@forklaunch/core 1.6.0 → 1.6.3

package/lib/persistence/mikroOrm.types.d.ts

@@ -1,4 +1,4 @@
-import type { MikroORM } from '@mikro-orm/core';
+import type { Collection, IndexHints, MikroORM, Reference } from '@mikro-orm/core';
 /**
  * `MikroORM` with relaxed type parameters.
  *
@@ -35,8 +35,24 @@ export type AnyMikroORM = Awaited<ReturnType<typeof MikroORM.init>>;
  * should compare `ResolvedEntity<(typeof X)['~entity']>` so compatibility is
  * judged on the actual field types, which is what the consuming code reads
  * and writes.
+ *
+ * Relations are resolved the same way. A `Collection<Permission>`, a
+ * `Reference<Organization>` or a bare `Organization` on the entity carries the
+ * related entity's builder record too, and since mikro-orm 7.2 the builders
+ * are declared `in out` (invariant), so a concrete `Role` whose `permissions`
+ * point at the app's `Permission` would never satisfy a constraint written
+ * against a module's minimal `Permission` unless the relation target is
+ * stripped of its metadata slots as well.
  */
 export type ResolvedEntity<T> = {
-    [K in keyof T as K extends string ? K : never]: T[K];
+    [K in keyof T as K extends string ? K : never]: ResolvedRelation<T[K]>;
 };
+/**
+ * `ResolvedEntity` applied through a relation wrapper: `Collection<E>` becomes
+ * `Collection<ResolvedEntity<E>>`, references likewise, and a bare entity
+ * object (a `manyToOne` without `.ref()`) resolves in place. Scalars, dates,
+ * enums, `null` and `undefined` pass through untouched: only a value that
+ * carries the `IndexHints` slot is an entity.
+ */
+export type ResolvedRelation<V> = V extends Collection<infer E extends object, infer O extends object> ? Collection<ResolvedEntity<E>, O> : V extends Reference<infer E extends object> ? Reference<ResolvedEntity<E>> : typeof IndexHints extends keyof V ? ResolvedEntity<V> : V;
 //# sourceMappingURL=mikroOrm.types.d.ts.map

package/lib/persistence/mikroOrm.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mikroOrm.types.d.ts","sourceRoot":"","sources":["../../src/persistence/mikroOrm.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;CACrD,CAAC"}
+{"version":3,"file":"mikroOrm.types.d.ts","sourceRoot":"","sources":["../../src/persistence/mikroOrm.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,SAAS,EACV,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAC5B,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC,GAChE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAChC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,GACzC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAC5B,OAAO,UAAU,SAAS,MAAM,CAAC,GAC/B,cAAc,CAAC,CAAC,CAAC,GACjB,CAAC,CAAC"}

package/lib/persistence/tenantEm.d.ts

@@ -48,13 +48,26 @@ import type { EntityManager } from '@mikro-orm/core';
  * }
  * ```
  *
- * If `tenantId` is `undefined` or empty, the original EM is returned
- * unwrapped — useful for super-admin / lookup paths that need an
- * unscoped query before they know the tenant.
+ * # The empty tenant is a tenant
+ *
+ * Global rows (a billing plan, a trial, a template) are encrypted under the
+ * empty tenant `''`. A caller that passes `''` means "bind the no-tenant
+ * key", and gets a Proxy that runs every EM call inside
+ * `withEncryptionContext('', …)`. Only `undefined` means "do not wrap": the
+ * EM is returned as is and inherits whatever context is already bound,
+ * which is right for a super-admin lookup that has not resolved a tenant
+ * yet, and wrong for anything that writes.
+ *
+ * Earlier versions treated `''` like `undefined` and also seeded the ALS
+ * with `enterWith`, which mutates the *calling* async resource. Together
+ * those meant: after one org-scoped EM was created on a request, a later
+ * "no-tenant" EM on the same resource silently read and wrote under that
+ * org's key. Global rows then came out unreadable ("Failed to decrypt
+ * encrypted column value") depending on what had run before on the worker.
  *
  * @param em        a freshly forked `EntityManager` from `orm.em.fork(...)`
- * @param tenantId  the org/tenant id to bind for filter params + ALS;
- *                  pass `undefined` to skip wrapping entirely
+ * @param tenantId  the org/tenant id to bind; `''` binds the no-tenant key;
+ *                  `undefined` skips wrapping entirely
  */
 export declare function wrapEmWithTenantContext(em: EntityManager, tenantId: string | undefined): EntityManager;
 //# sourceMappingURL=tenantEm.d.ts.map

package/lib/persistence/tenantEm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenantEm.d.ts","sourceRoot":"","sources":["../../src/persistence/tenantEm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,aAAa,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,aAAa,CA0Bf"}
+{"version":3,"file":"tenantEm.d.ts","sourceRoot":"","sources":["../../src/persistence/tenantEm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,aAAa,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,aAAa,CA4Bf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forklaunch/core",
-  "version": "1.6.0",
+  "version": "1.6.3",
   "description": "forklaunch-js core package. Contains useful building blocks.",
   "homepage": "https://github.com/forklaunch/forklaunch-js#readme",
   "bugs": {
@@ -81,8 +81,8 @@
   "dependencies": {
     "@asyncapi/parser": "^3.6.3",
     "@forklaunch/opentelemetry-instrumentation-hyper-express": "0.0.5",
-    "@mikro-orm/core": "7.1.15",
-    "@mikro-orm/mongodb": "7.1.15",
+    "@mikro-orm/core": "7.2.1",
+    "@mikro-orm/mongodb": "7.2.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.222.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.222.0",
@@ -98,8 +98,8 @@
     "@opentelemetry/sdk-trace-node": "^2.11.0",
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "cors": "^2.8.6",
-    "dotenv": "^17.4.2",
-    "fastmcp": "^4.20.11",
+    "dotenv": "^18.0.1",
+    "fastmcp": "^4.20.14",
     "jose": "6.2.12",
     "openapi3-ts": "^4.6.1",
     "pino": "^10.3.1",
@@ -107,21 +107,21 @@
     "pino-pretty": "^13.1.3",
     "redis": "^6.2.1",
     "uuid": "^14.0.2",
-    "zod": "^4.6.4",
-    "@forklaunch/common": "^1.2.26",
-    "@forklaunch/validator": "^1.2.27"
+    "zod": "^4.6.5",
+    "@forklaunch/validator": "^1.2.28",
+    "@forklaunch/common": "^1.2.27"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@scalar/express-api-reference": "^0.10.18",
+    "@scalar/express-api-reference": "^0.10.19",
     "@types/cors": "^2.8.19",
     "@types/jest": "^30.0.0",
     "@types/qs": "^6.15.1",
     "@types/uuid": "^11.0.0",
     "globals": "^17.12.0",
-    "jest": "^30.5.1",
+    "jest": "^30.5.2",
     "jose": "6.1.3",
-    "prettier": "^3.9.6",
+    "prettier": "^3.9.8",
     "testcontainers": "^12.1.0",
     "ts-jest": "^29.4.12",
     "ts-node": "^10.9.2",