NeedsClassification, type RlsConfig, RlsEventSubscriber, TENANT_FILTER_NAME, createTenantFilterDef, defineBaseProperties, defineComplianceEntity, entityHasEncryptedFields, fp, getComplianceMetadata, getEntityComplianceFields, getSuperAdminContext, setupRls, setupTenantFilter, wrapEmWithNativeQueryBlocking };
+export { type ClassifiedProperty, ComplianceEventSubscriber, ComplianceLevel, ComplianceLevel as ComplianceLevelType, type ExtractInner, type ForklaunchPropertyBuilders, type ForklaunchPropertyChain, type RlsConfig, RlsEventSubscriber, TENANT_FILTER_NAME, createTenantFilterDef, defineComplianceEntity, entityHasEncryptedFields, fp, getComplianceMetadata, getEntityComplianceFields, getSuperAdminContext, setupRls, setupTenantFilter, wrapEmWithNativeQueryBlocking };

package/lib/persistence/index.d.ts

@@ -1,9 +1,8 @@
-import { PropertyBuilders, UniversalPropertyOptionsBuilder, PropertyChain, EmptyOptions, EntityMetadataWithProperties, EntitySchemaWithMeta, InferEntityFromProperties, EventSubscriber, EventArgs, FilterDef, EntityManager, MikroORM } from '@mikro-orm/core';
+import { PropertyChain, PropertyBuilders, UniversalPropertyOptionsBuilder, EmptyOptions, EntityMetadataWithProperties, EntitySchemaWithMeta, InferEntityFromProperties, EventSubscriber, EventArgs, FilterDef, EntityManager, MikroORM } from '@mikro-orm/core';
 export { InferEntity } from '@mikro-orm/core';
 
 /**
  * Classification levels for entity field compliance.
- * Drives encryption (phi/pci), audit log redaction (all non-none), and compliance reporting.
  */
 declare const ComplianceLevel: {
     readonly pii: "pii";
@@ -16,56 +15,40 @@ declare function getComplianceMetadata(entityName: string, fieldName: string): C
 declare function getEntityComplianceFields(entityName: string): Map<string, ComplianceLevel> | undefined;
 declare function entityHasEncryptedFields(entityName: string): boolean;
 /**
- * Brand symbol on unclassified scalar properties. Properties with this brand
- * are rejected by `defineComplianceEntity`. Calling `.compliance()` strips
- * the brand and returns raw `PropertyChain<V, O>`.
- */
-declare const NEEDS_CLASSIFICATION: unique symbol;
-interface NeedsClassification {
-    readonly [NEEDS_CLASSIFICATION]: true;
-}
-/**
- * Brand on classified scalar properties. Added by `.compliance()`.
- * Uses a regular string property (not unique symbol) so it survives
- * .d.ts boundaries across packages without identity divergence.
- * MikroORM's InferBuilderValue only checks ~type and ~options — it
- * ignores this property.
+ * A wrapper object that holds the raw MikroORM PropertyChain in `__inner`
+ * and the compliance classification in `__compliance`.
+ *
+ * This is what `.compliance()` returns. `defineComplianceEntity` requires
+ * this wrapper for scalar properties, extracts `__inner` for the return
+ * type (so InferEntity sees pure PropertyChain), and reads `__compliance`
+ * for the metadata registry.
+ *
+ * At runtime this is still a Proxy wrapping the MikroORM builder —
+ * the `__inner`/`__compliance` are type-level only.
  */
-interface ClassifiedProperty {
-    readonly __forklaunch_classified: true;
+interface ClassifiedProperty<Value = unknown, Options = unknown> {
+    readonly __inner: PropertyChain<Value, Options>;
+    readonly __compliance: ComplianceLevel;
 }
 /**
- * An unclassified scalar property builder. Has all `PropertyChain` methods
- * (remapped to preserve `.compliance()` through chaining) plus the
- * `.compliance()` method itself.
- *
- * Carries the `NEEDS_CLASSIFICATION` brand — `defineComplianceEntity`
- * rejects properties with this brand.
+ * An unclassified scalar property builder. All PropertyChain methods
+ * are remapped to return ForklaunchPropertyChain (preserving .compliance()
+ * through chains). `.compliance(level)` returns a ClassifiedProperty wrapper.
  *
- * `.compliance(level)` returns the raw `PropertyChain<Value, Options>`
- * from MikroORM (no brand) — which `defineEntity` and `InferEntity`
- * understand natively.
+ * NOT assignable to ClassifiedProperty — defineComplianceEntity rejects it.
  */
-type ForklaunchPropertyChain<Value, Options> = RemapReturns<Value, Options> & NeedsClassification & {
-    /**
-     * Classify this field's compliance level. Returns the raw MikroORM
-     * `PropertyChain` so `InferEntity` works without interference.
-     */
-    compliance(level: ComplianceLevel): PropertyChain<Value, Options> & ClassifiedProperty;
+type ForklaunchPropertyChain<Value, Options> = RemapReturns<Value, Options> & {
+    compliance(level: ComplianceLevel): ClassifiedProperty<Value, Options>;
 };
 type RemapReturns<Value, Options> = {
     [K in keyof PropertyChain<Value, Options>]: PropertyChain<Value, Options>[K] extends (...args: infer A) => PropertyChain<infer V2, infer O2> ? (...args: A) => ForklaunchPropertyChain<V2, O2> : PropertyChain<Value, Options>[K];
 };
 type RelationBuilderKeys = 'manyToOne' | 'oneToMany' | 'manyToMany' | 'oneToOne' | 'embedded';
-/**
- * Generic methods on PropertyBuilders that need explicit signatures
- * because mapped types collapse their type parameters.
- */
 type GenericBuilderKeys = 'json' | 'formula' | 'type' | 'bigint' | 'array' | 'decimal' | 'enum';
 /**
  * The type of `fp`:
- * - Scalar methods → `ForklaunchPropertyChain` (must call `.compliance()`)
- * - Relation methods → raw `PropertyChain` (auto-classified at runtime, no brand)
+ * - Scalar methods → ForklaunchPropertyChain (must call .compliance())
+ * - Relation methods → raw PropertyChain (auto-classified at runtime)
  * - Generic methods → explicit signatures preserving type parameters
  */
 type ForklaunchPropertyBuilders = {
@@ -81,6 +64,15 @@ type ForklaunchPropertyBuilders = {
     decimal: <Mode extends 'number' | 'string' = 'string'>(mode?: Mode) => ForklaunchPropertyChain<Mode extends 'number' ? number : string, EmptyOptions>;
     enum: <const T extends (number | string)[] | (() => Record<string, unknown>)>(items?: T) => ForklaunchPropertyChain<T extends () => Record<string, unknown> ? T extends () => infer R ? R[keyof R] : never : T extends (infer Value)[] ? Value : T, EmptyOptions>;
 };
+/**
+ * For each property in T:
+ * - ClassifiedProperty<V,O> → PropertyChain<V,O> (extract __inner)
+ * - Functions (lazy relations) → pass through unchanged
+ * - Raw PropertyChain (relations from fp.manyToOne) → pass through
+ */
+type ExtractInner<T> = {
+    [K in keyof T]: T[K] extends ClassifiedProperty<infer V, infer O> ? PropertyChain<V, O> : T[K];
+};
 
 /**
  * ForkLaunch property builder. Drop-in replacement for MikroORM's `p`
@@ -108,53 +100,27 @@ type ForklaunchPropertyBuilders = {
 declare const fp: ForklaunchPropertyBuilders;
 
 /**
- * Rejects properties with the NeedsClassification brand
- * (fp.string() without .compliance()). All other properties pass.
- */
-type RejectUnclassified$1<T> = {
-    [K in keyof T]: T[K] extends NeedsClassification ? never : T[K];
-};
-/**
- * Call signature: enforces ClassifiedProperty brand on input properties.
- * Return type: uses StripClassified to remove the brand so InferEntity
- * sees pure PropertyChain types across package boundaries.
- */
-declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & RejectUnclassified$1<TProperties>, TPK, TBase, TRepository, TForceObject>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<TProperties, TPK, TBase, TRepository, TForceObject>, TBase, TProperties>;
-
-/**
- * Rejects properties with NeedsClassification brand (same check
- * as defineComplianceEntity).
+ * Validates each property:
+ * - ClassifiedProperty (from .compliance()) → accepted
+ * - Functions (lazy relations) → pass through (no return type eval)
+ * - Raw PropertyChain (relations from fp.manyToOne) → accepted
+ * - ForklaunchPropertyChain (fp.string() without .compliance()) → rejected
+ *   (it has .compliance method, which ClassifiedProperty doesn't)
+ * - Plain p.string() → rejected (not ClassifiedProperty, not a function)
+ *
+ * Uses ClassifiedProperty as the required type for non-function scalars.
  */
-type RejectUnclassified<T> = {
-    [K in keyof T]: T[K] extends NeedsClassification ? never : T[K];
+type ValidateProperties<T> = {
+    [K in keyof T]: T[K] extends ClassifiedProperty ? T[K] : T[K] extends (...args: never[]) => unknown ? T[K] : ClassifiedProperty;
 };
 /**
- * Strips the ClassifiedProperty brand from a property type,
- * returning the underlying PropertyChain.
- */
-type StripBrand<T> = T extends PropertyChain<infer V, infer O> & ClassifiedProperty ? PropertyChain<V, O> : T;
-/**
- * Wraps shared base properties to:
- * 1. Validate all properties have `.compliance()` called (compile check)
- * 2. Strip the ClassifiedProperty brand from the output types
- *
- * Without this wrapper, spreading base properties into entities
- * leaks the ClassifiedProperty brand across package boundaries,
- * causing type identity mismatches.
+ * Wrapper around MikroORM's `defineEntity` that enforces compliance.
  *
- * @example
- * ```typescript
- * export const sqlBaseProperties = defineBaseProperties({
- *   id: fp.uuid().primary().onCreate(() => v4()).compliance('none'),
- *   createdAt: fp.datetime().onCreate(() => new Date()).compliance('none'),
- *   updatedAt: fp.datetime().onCreate(() => new Date())
- *     .onUpdate(() => new Date()).compliance('none')
- * });
- * ```
+ * Input: requires ClassifiedProperty wrappers on scalar properties.
+ * Output: extracts the inner PropertyChain from each wrapper so
+ * InferEntity sees pure MikroORM types — no brand, no interference.
  */
-declare function defineBaseProperties<T extends Record<string, unknown>>(properties: T & RejectUnclassified<T>): {
-    [K in keyof T]: StripBrand<T[K]>;
-};
+declare function defineComplianceEntity<const TName extends string, const TTableName extends string, const TProperties extends Record<string, unknown>, const TPK extends (keyof TProperties)[] | undefined = undefined, const TBase = never, const TRepository = never, const TForceObject extends boolean = false>(meta: EntityMetadataWithProperties<TName, TTableName, TProperties & ValidateProperties<TProperties>, TPK, TBase, TRepository, TForceObject>): EntitySchemaWithMeta<TName, TTableName, InferEntityFromProperties<ExtractInner<TProperties>, TPK, TBase, TRepository, TForceObject>, TBase, ExtractInner<TProperties>>;
 
 declare class FieldEncryptor {
     private readonly masterKey;
@@ -303,4 +269,4 @@ declare class RlsEventSubscriber implements EventSubscriber {
  */
 declare function setupRls(orm: MikroORM, config?: RlsConfig): void;
 
-export { type ClassifiedProperty, ComplianceEventSubscriber, ComplianceLevel, ComplianceLevel as ComplianceLevelType, type ForklaunchPropertyBuilders, type ForklaunchPropertyChain, type NeedsClassification, type RlsConfig, RlsEventSubscriber, TENANT_FILTER_NAME, createTenantFilterDef, defineBaseProperties, defineComplianceEntity, entityHasEncryptedFields, fp, getComplianceMetadata, getEntityComplianceFields, getSuperAdminContext, setupRls, setupTenantFilter, wrapEmWithNativeQueryBlocking };
+export { type ClassifiedProperty, ComplianceEventSubscriber, ComplianceLevel, ComplianceLevel as ComplianceLevelType, type ExtractInner, type ForklaunchPropertyBuilders, type ForklaunchPropertyChain, type RlsConfig, RlsEventSubscriber, TENANT_FILTER_NAME, createTenantFilterDef, defineComplianceEntity, entityHasEncryptedFields, fp, getComplianceMetadata, getEntityComplianceFields, getSuperAdminContext, setupRls, setupTenantFilter, wrapEmWithNativeQueryBlocking };

package/lib/persistence/index.js

@@ -25,7 +25,6 @@ __export(persistence_exports, {
   RlsEventSubscriber: () => RlsEventSubscriber,
   TENANT_FILTER_NAME: () => TENANT_FILTER_NAME,
   createTenantFilterDef: () => createTenantFilterDef,
-  defineBaseProperties: () => defineBaseProperties,
   defineComplianceEntity: () => defineComplianceEntity,
   entityHasEncryptedFields: () => entityHasEncryptedFields,
   fp: () => fp,
@@ -172,11 +171,6 @@ function defineComplianceEntity(meta) {
   return (0, import_core2.defineEntity)(meta);
 }
 
-// src/persistence/defineBaseProperties.ts
-function defineBaseProperties(properties) {
-  return properties;
-}
-
 // src/encryption/fieldEncryptor.ts
 var DecryptionError = class extends Error {
   name = "DecryptionError";
@@ -458,7 +452,6 @@ function escapeSqlString(value) {
   RlsEventSubscriber,
   TENANT_FILTER_NAME,
   createTenantFilterDef,
-  defineBaseProperties,
   defineComplianceEntity,
   entityHasEncryptedFields,
   fp,