@ghentcdh/crouton-api 0.0.1-alpha.42 → 0.0.1-alpha.46

package/dist/index.cjs

@@ -31,13 +31,16 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CROUTON_SECURITY: () => CROUTON_SECURITY,
   CroutonApiModule: () => CroutonApiModule,
+  CroutonSecurityGuard: () => CroutonSecurityGuard,
   DataSourceRegistry: () => DataSourceRegistry,
   FileSystemResourceConfigLoader: () => FileSystemResourceConfigLoader,
   ReadOpSchema: () => ReadOpSchema,
   ResourceConfigLoader: () => ResourceConfigLoader2,
   ResourceConfigRegistry: () => ResourceConfigRegistry,
   ResourceHooksSchema: () => ResourceHooksSchema,
+  SecurityGuardRegistry: () => SecurityGuardRegistry,
   WriteOpSchema: () => WriteOpSchema,
   buildFilterWhere: () => buildFilterWhere,
   buildViews: () => buildViews,
@@ -55,6 +58,8 @@ __export(index_exports, {
   prepareWrite: () => prepareWrite,
   resolveDefinition: () => resolveDefinition,
   schemaFor: () => schemaFor,
+  securityFor: () => securityFor,
+  securityForSub: () => securityForSub,
   upsertOnFor: () => upsertOnFor
 });
 module.exports = __toCommonJS(index_exports);
@@ -619,85 +624,150 @@ var transformDataSource = /* @__PURE__ */ __name((data) => {
 var DataSourceSchema = DataSourceShape.transform(transformDataSource);
 
 // ../crouton-core/src/lib/data-source/Operations.schema.ts
+var import_zod9 = require("zod");
+
+// ../crouton-core/src/lib/data-source/Security.schema.ts
 var import_zod8 = require("zod");
-var BoolOrUpsertSchema = import_zod8.z.union([
-  import_zod8.z.boolean(),
+var SecuritySchema = import_zod8.z.union([
   import_zod8.z.object({
-    upsertOn: import_zod8.z.union([
+    public: import_zod8.z.literal(true)
+  }),
+  import_zod8.z.object({
+    guard: import_zod8.z.union([
       import_zod8.z.string(),
-      import_zod8.z.array(import_zod8.z.string())
+      import_zod8.z.array(import_zod8.z.string()).min(1)
     ])
   })
 ]);
-var JsonOperationsSchema = import_zod8.z.object({
-  findAll: import_zod8.z.boolean().default(true),
-  findOne: import_zod8.z.boolean().default(true),
-  create: import_zod8.z.boolean().default(true),
-  update: import_zod8.z.boolean().default(true),
-  patch: import_zod8.z.boolean().default(true),
+
+// ../crouton-core/src/lib/data-source/Operations.schema.ts
+var OpEntry = import_zod9.z.union([
+  import_zod9.z.boolean(),
+  import_zod9.z.object({
+    security: SecuritySchema.optional()
+  })
+]);
+var BoolOrUpsertSchema = import_zod9.z.union([
+  import_zod9.z.boolean(),
+  import_zod9.z.object({
+    upsertOn: import_zod9.z.union([
+      import_zod9.z.string(),
+      import_zod9.z.array(import_zod9.z.string())
+    ]),
+    security: SecuritySchema.optional()
+  })
+]);
+var JsonOperationsSchema = import_zod9.z.object({
+  findAll: OpEntry.default(true),
+  findOne: OpEntry.default(true),
+  create: OpEntry.default(true),
+  update: OpEntry.default(true),
+  patch: OpEntry.default(true),
   upsert: BoolOrUpsertSchema.default(false),
-  delete: import_zod8.z.boolean().default(true)
+  delete: OpEntry.default(true)
 });
+var buildSubResourceOperations = /* @__PURE__ */ __name((ops, baseUri, idField = "id") => {
+  if (!ops) return {};
+  const idPlaceholder = `{${idField}}`;
+  return {
+    ...ops.findAll && {
+      findAll: {
+        uri: baseUri,
+        method: "get"
+      }
+    },
+    ...ops.findOne && {
+      findOne: {
+        uri: `${baseUri}/${idPlaceholder}`,
+        method: "get"
+      }
+    },
+    ...ops.create && {
+      create: {
+        uri: baseUri,
+        method: "post"
+      }
+    },
+    ...ops.update && {
+      update: {
+        uri: `${baseUri}/${idPlaceholder}`,
+        method: "put"
+      }
+    },
+    ...ops.patch && {
+      patch: {
+        uri: `${baseUri}/${idPlaceholder}`,
+        method: "patch"
+      }
+    },
+    ...ops.delete && {
+      delete: {
+        uri: `${baseUri}/${idPlaceholder}`,
+        method: "delete"
+      }
+    }
+  };
+}, "buildSubResourceOperations");
 
 // ../crouton-core/src/lib/resource/ResourceJson.schema.ts
-var import_zod18 = require("zod");
+var import_zod19 = require("zod");
 
 // ../crouton-core/src/lib/resource/CalculatedColumn.schema.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // ../crouton-core/src/lib/resource/FieldInput.schema.ts
-var import_zod9 = require("zod");
-var RelationType = import_zod9.z.enum([
+var import_zod10 = require("zod");
+var RelationType = import_zod10.z.enum([
   "oneToOne",
   "manyToOne",
   "oneToMany",
   "manyToMany"
 ]);
-var DetailControlSchema = import_zod9.z.object({
-  property: import_zod9.z.string(),
-  type: import_zod9.z.string().optional(),
-  options: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.unknown()).optional(),
-  hideLabel: import_zod9.z.boolean().optional(),
-  width: import_zod9.z.string().optional()
+var DetailControlSchema = import_zod10.z.object({
+  property: import_zod10.z.string(),
+  type: import_zod10.z.string().optional(),
+  options: import_zod10.z.record(import_zod10.z.string(), import_zod10.z.unknown()).optional(),
+  hideLabel: import_zod10.z.boolean().optional(),
+  width: import_zod10.z.string().optional()
 });
-var DetailConfigSchema = import_zod9.z.object({
-  layout: import_zod9.z.enum([
+var DetailConfigSchema = import_zod10.z.object({
+  layout: import_zod10.z.enum([
     "collapse",
     "row"
   ]),
-  titleKey: import_zod9.z.string().optional(),
-  controls: import_zod9.z.array(DetailControlSchema)
+  titleKey: import_zod10.z.string().optional(),
+  controls: import_zod10.z.array(DetailControlSchema)
 });
-var RelationFieldInputOptionsSchema = import_zod9.z.object({
-  colspan: import_zod9.z.number().optional().default(12),
+var RelationFieldInputOptionsSchema = import_zod10.z.object({
+  colspan: import_zod10.z.number().optional().default(12),
   /** Field to sort related records by, e.g. `"title"` or `"author.name"`. */
-  sort: import_zod9.z.string().optional(),
+  sort: import_zod10.z.string().optional(),
   /** Sort direction. Defaults to `"asc"` when omitted. */
-  sortDir: import_zod9.z.enum([
+  sortDir: import_zod10.z.enum([
     "asc",
     "desc"
   ]).optional(),
   /** CSS flex direction for the relation control button layout. */
-  direction: import_zod9.z.string().optional(),
+  direction: import_zod10.z.string().optional(),
   /** Key used as the display label in the relation control. */
-  displayKey: import_zod9.z.string().optional(),
+  displayKey: import_zod10.z.string().optional(),
   /** Path to the related resource (resolved to a URI at load time). */
-  resource: import_zod9.z.string().optional()
-}).catchall(import_zod9.z.unknown());
-var FieldInputSchema = import_zod9.z.object({
-  type: import_zod9.z.string().optional(),
-  customRender: import_zod9.z.string().optional(),
+  resource: import_zod10.z.string().optional()
+}).catchall(import_zod10.z.unknown());
+var FieldInputSchema = import_zod10.z.object({
+  type: import_zod10.z.string().optional(),
+  customRender: import_zod10.z.string().optional(),
   /**
   * Render format hint for the frontend (e.g. `"relation"` for sub-resource
   * relations). When `format` is `"relation"`, `resource` must also be set.
   */
-  format: import_zod9.z.string().optional(),
+  format: import_zod10.z.string().optional(),
   /**
   * Relative path to the child resource definition, e.g. `"./author.resource"`.
   * Only used when `format` is `"relation"`. Resolved at load time to inject
   * sub-resource URIs into `options`.
   */
-  resource: import_zod9.z.string().optional(),
+  resource: import_zod10.z.string().optional(),
   /**
   * Cardinality of the relation. Used by the frontend to determine the correct
   * renderer and behaviour (e.g. single-select vs multi-select).
@@ -706,11 +776,11 @@ var FieldInputSchema = import_zod9.z.object({
   */
   relationType: RelationType.optional(),
   /** FK field on the child model pointing back to the parent, e.g. `"workId"`. Defaults to `${parentModel}Id`. */
-  foreignKey: import_zod9.z.string().optional(),
+  foreignKey: import_zod10.z.string().optional(),
   /** Override the Prisma relation field name when it differs from the column id. */
-  relation: import_zod9.z.string().optional(),
+  relation: import_zod10.z.string().optional(),
   /** Override the display order in form views. Lower values come first. */
-  position: import_zod9.z.number().optional(),
+  position: import_zod10.z.number().optional(),
   /**
   * Value to pre-fill this field with on the create form. Injected into the
   * generated form view's JSON Schema as `properties[id].default`, which
@@ -718,10 +788,10 @@ var FieldInputSchema = import_zod9.z.object({
   * opening a blank record. Not applicable to `format: "relation"` fields —
   * relation columns are excluded from the picked data schema entirely.
   */
-  defaultValue: import_zod9.z.unknown().optional(),
-  options: import_zod9.z.union([
+  defaultValue: import_zod10.z.unknown().optional(),
+  options: import_zod10.z.union([
     RelationFieldInputOptionsSchema,
-    import_zod9.z.unknown()
+    import_zod10.z.unknown()
   ]).optional(),
   /** Nested array detail layout (renders via `detailFixed`). */
   detail: DetailConfigSchema.optional()
@@ -762,16 +832,16 @@ var normalizeLabel = /* @__PURE__ */ __name((obj) => {
 }, "normalizeLabel");
 
 // ../crouton-core/src/lib/resource/CalculatedColumn.schema.ts
-var CalculatedColumnSchema = import_zod10.z.object({
+var CalculatedColumnSchema = import_zod11.z.object({
   /** Column identifier used in the response payload and UI schema. */
-  id: import_zod10.z.string(),
+  id: import_zod11.z.string(),
   /** SQL alias — must match `id`. */
-  alias: import_zod10.z.string(),
+  alias: import_zod11.z.string(),
   /** Human-readable label shown in the table header. */
-  label: import_zod10.z.string().optional(),
-  sqlExpression: import_zod10.z.string(),
+  label: import_zod11.z.string().optional(),
+  sqlExpression: import_zod11.z.string(),
   /** JSON schema / cast type for the computed value. Defaults to `"number"`. `"string"` skips CAST. */
-  type: import_zod10.z.enum([
+  type: import_zod11.z.enum([
     "number",
     "boolean",
     "string"
@@ -782,9 +852,9 @@ var CalculatedColumnSchema = import_zod10.z.object({
    * `position: N` places this column before the element currently at index N.
    * Can also be set via `fieldInput.position` (takes precedence).
    */
-  position: import_zod10.z.number().optional(),
-  hiddenInTable: import_zod10.z.boolean().optional(),
-  hiddenInView: import_zod10.z.boolean().optional(),
+  position: import_zod11.z.number().optional(),
+  hiddenInTable: import_zod11.z.boolean().optional(),
+  hiddenInView: import_zod11.z.boolean().optional(),
   /**
    * Field input options for rendering in form / view schemas.
    * Supports `colspan`, `format`, and any other options passed to the Control renderer.
@@ -794,11 +864,11 @@ var CalculatedColumnSchema = import_zod10.z.object({
 }).transform(normalizeLabel);
 
 // ../crouton-core/src/lib/resource/Column.ts
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 
 // ../crouton-core/src/lib/resource/ColumnType.schema.ts
-var import_zod11 = require("zod");
-var ColumnTypeShorthandSchema = import_zod11.z.enum([
+var import_zod12 = require("zod");
+var ColumnTypeShorthandSchema = import_zod12.z.enum([
   "string",
   "number",
   "integer",
@@ -808,32 +878,32 @@ var ColumnTypeShorthandSchema = import_zod11.z.enum([
   "object",
   "array"
 ]);
-var JsonSchemaFragmentSchema = import_zod11.z.lazy(() => import_zod11.z.object({
-  type: import_zod11.z.union([
-    import_zod11.z.string(),
-    import_zod11.z.array(import_zod11.z.string())
+var JsonSchemaFragmentSchema = import_zod12.z.lazy(() => import_zod12.z.object({
+  type: import_zod12.z.union([
+    import_zod12.z.string(),
+    import_zod12.z.array(import_zod12.z.string())
   ]).optional(),
-  format: import_zod11.z.string().optional(),
-  enum: import_zod11.z.array(import_zod11.z.unknown()).optional(),
-  const: import_zod11.z.unknown().optional(),
-  nullable: import_zod11.z.boolean().optional(),
-  properties: import_zod11.z.record(import_zod11.z.string(), JsonSchemaFragmentSchema).optional(),
-  required: import_zod11.z.array(import_zod11.z.string()).optional(),
+  format: import_zod12.z.string().optional(),
+  enum: import_zod12.z.array(import_zod12.z.unknown()).optional(),
+  const: import_zod12.z.unknown().optional(),
+  nullable: import_zod12.z.boolean().optional(),
+  properties: import_zod12.z.record(import_zod12.z.string(), JsonSchemaFragmentSchema).optional(),
+  required: import_zod12.z.array(import_zod12.z.string()).optional(),
   items: JsonSchemaFragmentSchema.optional(),
-  additionalProperties: import_zod11.z.union([
-    import_zod11.z.boolean(),
+  additionalProperties: import_zod12.z.union([
+    import_zod12.z.boolean(),
     JsonSchemaFragmentSchema
   ]).optional(),
-  title: import_zod11.z.string().optional(),
-  description: import_zod11.z.string().optional(),
-  default: import_zod11.z.unknown().optional(),
-  minimum: import_zod11.z.number().optional(),
-  maximum: import_zod11.z.number().optional(),
-  minLength: import_zod11.z.number().optional(),
-  maxLength: import_zod11.z.number().optional(),
-  pattern: import_zod11.z.string().optional()
-}).catchall(import_zod11.z.unknown()));
-var ColumnTypeSchema = import_zod11.z.union([
+  title: import_zod12.z.string().optional(),
+  description: import_zod12.z.string().optional(),
+  default: import_zod12.z.unknown().optional(),
+  minimum: import_zod12.z.number().optional(),
+  maximum: import_zod12.z.number().optional(),
+  minLength: import_zod12.z.number().optional(),
+  maxLength: import_zod12.z.number().optional(),
+  pattern: import_zod12.z.string().optional()
+}).catchall(import_zod12.z.unknown()));
+var ColumnTypeSchema = import_zod12.z.union([
   ColumnTypeShorthandSchema,
   JsonSchemaFragmentSchema
 ]);
@@ -915,40 +985,40 @@ var isObjectColumnType = /* @__PURE__ */ __name((type) => columnTypeName(type) =
 var isArrayColumnType = /* @__PURE__ */ __name((type) => columnTypeName(type) === "array", "isArrayColumnType");
 
 // ../crouton-core/src/lib/resource/Column.ts
-var WhenConditionSchema = import_zod12.z.object({
-  field: import_zod12.z.string(),
-  eq: import_zod12.z.unknown().optional(),
-  neq: import_zod12.z.unknown().optional(),
-  exists: import_zod12.z.boolean().optional(),
-  notExists: import_zod12.z.boolean().optional()
+var WhenConditionSchema = import_zod13.z.object({
+  field: import_zod13.z.string(),
+  eq: import_zod13.z.unknown().optional(),
+  neq: import_zod13.z.unknown().optional(),
+  exists: import_zod13.z.boolean().optional(),
+  notExists: import_zod13.z.boolean().optional()
 });
-var JsonColumnSchema = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  column: import_zod12.z.string().optional(),
-  label: import_zod12.z.string().optional(),
-  hiddenInTable: import_zod12.z.boolean().default(false),
-  hiddenInForm: import_zod12.z.boolean().default(false),
-  hiddenInView: import_zod12.z.boolean().default(false),
-  sortable: import_zod12.z.boolean().default(false),
-  defaultSort: import_zod12.z.boolean().default(false),
-  searchable: import_zod12.z.boolean().default(false),
-  filterable: import_zod12.z.boolean().default(false),
-  createable: import_zod12.z.boolean().default(true),
-  updateable: import_zod12.z.boolean().default(true),
-  hideLabel: import_zod12.z.boolean().default(false),
+var JsonColumnSchema = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  column: import_zod13.z.string().optional(),
+  label: import_zod13.z.string().optional(),
+  hiddenInTable: import_zod13.z.boolean().default(false),
+  hiddenInForm: import_zod13.z.boolean().default(false),
+  hiddenInView: import_zod13.z.boolean().default(false),
+  sortable: import_zod13.z.boolean().default(false),
+  defaultSort: import_zod13.z.boolean().default(false),
+  searchable: import_zod13.z.boolean().default(false),
+  filterable: import_zod13.z.boolean().default(false),
+  createable: import_zod13.z.boolean().default(true),
+  updateable: import_zod13.z.boolean().default(true),
+  hideLabel: import_zod13.z.boolean().default(false),
   showWhen: WhenConditionSchema.optional(),
   hideWhen: WhenConditionSchema.optional(),
   disabledWhen: WhenConditionSchema.optional(),
-  displayKey: import_zod12.z.string().optional(),
-  sortId: import_zod12.z.string().optional(),
+  displayKey: import_zod13.z.string().optional(),
+  sortId: import_zod13.z.string().optional(),
   /**
   * Name of a shared enum in the project enum registry (`crouton.enums.json`).
   * At load time the loader injects that enum's `{ value, label }[]` into
   * `fieldInput.options.values`, so columns don't duplicate the option list.
   */
-  enum: import_zod12.z.string().optional(),
-  idField: import_zod12.z.boolean().default(false),
-  showInLookup: import_zod12.z.boolean().default(false),
+  enum: import_zod13.z.string().optional(),
+  idField: import_zod13.z.boolean().default(false),
+  showInLookup: import_zod13.z.boolean().default(false),
   /**
   * Data type of the column, as a shorthand name (`"string"`, `"integer"`, …)
   * or a full JSON Schema fragment:
@@ -979,12 +1049,12 @@ var JsonColumnSchema = import_zod12.z.object({
   * Ignored on the id column and on columns that are neither createable nor
   * updateable, since the form cannot supply a value for those.
   */
-  required: import_zod12.z.boolean().optional(),
+  required: import_zod13.z.boolean().optional(),
   /**
   * @deprecated Use `type` instead. Retained because it is still consumed by
   * the boolean predicate and the schema-less sub-resource view builder.
   */
-  columnType: import_zod12.z.string().default("string"),
+  columnType: import_zod13.z.string().default("string"),
   fieldInput: FieldInputSchema.optional(),
   /**
   * Optional per-context override for the read-only VIEW ui. Same shape as
@@ -1008,27 +1078,27 @@ var JsonColumnSchema = import_zod12.z.object({
   * Visibility (`hiddenInTable/Form/View`) on this column is inherited by all sub-columns as a
   * default; the referenced resource's own column visibility further restricts it.
   */
-  extend: import_zod12.z.string().optional(),
+  extend: import_zod13.z.string().optional(),
   /**
   * Per-sub-column overrides when using `extend`.
   * Key: the virtual column id (`"{extendId}_{refColId}"`) or just the referenced column id.
   * Value: any `JsonColumn` fields to merge over the generated virtual column.
   */
-  columns: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown())).optional()
+  columns: import_zod13.z.record(import_zod13.z.string(), import_zod13.z.record(import_zod13.z.string(), import_zod13.z.unknown())).optional()
 });
 
 // ../crouton-core/src/lib/resource/ParentRef.schema.ts
-var import_zod13 = require("zod");
-var ParentRefSchema = import_zod13.z.object({
+var import_zod14 = require("zod");
+var ParentRefSchema = import_zod14.z.object({
   /** Route segment of the parent, e.g. `"group"`. */
-  route: import_zod13.z.string(),
+  route: import_zod14.z.string(),
   /**
   * Name of the path parameter carrying the parent id, e.g. `"groupId"`.
   * Avoid `"id"` — that is the child's own id in `/:id` routes.
   */
-  param: import_zod13.z.string().default("parentId"),
+  param: import_zod14.z.string().default("parentId"),
   /** Type of the parent id, used to coerce the path param. Defaults to `'string'`. */
-  idType: import_zod13.z.enum([
+  idType: import_zod14.z.enum([
     "string",
     "number"
   ]).optional()
@@ -1036,37 +1106,37 @@ var ParentRefSchema = import_zod13.z.object({
 var resourceControllerPath = /* @__PURE__ */ __name((route, parent) => parent ? `${parent.route}/:${parent.param}/${route}` : route, "resourceControllerPath");
 
 // ../crouton-core/src/lib/resource/ResourceKind.ts
-var import_zod14 = require("zod");
-var ResourceKindSchema = import_zod14.z.enum([
+var import_zod15 = require("zod");
+var ResourceKindSchema = import_zod15.z.enum([
   "prisma",
   "custom"
 ]).default("prisma");
 
 // ../crouton-core/src/lib/resource/Sidebar.schema.ts
-var import_zod15 = __toESM(require("zod"), 1);
-var SidebarGroupSchema = import_zod15.default.object({
+var import_zod16 = __toESM(require("zod"), 1);
+var SidebarGroupSchema = import_zod16.default.object({
   /** Human-readable heading shown in the sidebar. Defaults to a title-cased version of the slug. */
-  label: import_zod15.default.string().optional(),
+  label: import_zod16.default.string().optional(),
   /** Controls the order of this group among top-level sidebar items. */
-  position: import_zod15.default.number().optional()
+  position: import_zod16.default.number().optional()
 });
-var SidebarSchema = import_zod15.default.object({
-  hide: import_zod15.default.boolean().default(false),
-  position: import_zod15.default.number().optional(),
-  label: import_zod15.default.string().optional(),
+var SidebarSchema = import_zod16.default.object({
+  hide: import_zod16.default.boolean().default(false),
+  position: import_zod16.default.number().optional(),
+  label: import_zod16.default.string().optional(),
   /**
   * Slug of the group this resource belongs to.
   * Must match a key in `sidebarGroups` in `crouton.json`.
   * Resources with the same `group` are nested under a shared collapsible section.
   */
-  group: import_zod15.default.string().optional()
+  group: import_zod16.default.string().optional()
 });
 
 // ../crouton-core/src/lib/resource/TableAction.schema.ts
-var import_zod16 = require("zod");
-var ActionConditionSchema = import_zod16.z.object({
+var import_zod17 = require("zod");
+var ActionConditionSchema = import_zod17.z.object({
   /** Row field to evaluate. */
-  field: import_zod16.z.string(),
+  field: import_zod17.z.string(),
   /**
   * Comparison operator. Defaults to `"eq"`.
   * - `eq` / `neq`         — strict equality
@@ -1074,7 +1144,7 @@ var ActionConditionSchema = import_zod16.z.object({
   * - `exists`             — field is not null / undefined / empty string
   * - `notExists`          — field is null / undefined / empty string
   */
-  op: import_zod16.z.enum([
+  op: import_zod17.z.enum([
     "eq",
     "neq",
     "gt",
@@ -1085,38 +1155,38 @@ var ActionConditionSchema = import_zod16.z.object({
     "notExists"
   ]).default("eq"),
   /** Comparison value. Not required for `exists` / `notExists`. */
-  value: import_zod16.z.unknown().optional()
+  value: import_zod17.z.unknown().optional()
 });
-var ActionSchema = import_zod16.z.object({
-  type: import_zod16.z.string(),
+var ActionSchema = import_zod17.z.object({
+  type: import_zod17.z.string(),
   /** Unique identifier for the action. */
-  id: import_zod16.z.string(),
+  id: import_zod17.z.string(),
   /** Human-readable button label. */
-  label: import_zod16.z.string(),
+  label: import_zod17.z.string(),
   /** MDI icon name, e.g. `"mdi:open-in-new"`. */
-  icon: import_zod16.z.string().optional(),
+  icon: import_zod17.z.string().optional(),
   /** Tooltip text. Falls back to `label` when omitted. */
-  tooltip: import_zod16.z.string().optional(),
+  tooltip: import_zod17.z.string().optional(),
   condition: ActionConditionSchema.optional()
 });
 var JsonProcedureActionSchema = ActionSchema.extend({
-  type: import_zod16.z.literal("procedure").default("procedure"),
+  type: import_zod17.z.literal("procedure").default("procedure"),
   /**
   * Filename (without extension) inside the resource's `actions/` directory
   * that exports the table-action procedure, e.g. `"syncZotero"`.
   */
-  procedure: import_zod16.z.string(),
+  procedure: import_zod17.z.string(),
   /** HTTP method for the frontend. Defaults to `"post"`. */
-  method: import_zod16.z.string().optional().default("post"),
+  method: import_zod17.z.string().optional().default("post"),
   /** Static query / body params passed to the endpoint. */
-  data: import_zod16.z.record(import_zod16.z.string(), import_zod16.z.unknown()).optional()
+  data: import_zod17.z.record(import_zod17.z.string(), import_zod17.z.unknown()).optional()
 });
 var JsonLinkActionSchema = ActionSchema.extend({
   /** Optional condition evaluated per row. Button is hidden when the condition is false. */
-  type: import_zod16.z.literal("link").default("link"),
+  type: import_zod17.z.literal("link").default("link"),
   /** URL to open. May contain `{env.VAR}` placeholders. */
-  href: import_zod16.z.string(),
-  blank: import_zod16.z.boolean().optional().default(true)
+  href: import_zod17.z.string(),
+  blank: import_zod17.z.boolean().optional().default(true)
 });
 var transformAction = /* @__PURE__ */ __name((action) => {
   const label = action.label;
@@ -1125,20 +1195,20 @@ var transformAction = /* @__PURE__ */ __name((action) => {
     ...action
   };
 }, "transformAction");
-var JsonActionSchema = import_zod16.z.union([
+var JsonActionSchema = import_zod17.z.union([
   JsonProcedureActionSchema,
   JsonLinkActionSchema
 ]).transform(transformAction);
 
 // ../crouton-core/src/lib/resource/include.schema.ts
-var import_zod17 = require("zod");
-var JsonIncludeEntrySchema = import_zod17.z.lazy(() => import_zod17.z.union([
-  import_zod17.z.string(),
-  import_zod17.z.object({
-    relation: import_zod17.z.string(),
-    include: import_zod17.z.array(JsonIncludeEntrySchema).optional(),
+var import_zod18 = require("zod");
+var JsonIncludeEntrySchema = import_zod18.z.lazy(() => import_zod18.z.union([
+  import_zod18.z.string(),
+  import_zod18.z.object({
+    relation: import_zod18.z.string(),
+    include: import_zod18.z.array(JsonIncludeEntrySchema).optional(),
     /** Prisma-format orderBy clause applied to the included records. */
-    orderBy: import_zod17.z.record(import_zod17.z.string(), import_zod17.z.unknown()).optional()
+    orderBy: import_zod18.z.record(import_zod18.z.string(), import_zod18.z.unknown()).optional()
   })
 ]));
 
@@ -1147,16 +1217,16 @@ var BASELINE_RESOURCE_VERSION = 1;
 var CURRENT_RESOURCE_VERSION = 1;
 
 // ../crouton-core/src/lib/resource/ResourceJson.schema.ts
-var JsonColumnsMapSchema = import_zod18.z.record(import_zod18.z.string(), JsonColumnSchema.omit({
+var JsonColumnsMapSchema = import_zod19.z.record(import_zod19.z.string(), JsonColumnSchema.omit({
   id: true
-}).catchall(import_zod18.z.unknown()));
+}).catchall(import_zod19.z.unknown()));
 var ColumnsSchema = JsonColumnsMapSchema;
-var JsonDisplaySchema = import_zod18.z.object({
-  mode: import_zod18.z.enum([
+var JsonDisplaySchema = import_zod19.z.object({
+  mode: import_zod19.z.enum([
     "page",
     "modal"
   ]).default("modal"),
-  customComponent: import_zod18.z.string().nullable().optional().default(null)
+  customComponent: import_zod19.z.string().nullable().optional().default(null)
 });
 var normalizeColumns = /* @__PURE__ */ __name((columns) => {
   if (!columns) return void 0;
@@ -1169,46 +1239,46 @@ var normalizeColumns = /* @__PURE__ */ __name((columns) => {
     label: col.label ?? labelFromId(col.id)
   }));
 }, "normalizeColumns");
-var ResourceJsonShape = import_zod18.z.object({
+var ResourceJsonShape = import_zod19.z.object({
   /**
   * URL of the generated JSON Schema, for editor autocomplete/validation. Declared so the
   * key is *allowed* (not stripped, and not flagged by the very schema it points at).
   * Ignored at runtime.
   */
-  $schema: import_zod18.z.string().optional(),
+  $schema: import_zod19.z.string().optional(),
   /**
   * resource.json shape version. Missing ⇒ baseline (see `./version`). Auto-migrated
   * toward `CURRENT_RESOURCE_VERSION` on load in the dev environment.
   */
-  schemaVersion: import_zod18.z.number().int().positive().optional(),
+  schemaVersion: import_zod19.z.number().int().positive().optional(),
   /** When `true`, the resource lives in the repo but is NOT loaded/served (work in progress). */
-  draft: import_zod18.z.boolean().optional().default(false),
+  draft: import_zod19.z.boolean().optional().default(false),
   /**
   * Where the data comes from. `prisma` (the default) is backed by a Prisma
   * model plus a `schema.ts`; `custom` is configuration only and the developer
   * supplies a `repository.ts`. See `./ResourceKind`.
   */
   kind: ResourceKindSchema,
-  name: import_zod18.z.string(),
-  route: import_zod18.z.string(),
+  name: import_zod19.z.string(),
+  route: import_zod19.z.string(),
   /**
   * Prisma model name. Required when `kind` is `prisma` (enforced by the
   * refinement on `ResourceJsonSchema`), and must be absent when `kind` is
   * `custom` — there is no Prisma delegate to address.
   */
-  model: import_zod18.z.string().optional(),
-  tag: import_zod18.z.string(),
-  title: import_zod18.z.string().optional(),
-  table: import_zod18.z.string().optional(),
+  model: import_zod19.z.string().optional(),
+  tag: import_zod19.z.string(),
+  title: import_zod19.z.string().optional(),
+  table: import_zod19.z.string().optional(),
   /**
   * Type of the resource's primary key, used to coerce `:id` route params.
   * Written by codegen from the Prisma model; defaults to `'string'`.
   */
-  idType: import_zod18.z.enum([
+  idType: import_zod19.z.enum([
     "string",
     "number"
   ]).optional(),
-  database: import_zod18.z.string().optional(),
+  database: import_zod19.z.string().optional(),
   /**
   * Mount this resource under a parent route instead of at the top level —
   * see `./ParentRef.schema`. Only valid on a `kind: "custom"` resource.
@@ -1216,14 +1286,16 @@ var ResourceJsonShape = import_zod18.z.object({
   parent: ParentRefSchema.optional(),
   sidebar: SidebarSchema.default(SidebarSchema.parse({})),
   display: JsonDisplaySchema.default(JsonDisplaySchema.parse({})),
+  /** Global security block — applies to every operation unless overridden per-operation. */
+  security: SecuritySchema.optional(),
   operations: JsonOperationsSchema,
   columns: ColumnsSchema.default(ColumnsSchema.parse({})),
-  calculatedColumns: import_zod18.z.array(CalculatedColumnSchema).default([]),
-  actions: import_zod18.z.array(JsonActionSchema).default([]),
+  calculatedColumns: import_zod19.z.array(CalculatedColumnSchema).default([]),
+  actions: import_zod19.z.array(JsonActionSchema).default([]),
   /** Global table-level actions (no record id). Shown as toolbar buttons. */
-  tableActions: import_zod18.z.array(JsonActionSchema).default([]),
+  tableActions: import_zod19.z.array(JsonActionSchema).default([]),
   /** Modal width when opening a form for this resource. */
-  modalSize: import_zod18.z.enum([
+  modalSize: import_zod19.z.enum([
     "xs",
     "sm",
     "lg",
@@ -1236,7 +1308,7 @@ var ResourceJsonShape = import_zod18.z.object({
   * `{ "relation": "text_author", "include": ["author"] }` →
   *   `include: { text_author: { include: { author: true } } }`
   */
-  include: import_zod18.z.array(JsonIncludeEntrySchema).default([])
+  include: import_zod19.z.array(JsonIncludeEntrySchema).default([])
 });
 var refineByKind = /* @__PURE__ */ __name((obj, ctx) => {
   if (obj.kind === "custom") {
@@ -1381,58 +1453,58 @@ var resolveViewField = /* @__PURE__ */ __name((c) => mergeFieldVariant(c.fieldIn
 var resolveTableField = /* @__PURE__ */ __name((c) => mergeFieldVariant(resolveViewField(c), c.fieldTable), "resolveTableField");
 
 // ../crouton-core/src/lib/config/CroutonConfig.schema.ts
-var import_zod19 = require("zod");
-var RulesetSchema = import_zod19.z.object({
-  hideIdInTable: import_zod19.z.boolean().default(true),
-  hideIdInForm: import_zod19.z.boolean().default(true),
-  hideIdInView: import_zod19.z.boolean().default(true),
-  hideTimestamps: import_zod19.z.boolean().default(true),
-  hideForeignKeys: import_zod19.z.boolean().default(true),
-  includeRelations: import_zod19.z.boolean().default(true),
-  hideRelationsInTable: import_zod19.z.boolean().default(true),
-  showRelationsInForm: import_zod19.z.boolean().default(true),
-  enumValueLabel: import_zod19.z.boolean().default(true),
-  sharedEnums: import_zod19.z.boolean().default(true),
+var import_zod20 = require("zod");
+var RulesetSchema = import_zod20.z.object({
+  hideIdInTable: import_zod20.z.boolean().default(true),
+  hideIdInForm: import_zod20.z.boolean().default(true),
+  hideIdInView: import_zod20.z.boolean().default(true),
+  hideTimestamps: import_zod20.z.boolean().default(true),
+  hideForeignKeys: import_zod20.z.boolean().default(true),
+  includeRelations: import_zod20.z.boolean().default(true),
+  hideRelationsInTable: import_zod20.z.boolean().default(true),
+  showRelationsInForm: import_zod20.z.boolean().default(true),
+  enumValueLabel: import_zod20.z.boolean().default(true),
+  sharedEnums: import_zod20.z.boolean().default(true),
   defaultOperations: JsonOperationsSchema.default(JsonOperationsSchema.parse({}))
 });
-var I18nConfigSchema = import_zod19.z.object({
+var I18nConfigSchema = import_zod20.z.object({
   /** Default / fallback language. */
-  defaultLanguage: import_zod19.z.string().default("en"),
+  defaultLanguage: import_zod20.z.string().default("en"),
   /** All supported language codes. */
-  languages: import_zod19.z.array(import_zod19.z.string()).min(1),
+  languages: import_zod20.z.array(import_zod20.z.string()).min(1),
   /** Directory containing `<lang>.json` bundles, relative to project root. */
-  translationsDir: import_zod19.z.string().default("translations")
+  translationsDir: import_zod20.z.string().default("translations")
 });
-var CroutonConfigSchema = import_zod19.z.object({
+var CroutonConfigSchema = import_zod20.z.object({
   /**
   * Application title served to the frontend via `GET /_app/layout`.
   * Displayed in the admin sidebar header.
   */
-  title: import_zod19.z.string(),
+  title: import_zod20.z.string(),
   /** Where resource directories live, relative to the project root. */
-  resourcesDir: import_zod19.z.string(),
+  resourcesDir: import_zod20.z.string(),
   /** Where datasource folders live (each with a `data-source.json`). */
-  dataSourcesDir: import_zod19.z.string(),
+  dataSourcesDir: import_zod20.z.string(),
   /**
   * Template for a model's Zod export name. `{Model}` → Prisma model name.
   * Defaults to `{Model}WithRelationsSchema` (the relations-aware schema
   * emitted by zod-prisma-types when `createRelationValuesTypes` is on).
   */
-  schemaExportName: import_zod19.z.string().default("{Model}WithRelationsSchema"),
+  schemaExportName: import_zod20.z.string().default("{Model}WithRelationsSchema"),
   /** Path to the shared enum registry, relative to project root. Default `crouton.enums.json`. */
-  enumsFile: import_zod19.z.string().default("crouton.enums.json"),
+  enumsFile: import_zod20.z.string().default("crouton.enums.json"),
   /** Optional overrides of the default visibility ruleset. */
   rules: RulesetSchema.default(RulesetSchema.parse({})),
   /**
   * Sidebar group definitions, keyed by group slug (e.g. `"metadata"`).
   * Resources reference a group via `sidebar.group` in their `resource.json`.
   */
-  sidebarGroups: import_zod19.z.record(import_zod19.z.string(), SidebarGroupSchema).default({}),
+  sidebarGroups: import_zod20.z.record(import_zod20.z.string(), SidebarGroupSchema).default({}),
   /**
   * Whether form fields are saved automatically as the user edits them.
   * @default true
   */
-  autoSave: import_zod19.z.boolean().default(true),
+  autoSave: import_zod20.z.boolean().default(true),
   /** Optional i18n / translation configuration. */
   i18n: I18nConfigSchema.optional()
 });
@@ -1820,7 +1892,7 @@ var injectCalculatedColumns = /* @__PURE__ */ __name((tableView, calculated) =>
 var injectCalculatedColumnsToView = /* @__PURE__ */ __name((viewConfig, calculated) => injectCalculatedColumnsIntoView(viewConfig, calculated, "view"), "injectCalculatedColumnsToView");
 
 // ../crouton-core/src/lib/view/view.builder.ts
-var import_zod21 = require("zod");
+var import_zod22 = require("zod");
 
 // ../crouton-core/src/lib/view/column-type-schema.source.ts
 var optionValues = /* @__PURE__ */ __name((col) => {
@@ -1856,18 +1928,18 @@ var columnTypeSchemaSource = /* @__PURE__ */ __name((schemaCols) => {
 }, "columnTypeSchemaSource");
 
 // ../crouton-core/src/lib/view/json-schema.opts.ts
-var import_zod20 = require("zod");
+var import_zod21 = require("zod");
 var isInstanceOf = /* @__PURE__ */ __name((zodSchema, className) => {
-  if (!(zodSchema instanceof import_zod20.z.ZodCustom)) return false;
+  if (!(zodSchema instanceof import_zod21.z.ZodCustom)) return false;
   const result = zodSchema.safeParse(null);
   return !result.success && result.error.issues[0]?.expected === className;
 }, "isInstanceOf");
 var jsonSchemaOverride = /* @__PURE__ */ __name(({ zodSchema, jsonSchema }) => {
-  if (zodSchema instanceof import_zod20.z.ZodDate) {
+  if (zodSchema instanceof import_zod21.z.ZodDate) {
     jsonSchema.type = "string";
     jsonSchema.format = "date-time";
   }
-  if (zodSchema instanceof import_zod20.z.ZodBigInt) {
+  if (zodSchema instanceof import_zod21.z.ZodBigInt) {
     jsonSchema.type = "integer";
   }
   if (isInstanceOf(zodSchema, "Decimal")) {
@@ -1941,7 +2013,7 @@ var zodSchemaSource = /* @__PURE__ */ __name((schema) => (schemaCols) => {
     true
   ]));
   const picked = schema.pick(mask);
-  return (0, import_zod21.toJSONSchema)(picked, {
+  return (0, import_zod22.toJSONSchema)(picked, {
     target: "draft-07",
     ...jsonSchemaOpts
   });
@@ -2148,45 +2220,55 @@ var buildViewsFromColumns = /* @__PURE__ */ __name((columns) => {
 }, "buildViewsFromColumns");
 
 // ../crouton-core/src/lib/view/view.schema.ts
-var import_zod22 = require("zod");
-var ViewColumnConfigSchema = import_zod22.z.object({
-  id: import_zod22.z.string(),
-  label: import_zod22.z.string().optional(),
-  sortable: import_zod22.z.boolean().optional(),
-  searchable: import_zod22.z.boolean().optional(),
+var import_zod23 = require("zod");
+var ViewColumnConfigSchema = import_zod23.z.object({
+  id: import_zod23.z.string(),
+  label: import_zod23.z.string().optional(),
+  sortable: import_zod23.z.boolean().optional(),
+  searchable: import_zod23.z.boolean().optional(),
   fieldInput: FieldInputSchema.optional()
 });
-var ViewConfigSchema = import_zod22.z.object({
-  json_schema: import_zod22.z.record(import_zod22.z.string(), import_zod22.z.unknown()),
-  ui_schema: import_zod22.z.record(import_zod22.z.string(), import_zod22.z.unknown()),
-  columns: import_zod22.z.array(ViewColumnConfigSchema),
-  defaultSort: import_zod22.z.string().optional()
+var ViewConfigSchema = import_zod23.z.object({
+  // TODO why we have both?
+  json_schema: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.unknown()).optional(),
+  ui_schema: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.unknown()).optional(),
+  // TODO why we have both?
+  ui: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.unknown()).optional(),
+  data: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.unknown()).optional(),
+  columns: import_zod23.z.array(ViewColumnConfigSchema),
+  defaultSort: import_zod23.z.string().optional()
 });
+var viewDefList = [
+  "table",
+  "view",
+  "form"
+];
+var ViewDefEnum = import_zod23.z.enum(viewDefList);
 
 // ../crouton-core/src/lib/i18n/Translations.schema.ts
-var import_zod23 = require("zod");
-var NestedStringRecord = import_zod23.z.lazy(() => import_zod23.z.record(import_zod23.z.string(), import_zod23.z.union([
-  import_zod23.z.string(),
+var import_zod24 = require("zod");
+var NestedStringRecord = import_zod24.z.lazy(() => import_zod24.z.record(import_zod24.z.string(), import_zod24.z.union([
+  import_zod24.z.string(),
   NestedStringRecord
 ])));
-var TranslationBundleSchema = import_zod23.z.object({
-  app: import_zod23.z.object({
-    title: import_zod23.z.string().optional()
+var TranslationBundleSchema = import_zod24.z.object({
+  app: import_zod24.z.object({
+    title: import_zod24.z.string().optional()
   }).optional(),
-  sidebarGroups: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string()).optional(),
-  resources: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.object({
-    title: import_zod23.z.string().optional(),
-    sidebar: import_zod23.z.string().optional(),
-    columns: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string()).optional(),
-    actions: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string()).optional(),
-    subResources: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.object({
-      title: import_zod23.z.string().optional(),
-      columns: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string()).optional()
+  sidebarGroups: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional(),
+  resources: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.object({
+    title: import_zod24.z.string().optional(),
+    sidebar: import_zod24.z.string().optional(),
+    columns: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional(),
+    actions: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional(),
+    subResources: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.object({
+      title: import_zod24.z.string().optional(),
+      columns: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional()
     }).optional()).optional()
   }).optional()).optional(),
-  enums: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string())).optional(),
+  enums: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string())).optional(),
   ui: NestedStringRecord.optional(),
-  validation: import_zod23.z.record(import_zod23.z.string(), import_zod23.z.string()).optional()
+  validation: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional()
 }).passthrough();
 
 // ../crouton-core/src/lib/i18n/translation-keys.ts
@@ -2266,25 +2348,25 @@ var resolveLanguage = /* @__PURE__ */ __name((acceptLanguage, supported, default
 }, "resolveLanguage");
 
 // src/lib/crouton-api.module.ts
-var import_common22 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
+var import_common24 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
 
 // src/lib/crud/app-layout/app-layout.types.ts
-var import_zod24 = require("zod");
-var SidebarLeafSchema = import_zod24.z.object({
-  kind: import_zod24.z.literal("item").default("item"),
-  id: import_zod24.z.string(),
-  label: import_zod24.z.string(),
-  position: import_zod24.z.number().optional()
+var import_zod25 = require("zod");
+var SidebarLeafSchema = import_zod25.z.object({
+  kind: import_zod25.z.literal("item").default("item"),
+  id: import_zod25.z.string(),
+  label: import_zod25.z.string(),
+  position: import_zod25.z.number().optional()
 });
-var SidebarGroupSchema2 = import_zod24.z.object({
-  kind: import_zod24.z.literal("group").default("group"),
-  id: import_zod24.z.string(),
-  label: import_zod24.z.string(),
-  position: import_zod24.z.number().optional(),
-  children: import_zod24.z.array(SidebarLeafSchema).default([])
+var SidebarGroupSchema2 = import_zod25.z.object({
+  kind: import_zod25.z.literal("group").default("group"),
+  id: import_zod25.z.string(),
+  label: import_zod25.z.string(),
+  position: import_zod25.z.number().optional(),
+  children: import_zod25.z.array(SidebarLeafSchema).default([])
 });
-var SidebarNodeSchema = import_zod24.z.discriminatedUnion("kind", [
+var SidebarNodeSchema = import_zod25.z.discriminatedUnion("kind", [
   SidebarLeafSchema,
   SidebarGroupSchema2
 ]);
@@ -2543,6 +2625,12 @@ var resolveColumnFieldVariants = /* @__PURE__ */ __name((cols) => cols?.map((col
 
 // src/lib/crud/translation/localize-resource.ts
 var clone = /* @__PURE__ */ __name((obj) => JSON.parse(JSON.stringify(obj)), "clone");
+var cloneResource = /* @__PURE__ */ __name((config) => {
+  const { definition, ...rest } = config;
+  const localized = clone(rest);
+  if (definition) localized.definition = definition;
+  return localized;
+}, "cloneResource");
 var translateEnumOptions = /* @__PURE__ */ __name((columns, t) => {
   if (!columns) return;
   for (const col of columns) {
@@ -2592,7 +2680,7 @@ var patchViewTitles = /* @__PURE__ */ __name((views, columnLabels) => {
 }, "patchViewTitles");
 var localizeResource = /* @__PURE__ */ __name((config, t) => {
   const name = config.name;
-  const localized = clone(config);
+  const localized = cloneResource(config);
   localized.title = t(resourceTitleKey(name), config.title ?? config.tag);
   if (localized.sidebar) {
     const sidebarTranslation = t(resourceSidebarKey(name), config.sidebar?.label);
@@ -2926,7 +3014,11 @@ var loadConfig = /* @__PURE__ */ __name(async () => {
     const mod = await import(path);
     config = mod.default ?? mod;
   }
-  return CroutonConfigSchema.parse(config);
+  const parsed = CroutonConfigSchema.parse(config);
+  return {
+    ...parsed,
+    configDir: (0, import_node_path3.dirname)(path)
+  };
 }, "loadConfig");
 
 // src/lib/crud/crouton-validation.filter.ts
@@ -3080,51 +3172,51 @@ CroutonValidationExceptionFilter = _ts_decorate3([
 ], CroutonValidationExceptionFilter);
 
 // src/lib/crud/crud-controller.factory.ts
-var import_common19 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 var import_swagger11 = require("@nestjs/swagger");
 
 // src/lib/crud/action/action.types.ts
-var import_zod25 = require("zod");
-var ActionMetadataSchema = import_zod25.z.object({
+var import_zod26 = require("zod");
+var ActionMetadataSchema = import_zod26.z.object({
   /** URL segment used in the endpoint. */
-  id: import_zod25.z.string(),
+  id: import_zod26.z.string(),
   /** Human-readable label shown as a button. */
-  label: import_zod25.z.string().optional(),
+  label: import_zod26.z.string().optional(),
   /** MDI icon name, e.g. `"mdi:open-in-new"`. */
-  icon: import_zod25.z.string().optional(),
+  icon: import_zod26.z.string().optional(),
   /** Tooltip text. Falls back to `label` when omitted. */
-  tooltip: import_zod25.z.string().optional(),
+  tooltip: import_zod26.z.string().optional(),
   /** Per-row condition — button is hidden when false. */
-  condition: import_zod25.z.custom().optional()
+  condition: import_zod26.z.custom().optional()
 });
 var ResourceLinkActionSchema = ActionMetadataSchema.extend({
-  type: import_zod25.z.literal("link"),
+  type: import_zod26.z.literal("link"),
   /** URL to open. May contain `{id}` or `{env.VAR}` placeholders. */
-  href: import_zod25.z.string()
+  href: import_zod26.z.string()
 });
 var ResourceRowProcedureActionSchema = ActionMetadataSchema.extend({
-  type: import_zod25.z.literal("procedure").optional(),
+  type: import_zod26.z.literal("procedure").optional(),
   /** HTTP method for the endpoint. Defaults to `"post"`. */
-  method: import_zod25.z.string().optional(),
+  method: import_zod26.z.string().optional(),
   /** Static data payload merged into the request body by the frontend. */
-  data: import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown()).optional(),
+  data: import_zod26.z.record(import_zod26.z.string(), import_zod26.z.unknown()).optional(),
   /** Procedure called with `(prisma, recordId)`. */
-  procedure: import_zod25.z.custom((v) => typeof v === "function")
+  procedure: import_zod26.z.custom((v) => typeof v === "function")
 });
 var ResourceTableProcedureActionSchema = ActionMetadataSchema.extend({
-  type: import_zod25.z.literal("procedure").optional(),
+  type: import_zod26.z.literal("procedure").optional(),
   /** HTTP method for the endpoint. Defaults to `"post"`. */
-  method: import_zod25.z.string().optional(),
+  method: import_zod26.z.string().optional(),
   /** Static data payload merged into the request body by the frontend. */
-  data: import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown()).optional(),
+  data: import_zod26.z.record(import_zod26.z.string(), import_zod26.z.unknown()).optional(),
   /** Procedure called with `(prisma)` — no record id. */
-  procedure: import_zod25.z.custom((v) => typeof v === "function")
+  procedure: import_zod26.z.custom((v) => typeof v === "function")
 });
-var ResourceRowActionSchema = import_zod25.z.union([
+var ResourceRowActionSchema = import_zod26.z.union([
   ResourceRowProcedureActionSchema,
   ResourceLinkActionSchema
 ]);
-var ResourceTableActionSchema = import_zod25.z.union([
+var ResourceTableActionSchema = import_zod26.z.union([
   ResourceTableProcedureActionSchema,
   ResourceLinkActionSchema
 ]);
@@ -3204,9 +3296,18 @@ var schemaFor = /* @__PURE__ */ __name((def2, op) => {
   return entry.schema;
 }, "schemaFor");
 var upsertOnFor = /* @__PURE__ */ __name((def2) => def2.upsert?.upsertOn, "upsertOnFor");
+var opSecurity = /* @__PURE__ */ __name((entry) => {
+  if (!entry || entry === true) return void 0;
+  return entry.security;
+}, "opSecurity");
+var securityFor = /* @__PURE__ */ __name((config, def2, op, moduleDefault) => opSecurity(def2[op]) ?? config.security ?? moduleDefault, "securityFor");
+var securityForSub = /* @__PURE__ */ __name((config, sub, op, moduleDefault) => {
+  const entry = sub.operations[op];
+  return opSecurity(entry) ?? config.security ?? moduleDefault;
+}, "securityForSub");
 
 // src/lib/crud/custom-repository/custom-repository.types.ts
-var import_zod26 = require("zod");
+var import_zod27 = require("zod");
 var CUSTOM_OPS = [
   "findAll",
   "findOne",
@@ -3223,7 +3324,7 @@ var PARENT_METHOD = {
   patch: "patchByParent",
   delete: "deleteByParent"
 };
-var CustomRepositorySchema = import_zod26.z.custom((value) => typeof value === "object" && value !== null);
+var CustomRepositorySchema = import_zod27.z.custom((value) => typeof value === "object" && value !== null);
 
 // src/lib/crud/resource/resource-load-errors.registry.ts
 var ResourceLoadErrorsRegistry = class ResourceLoadErrorsRegistry2 {
@@ -3297,22 +3398,22 @@ var DEFAULT_ID_TYPE = "string";
 var DEFAULT_ID_FIELD = "id";
 
 // src/lib/crud/hooks/hooks.types.ts
-var import_zod27 = require("zod");
-var WriteOpSchema = import_zod27.z.enum([
+var import_zod28 = require("zod");
+var WriteOpSchema = import_zod28.z.enum([
   "create",
   "update",
   "patch",
   "upsert",
   "delete"
 ]);
-var ReadOpSchema = import_zod27.z.enum([
+var ReadOpSchema = import_zod28.z.enum([
   "findAll",
   "findOne"
 ]);
-var ResourceHooksSchema = import_zod27.z.object({
-  beforeWrite: import_zod27.z.custom().optional(),
-  afterWrite: import_zod27.z.custom().optional(),
-  afterRead: import_zod27.z.custom().optional()
+var ResourceHooksSchema = import_zod28.z.object({
+  beforeWrite: import_zod28.z.custom().optional(),
+  afterWrite: import_zod28.z.custom().optional(),
+  afterRead: import_zod28.z.custom().optional()
 });
 
 // src/lib/crud/hooks/hooks.loader.ts
@@ -4260,9 +4361,9 @@ var ReadRepository = class {
 };
 
 // src/lib/crud/schema.utils.ts
-var import_zod28 = require("zod");
+var import_zod29 = require("zod");
 function isZodSchema(schema) {
-  return schema instanceof import_zod28.ZodObject;
+  return schema instanceof import_zod29.ZodObject;
 }
 __name(isZodSchema, "isZodSchema");
 var isNullableProperty2 = /* @__PURE__ */ __name((property) => {
@@ -4276,7 +4377,7 @@ var dropNullableFromRequired2 = /* @__PURE__ */ __name((jsonSchema) => {
 }, "dropNullableFromRequired");
 function toJsonSchema(schema) {
   if (isZodSchema(schema)) {
-    const jsonSchema = (0, import_zod28.toJSONSchema)(schema, {
+    const jsonSchema = (0, import_zod29.toJSONSchema)(schema, {
       target: "openApi3",
       ...jsonSchemaOpts
     });
@@ -4831,9 +4932,121 @@ var findModule2 = /* @__PURE__ */ __name((dir, name) => {
 }, "findModule");
 
 // src/lib/crud/operations/register-actions.ts
-var import_common10 = require("@nestjs/common");
+var import_common12 = require("@nestjs/common");
 var import_swagger2 = require("@nestjs/swagger");
 
+// src/lib/crud/security/crouton-security.guard.ts
+var import_common11 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+
+// src/lib/crud/security/security-guard.registry.ts
+var import_common10 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc2) {
+  var c = arguments.length, r = c < 3 ? target : desc2 === null ? desc2 = Object.getOwnPropertyDescriptor(target, key) : desc2, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc2);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata6(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata6, "_ts_metadata");
+var SecurityGuardRegistry = class {
+  static {
+    __name(this, "SecurityGuardRegistry");
+  }
+  guards;
+  constructor(guards = {}) {
+    this.guards = guards;
+  }
+  resolve(name) {
+    const g = this.guards[name];
+    if (!g) throw new Error(`Unknown security guard "${name}". Register it in security.guards.`);
+    return g;
+  }
+  classes() {
+    return Object.values(this.guards);
+  }
+};
+SecurityGuardRegistry = _ts_decorate6([
+  (0, import_common10.Injectable)(),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof Record === "undefined" ? Object : Record
+  ])
+], SecurityGuardRegistry);
+
+// src/lib/crud/security/crouton-security.guard.ts
+function _ts_decorate7(decorators, target, key, desc2) {
+  var c = arguments.length, r = c < 3 ? target : desc2 === null ? desc2 = Object.getOwnPropertyDescriptor(target, key) : desc2, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc2);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata7(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata7, "_ts_metadata");
+var CROUTON_SECURITY = "crouton:security";
+var CroutonSecurityGuard = class {
+  static {
+    __name(this, "CroutonSecurityGuard");
+  }
+  reflector;
+  registry;
+  moduleRef;
+  constructor(reflector, registry, moduleRef) {
+    this.reflector = reflector;
+    this.registry = registry;
+    this.moduleRef = moduleRef;
+  }
+  async canActivate(context) {
+    const sec = this.reflector.get(CROUTON_SECURITY, context.getHandler());
+    if (!sec || "public" in sec) return true;
+    const names = Array.isArray(sec.guard) ? sec.guard : [
+      sec.guard
+    ];
+    for (const name of names) {
+      const cls = this.registry.resolve(name);
+      const guard = this.moduleRef.get(cls, {
+        strict: false
+      });
+      const ok = await guard.canActivate(context);
+      if (!ok) return false;
+    }
+    return true;
+  }
+};
+CroutonSecurityGuard = _ts_decorate7([
+  (0, import_common11.Injectable)(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof SecurityGuardRegistry === "undefined" ? Object : SecurityGuardRegistry,
+    typeof import_core.ModuleRef === "undefined" ? Object : import_core.ModuleRef
+  ])
+], CroutonSecurityGuard);
+
 // src/lib/crud/operations/decorator.utils.ts
 var def = /* @__PURE__ */ __name((cls, method, fn) => {
   Object.defineProperty(cls.prototype, method, {
@@ -4855,8 +5068,8 @@ var registerActionRoutes = /* @__PURE__ */ __name((ctx) => {
       return action.procedure(this.repo.prisma, recordId);
     });
     const d = desc(cls, methodName);
-    (0, import_common10.Post)(`procedure/${action.id}/:recordId`)(cls.prototype, methodName, d);
-    (0, import_common10.Param)("recordId")(cls.prototype, methodName, 0);
+    (0, import_common12.Post)(`procedure/${action.id}/:recordId`)(cls.prototype, methodName, d);
+    (0, import_common12.Param)("recordId")(cls.prototype, methodName, 0);
     (0, import_swagger2.ApiOperation)({
       summary: `Execute action "${action.label}" on a ${name}`
     })(cls.prototype, methodName, d);
@@ -4868,6 +5081,10 @@ var registerActionRoutes = /* @__PURE__ */ __name((ctx) => {
       status: 200,
       description: `Action "${action.id}" result`
     })(cls.prototype, methodName, d);
+    const sec = ctx.config.security ?? ctx.moduleDefaultSecurity;
+    if (sec) {
+      (0, import_common12.SetMetadata)(CROUTON_SECURITY, sec)(cls.prototype, methodName, d);
+    }
   }
 }, "registerActionRoutes");
 var registerTableActionRoutes = /* @__PURE__ */ __name((ctx) => {
@@ -4880,7 +5097,7 @@ var registerTableActionRoutes = /* @__PURE__ */ __name((ctx) => {
       return action.procedure(this.repo.prisma);
     });
     const d = desc(cls, methodName);
-    (0, import_common10.Post)(`table-action/${action.id}`)(cls.prototype, methodName, d);
+    (0, import_common12.Post)(`table-action/${action.id}`)(cls.prototype, methodName, d);
     (0, import_swagger2.ApiOperation)({
       summary: `Execute table action "${action.label ?? action.id}" on ${name}`
     })(cls.prototype, methodName, d);
@@ -4888,11 +5105,15 @@ var registerTableActionRoutes = /* @__PURE__ */ __name((ctx) => {
       status: 200,
       description: `Table action "${action.id}" result`
     })(cls.prototype, methodName, d);
+    const sec = ctx.config.security ?? ctx.moduleDefaultSecurity;
+    if (sec) {
+      (0, import_common12.SetMetadata)(CROUTON_SECURITY, sec)(cls.prototype, methodName, d);
+    }
   }
 }, "registerTableActionRoutes");
 
 // src/lib/crud/operations/register-create.ts
-var import_common11 = require("@nestjs/common");
+var import_common13 = require("@nestjs/common");
 var import_swagger3 = require("@nestjs/swagger");
 var defaultCreate = /* @__PURE__ */ __name((ctx) => {
   if (!isOperationEnabled(ctx.definition, "create")) return null;
@@ -4909,7 +5130,7 @@ var defaultCreate = /* @__PURE__ */ __name((ctx) => {
       bodyDecorator(createSchema, {
         coerceNullableUndefinedToNull: true
       })(cls.prototype, methodName, 0);
-      (0, import_common11.Req)()(cls.prototype, methodName, 1);
+      (0, import_common13.Req)()(cls.prototype, methodName, 1);
     }, "decorators")
   };
 }, "defaultCreate");
@@ -4921,9 +5142,9 @@ var childCreate = /* @__PURE__ */ __name((sub) => (ctx) => {
     return this.repo.createChild(id, sub, body, req);
   }, "createFn");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common11.Param)("id")(cls.prototype, methodName, 0);
-    (0, import_common11.Body)()(cls.prototype, methodName, 1);
-    (0, import_common11.Req)()(cls.prototype, methodName, 2);
+    (0, import_common13.Param)("id")(cls.prototype, methodName, 0);
+    (0, import_common13.Body)()(cls.prototype, methodName, 1);
+    (0, import_common13.Req)()(cls.prototype, methodName, 2);
   }, "decorators");
   return {
     route: `:id/${sub.childRoute}`,
@@ -4941,7 +5162,7 @@ var registerCreate = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.createFn);
   const d = desc(cls, methodName);
-  (0, import_common11.Post)(route)(cls.prototype, methodName, d);
+  (0, import_common13.Post)(route)(cls.prototype, methodName, d);
   (0, import_swagger3.ApiOperation)({
     summary: `Create a ${name}`
   })(cls.prototype, methodName, d);
@@ -4950,10 +5171,11 @@ var registerCreate = /* @__PURE__ */ __name((ctx, sub) => {
     description: `${name} created`
   })(cls.prototype, methodName, d);
   properties.decorators();
+  ctx.secure(methodName, "create", sub);
 }, "registerCreate");
 
 // src/lib/crud/operations/register-delete.ts
-var import_common12 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 var import_swagger4 = require("@nestjs/swagger");
 var defaultDelete = /* @__PURE__ */ __name((ctx) => {
   if (!isOperationEnabled(ctx.definition, "delete")) return null;
@@ -4979,9 +5201,9 @@ var deleteChild = /* @__PURE__ */ __name((sub) => (ctx) => {
     return this.repo.deleteChild(sub, childId, parentId2, req);
   }, "deleteFn");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common12.Param)("childId")(cls.prototype, methodName, 0);
-    (0, import_common12.Param)("id")(cls.prototype, methodName, 1);
-    (0, import_common12.Req)()(cls.prototype, methodName, 2);
+    (0, import_common14.Param)("childId")(cls.prototype, methodName, 0);
+    (0, import_common14.Param)("id")(cls.prototype, methodName, 1);
+    (0, import_common14.Req)()(cls.prototype, methodName, 2);
   }, "decorators");
   return {
     route: `:id/${sub.childRoute}/:childId`,
@@ -4999,8 +5221,8 @@ var registerDelete = /* @__PURE__ */ __name((ctx, sub) => {
   const { methodName, route, name } = properties;
   def(cls, methodName, properties.deleteFn);
   const d = desc(cls, methodName);
-  (0, import_common12.Delete)(route)(cls.prototype, methodName, d);
-  (0, import_common12.Param)("id")(cls.prototype, methodName, 0);
+  (0, import_common14.Delete)(route)(cls.prototype, methodName, d);
+  (0, import_common14.Param)("id")(cls.prototype, methodName, 0);
   (0, import_swagger4.ApiOperation)({
     summary: `Delete ${name} record`
   })(cls.prototype, methodName, d);
@@ -5009,11 +5231,12 @@ var registerDelete = /* @__PURE__ */ __name((ctx, sub) => {
     status: 200
   })(cls.prototype, methodName, d);
   properties.decorators();
-  if (!sub) (0, import_common12.Req)()(cls.prototype, methodName, 1);
+  if (!sub) (0, import_common14.Req)()(cls.prototype, methodName, 1);
+  ctx.secure(methodName, "delete", sub);
 }, "registerDelete");
 
 // src/lib/crud/operations/register-findall.ts
-var import_common13 = require("@nestjs/common");
+var import_common15 = require("@nestjs/common");
 var import_swagger5 = require("@nestjs/swagger");
 
 // src/lib/crud/request.dto.ts
@@ -5169,8 +5392,8 @@ var childFindAll = /* @__PURE__ */ __name((sub) => (ctx) => {
     return findAllByParent(this.repo, id, sub.childRoute, params, req);
   }, "findAll");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common13.Param)("id")(cls.prototype, methodName, 2);
-    (0, import_common13.Req)()(cls.prototype, methodName, 3);
+    (0, import_common15.Param)("id")(cls.prototype, methodName, 2);
+    (0, import_common15.Req)()(cls.prototype, methodName, 3);
   }, "decorators");
   return {
     name: sub.childRoute,
@@ -5189,10 +5412,10 @@ var registerFindAll = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.findAll);
   const d = desc(cls, methodName);
-  (0, import_common13.Get)(route)(cls.prototype, methodName, d);
-  (0, import_common13.Query)(new ZodValidationPipe(RequestDtoNoOffset.zodSchema))(cls.prototype, methodName, 0);
-  (0, import_common13.Query)("q")(cls.prototype, methodName, 1);
-  if (!sub) (0, import_common13.Req)()(cls.prototype, methodName, 2);
+  (0, import_common15.Get)(route)(cls.prototype, methodName, d);
+  (0, import_common15.Query)(new ZodValidationPipe(RequestDtoNoOffset.zodSchema))(cls.prototype, methodName, 0);
+  (0, import_common15.Query)("q")(cls.prototype, methodName, 1);
+  if (!sub) (0, import_common15.Req)()(cls.prototype, methodName, 2);
   (0, import_swagger5.ApiOperation)({
     summary: `List all ${name}s`
   })(cls.prototype, methodName, d);
@@ -5207,10 +5430,11 @@ var registerFindAll = /* @__PURE__ */ __name((ctx, sub) => {
     }
   })(cls.prototype, methodName, d);
   properties.decorators();
+  ctx.secure(methodName, "findAll", sub);
 }, "registerFindAll");
 
 // src/lib/crud/operations/register-findone.ts
-var import_common14 = require("@nestjs/common");
+var import_common16 = require("@nestjs/common");
 var import_swagger6 = require("@nestjs/swagger");
 var defaultFindOne = /* @__PURE__ */ __name((ctx) => {
   if (!isOperationEnabled(ctx.definition, "findOne")) return null;
@@ -5224,8 +5448,8 @@ var defaultFindOne = /* @__PURE__ */ __name((ctx) => {
       return this.repo.findOne(id, req);
     }, "findOneFn"),
     decorators: /* @__PURE__ */ __name(() => {
-      (0, import_common14.Param)("id")(cls.prototype, methodName, 0);
-      (0, import_common14.Req)()(cls.prototype, methodName, 1);
+      (0, import_common16.Param)("id")(cls.prototype, methodName, 0);
+      (0, import_common16.Req)()(cls.prototype, methodName, 1);
     }, "decorators")
   };
 }, "defaultFindOne");
@@ -5237,9 +5461,9 @@ var childFindOne = /* @__PURE__ */ __name((sub) => (ctx) => {
     return this.repo.findOneChild(sub, childId, parentId2, req);
   }, "findOneFn");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common14.Param)("id")(cls.prototype, methodName, 0);
-    (0, import_common14.Param)("childId")(cls.prototype, methodName, 1);
-    (0, import_common14.Req)()(cls.prototype, methodName, 2);
+    (0, import_common16.Param)("id")(cls.prototype, methodName, 0);
+    (0, import_common16.Param)("childId")(cls.prototype, methodName, 1);
+    (0, import_common16.Req)()(cls.prototype, methodName, 2);
   }, "decorators");
   return {
     route: `:id/${sub.childRoute}/:childId`,
@@ -5257,7 +5481,7 @@ var registerFindOne = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.findOneFn);
   const d = desc(cls, methodName);
-  (0, import_common14.Get)(route)(cls.prototype, methodName, d);
+  (0, import_common16.Get)(route)(cls.prototype, methodName, d);
   (0, import_swagger6.ApiOperation)({
     summary: `Get one ${name} by id`
   })(cls.prototype, methodName, d);
@@ -5273,10 +5497,11 @@ var registerFindOne = /* @__PURE__ */ __name((ctx, sub) => {
     description: "Not found"
   })(cls.prototype, methodName, d);
   properties.decorators();
+  ctx.secure(methodName, "findOne", sub);
 }, "registerFindOne");
 
 // src/lib/crud/operations/register-patch.ts
-var import_common15 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 var import_swagger7 = require("@nestjs/swagger");
 var defaultPatch = /* @__PURE__ */ __name((ctx) => {
   if (!isOperationEnabled(ctx.definition, "patch")) return null;
@@ -5290,9 +5515,9 @@ var defaultPatch = /* @__PURE__ */ __name((ctx) => {
       return this.repo.patch(id, body, req);
     }, "patchFn"),
     decorators: /* @__PURE__ */ __name(() => {
-      (0, import_common15.Param)("id")(cls.prototype, methodName, 0);
+      (0, import_common17.Param)("id")(cls.prototype, methodName, 0);
       bodyDecorator(patchSchema)(cls.prototype, methodName, 1);
-      (0, import_common15.Req)()(cls.prototype, methodName, 2);
+      (0, import_common17.Req)()(cls.prototype, methodName, 2);
     }, "decorators")
   };
 }, "defaultPatch");
@@ -5304,10 +5529,10 @@ var childPatch = /* @__PURE__ */ __name((sub) => (ctx) => {
     return this.repo.updateChild(sub, childId, body, req);
   }, "patchFn");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common15.Param)("id")(cls.prototype, methodName, 0);
-    (0, import_common15.Param)("childId")(cls.prototype, methodName, 1);
-    (0, import_common15.Body)()(cls.prototype, methodName, 2);
-    (0, import_common15.Req)()(cls.prototype, methodName, 3);
+    (0, import_common17.Param)("id")(cls.prototype, methodName, 0);
+    (0, import_common17.Param)("childId")(cls.prototype, methodName, 1);
+    (0, import_common17.Body)()(cls.prototype, methodName, 2);
+    (0, import_common17.Req)()(cls.prototype, methodName, 3);
   }, "decorators");
   return {
     route: `:id/${sub.childRoute}/:childId`,
@@ -5325,7 +5550,7 @@ var registerPatch = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.patchFn);
   const d = desc(cls, methodName);
-  (0, import_common15.Patch)(route)(cls.prototype, methodName, d);
+  (0, import_common17.Patch)(route)(cls.prototype, methodName, d);
   (0, import_swagger7.ApiOperation)({
     summary: `Update a ${name}`
   })(cls.prototype, methodName, d);
@@ -5337,33 +5562,34 @@ var registerPatch = /* @__PURE__ */ __name((ctx, sub) => {
     description: "Not found"
   })(cls.prototype, methodName, d);
   properties.decorators();
+  ctx.secure(methodName, "patch", sub);
 }, "registerPatch");
 
 // src/lib/crud/operations/register-schema-endpoints.ts
-var import_common16 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 var import_swagger8 = require("@nestjs/swagger");
 
 // src/lib/crud/resource/PatchResourceJson.schema.ts
-var import_zod29 = require("zod");
-var FieldVariantPatchSchema = import_zod29.z.object({
-  type: import_zod29.z.string().nullable().optional(),
-  format: import_zod29.z.string().nullable().optional(),
-  resource: import_zod29.z.string().nullable().optional(),
-  position: import_zod29.z.number().nullable().optional(),
-  options: import_zod29.z.record(import_zod29.z.string(), import_zod29.z.unknown().nullable()).optional()
+var import_zod30 = require("zod");
+var FieldVariantPatchSchema = import_zod30.z.object({
+  type: import_zod30.z.string().nullable().optional(),
+  format: import_zod30.z.string().nullable().optional(),
+  resource: import_zod30.z.string().nullable().optional(),
+  position: import_zod30.z.number().nullable().optional(),
+  options: import_zod30.z.record(import_zod30.z.string(), import_zod30.z.unknown().nullable()).optional()
 }).partial();
-var PatchColumnSchema = import_zod29.z.object({
-  label: import_zod29.z.string().optional(),
-  column: import_zod29.z.string().optional(),
-  hiddenInTable: import_zod29.z.boolean().optional(),
-  hiddenInForm: import_zod29.z.boolean().optional(),
-  hiddenInView: import_zod29.z.boolean().optional(),
+var PatchColumnSchema = import_zod30.z.object({
+  label: import_zod30.z.string().optional(),
+  column: import_zod30.z.string().optional(),
+  hiddenInTable: import_zod30.z.boolean().optional(),
+  hiddenInForm: import_zod30.z.boolean().optional(),
+  hiddenInView: import_zod30.z.boolean().optional(),
   fieldInput: FieldVariantPatchSchema.optional(),
   fieldView: FieldVariantPatchSchema.optional(),
   fieldTable: FieldVariantPatchSchema.optional()
 }).partial();
-var PatchResourceJsonSchema = import_zod29.z.object({
-  columns: import_zod29.z.record(import_zod29.z.string(), PatchColumnSchema)
+var PatchResourceJsonSchema = import_zod30.z.object({
+  columns: import_zod30.z.record(import_zod30.z.string(), PatchColumnSchema)
 });
 
 // src/lib/crud/resource/WriteResourceJson.ts
@@ -5431,48 +5657,6 @@ var writeRawResourceJson = /* @__PURE__ */ __name((jsonPath, raw) => {
 
 // src/lib/crud/operations/payload-builders.ts
 var resolveEnvPlaceholders = /* @__PURE__ */ __name((value) => value.replace(/\{env\.([^}]+)\}/g, (match, varName) => process.env[varName] ?? match), "resolveEnvPlaceholders");
-var buildSubResourceOperations = /* @__PURE__ */ __name((ops, baseUri, idField = "id") => {
-  if (!ops) return {};
-  const idPlaceholder = `{${idField}}`;
-  return {
-    ...ops.findAll && {
-      findAll: {
-        uri: baseUri,
-        method: "get"
-      }
-    },
-    ...ops.findOne && {
-      findOne: {
-        uri: `${baseUri}/${idPlaceholder}`,
-        method: "get"
-      }
-    },
-    ...ops.create && {
-      create: {
-        uri: baseUri,
-        method: "post"
-      }
-    },
-    ...ops.update && {
-      update: {
-        uri: `${baseUri}/${idPlaceholder}`,
-        method: "put"
-      }
-    },
-    ...ops.patch && {
-      patch: {
-        uri: `${baseUri}/${idPlaceholder}`,
-        method: "patch"
-      }
-    },
-    ...ops.delete && {
-      delete: {
-        uri: `${baseUri}/${idPlaceholder}`,
-        method: "delete"
-      }
-    }
-  };
-}, "buildSubResourceOperations");
 var RESOURCE_OPS = [
   "findAll",
   "findOne",
@@ -5699,7 +5883,7 @@ var registerDefinitionEndpoint = /* @__PURE__ */ __name((ctx) => {
     return definitionPayload;
   });
   const d = desc(cls, "getDefinition");
-  (0, import_common16.Get)("definition")(cls.prototype, "getDefinition", d);
+  (0, import_common18.Get)("definition")(cls.prototype, "getDefinition", d);
   (0, import_swagger8.ApiOperation)({
     summary: `Get the resource definition for ${name}`
   })(cls.prototype, "getDefinition", d);
@@ -5707,6 +5891,10 @@ var registerDefinitionEndpoint = /* @__PURE__ */ __name((ctx) => {
     status: 200,
     description: `Definition (operations + schemas) for ${name}`
   })(cls.prototype, "getDefinition", d);
+  const sec = ctx.config.security ?? ctx.moduleDefaultSecurity;
+  if (sec) {
+    (0, import_common18.SetMetadata)(CROUTON_SECURITY, sec)(cls.prototype, "getDefinition", d);
+  }
 }, "registerDefinitionEndpoint");
 var registerResourceJsonEndpoint = /* @__PURE__ */ __name((ctx) => {
   const { cls, config, baseUrl } = ctx;
@@ -5721,7 +5909,7 @@ var registerResourceJsonEndpoint = /* @__PURE__ */ __name((ctx) => {
     return resourceJsonPayload;
   });
   const d = desc(cls, "getResourceJson");
-  (0, import_common16.Get)("resource.json")(cls.prototype, "getResourceJson", d);
+  (0, import_common18.Get)("resource.json")(cls.prototype, "getResourceJson", d);
   (0, import_swagger8.ApiOperation)({
     summary: `Get resource descriptor for ${name}`
   })(cls.prototype, "getResourceJson", d);
@@ -5729,19 +5917,23 @@ var registerResourceJsonEndpoint = /* @__PURE__ */ __name((ctx) => {
     status: 200,
     description: `Resource descriptor (operations + JSON Schema) for ${name}`
   })(cls.prototype, "getResourceJson", d);
+  const sec = ctx.config.security ?? ctx.moduleDefaultSecurity;
+  if (sec) {
+    (0, import_common18.SetMetadata)(CROUTON_SECURITY, sec)(cls.prototype, "getResourceJson", d);
+  }
 }, "registerResourceJsonEndpoint");
 var registerResourceColumnsEndpoint = /* @__PURE__ */ __name((ctx) => {
   const { cls, config } = ctx;
   const { route, name } = config;
   def(cls, "getResourceColumns", async function() {
     if (!IS_DEV) {
-      throw new import_common16.ForbiddenException("The resource schema editor is only available when the backend is running in local dev mode.");
+      throw new import_common18.ForbiddenException("The resource schema editor is only available when the backend is running in local dev mode.");
     }
     const fresh = await this.configRegistry.getByRoute(route);
     return buildEditableColumnsPayload(fresh ?? config);
   });
   const d = desc(cls, "getResourceColumns");
-  (0, import_common16.Get)("resource-columns")(cls.prototype, "getResourceColumns", d);
+  (0, import_common18.Get)("resource-columns")(cls.prototype, "getResourceColumns", d);
   (0, import_swagger8.ApiOperation)({
     summary: `Dev-only: get the editable column list for ${name}`
   })(cls.prototype, "getResourceColumns", d);
@@ -5755,30 +5947,30 @@ var registerResourceJsonPatchEndpoint = /* @__PURE__ */ __name((ctx) => {
   const { route, name } = config;
   def(cls, "patchResourceJson", async function(body) {
     if (!IS_DEV) {
-      throw new import_common16.ForbiddenException("Editing resource.json is only available when the backend is running in local dev mode.");
+      throw new import_common18.ForbiddenException("Editing resource.json is only available when the backend is running in local dev mode.");
     }
     await this.configRegistry.getByRoute(route);
     const dir = this.configRegistry.getResourceDir(route);
     if (!dir) {
-      throw new import_common16.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
+      throw new import_common18.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
     }
     const jsonPath = (0, import_node_path9.join)(dir, "resource.json");
     const raw = readRawResourceJson(jsonPath);
     if (!raw) {
-      throw new import_common16.NotFoundException(`resource.json not found at ${jsonPath}`);
+      throw new import_common18.NotFoundException(`resource.json not found at ${jsonPath}`);
     }
     const merged = applyColumnPatch(raw, body);
     const validated = validateResourceJson(merged);
     if (!validated.success) {
-      throw new import_common16.BadRequestException(validated.error.issues);
+      throw new import_common18.BadRequestException(validated.error.issues);
     }
     writeRawResourceJson(jsonPath, merged);
     const fresh = await this.configRegistry.getByRoute(route);
     return buildEditableColumnsPayload(fresh ?? config);
   });
   const d = desc(cls, "patchResourceJson");
-  (0, import_common16.Patch)("resource.json")(cls.prototype, "patchResourceJson", d);
-  (0, import_common16.Body)(new ZodValidationPipe(PatchResourceJsonSchema))(cls.prototype, "patchResourceJson", 0);
+  (0, import_common18.Patch)("resource.json")(cls.prototype, "patchResourceJson", d);
+  (0, import_common18.Body)(new ZodValidationPipe(PatchResourceJsonSchema))(cls.prototype, "patchResourceJson", 0);
   (0, import_swagger8.ApiOperation)({
     summary: `Dev-only: patch column layout in resource.json for ${name}`
   })(cls.prototype, "patchResourceJson", d);
@@ -5792,22 +5984,22 @@ var registerResourceJsonRawGetEndpoint = /* @__PURE__ */ __name((ctx) => {
   const { route, name } = config;
   def(cls, "getResourceJsonRaw", async function() {
     if (!IS_DEV) {
-      throw new import_common16.ForbiddenException("The resource JSON editor is only available when the backend is running in local dev mode.");
+      throw new import_common18.ForbiddenException("The resource JSON editor is only available when the backend is running in local dev mode.");
     }
     await this.configRegistry.getByRoute(route);
     const dir = this.configRegistry.getResourceDir(route);
     if (!dir) {
-      throw new import_common16.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
+      throw new import_common18.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
     }
     const jsonPath = (0, import_node_path9.join)(dir, "resource.json");
     const raw = readRawResourceJson(jsonPath);
     if (!raw) {
-      throw new import_common16.NotFoundException(`resource.json not found at ${jsonPath}`);
+      throw new import_common18.NotFoundException(`resource.json not found at ${jsonPath}`);
     }
     return raw;
   });
   const d = desc(cls, "getResourceJsonRaw");
-  (0, import_common16.Get)("resource-json-raw")(cls.prototype, "getResourceJsonRaw", d);
+  (0, import_common18.Get)("resource-json-raw")(cls.prototype, "getResourceJsonRaw", d);
   (0, import_swagger8.ApiOperation)({
     summary: `Dev-only: get the raw resource.json for ${name}`
   })(cls.prototype, "getResourceJsonRaw", d);
@@ -5821,24 +6013,24 @@ var registerResourceJsonRawPutEndpoint = /* @__PURE__ */ __name((ctx) => {
   const { route, name } = config;
   def(cls, "putResourceJsonRaw", async function(body) {
     if (!IS_DEV) {
-      throw new import_common16.ForbiddenException("Editing resource.json is only available when the backend is running in local dev mode.");
+      throw new import_common18.ForbiddenException("Editing resource.json is only available when the backend is running in local dev mode.");
     }
     await this.configRegistry.getByRoute(route);
     const dir = this.configRegistry.getResourceDir(route);
     if (!dir) {
-      throw new import_common16.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
+      throw new import_common18.NotFoundException(`No resource.json on disk for "${name}" (route "${route}").`);
     }
     const validated = validateResourceJson(body);
     if (!validated.success) {
-      throw new import_common16.BadRequestException(validated.error.issues);
+      throw new import_common18.BadRequestException(validated.error.issues);
     }
     const jsonPath = (0, import_node_path9.join)(dir, "resource.json");
     writeRawResourceJson(jsonPath, body);
     return body;
   });
   const d = desc(cls, "putResourceJsonRaw");
-  (0, import_common16.Put)("resource-json-raw")(cls.prototype, "putResourceJsonRaw", d);
-  (0, import_common16.Body)()(cls.prototype, "putResourceJsonRaw", 0);
+  (0, import_common18.Put)("resource-json-raw")(cls.prototype, "putResourceJsonRaw", d);
+  (0, import_common18.Body)()(cls.prototype, "putResourceJsonRaw", 0);
   (0, import_swagger8.ApiOperation)({
     summary: `Dev-only: replace the full resource.json for ${name}`
   })(cls.prototype, "putResourceJsonRaw", d);
@@ -5849,7 +6041,7 @@ var registerResourceJsonRawPutEndpoint = /* @__PURE__ */ __name((ctx) => {
 }, "registerResourceJsonRawPutEndpoint");
 
 // src/lib/crud/operations/register-schemas.ts
-var import_common17 = require("@nestjs/common");
+var import_common19 = require("@nestjs/common");
 var import_swagger9 = require("@nestjs/swagger");
 var defaultSchemas = /* @__PURE__ */ __name((ctx) => {
   const { config, baseUrl } = ctx;
@@ -5894,7 +6086,7 @@ var registerSchemas = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.schemasFn);
   const d = desc(cls, methodName);
-  (0, import_common17.Get)(route)(cls.prototype, methodName, d);
+  (0, import_common19.Get)(route)(cls.prototype, methodName, d);
   (0, import_swagger9.ApiOperation)({
     summary: `Get view schemas for ${name}`
   })(cls.prototype, methodName, d);
@@ -5903,10 +6095,14 @@ var registerSchemas = /* @__PURE__ */ __name((ctx, sub) => {
     description: `View schemas for ${name}`
   })(cls.prototype, methodName, d);
   properties.decorators();
+  const sec = ctx.config.security ?? ctx.moduleDefaultSecurity;
+  if (sec) {
+    (0, import_common19.SetMetadata)(CROUTON_SECURITY, sec)(cls.prototype, methodName, d);
+  }
 }, "registerSchemas");
 
 // src/lib/crud/operations/register-update.ts
-var import_common18 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 var import_swagger10 = require("@nestjs/swagger");
 var defaultUpdate = /* @__PURE__ */ __name((ctx) => {
   if (!isOperationEnabled(ctx.definition, "update")) return null;
@@ -5920,9 +6116,9 @@ var defaultUpdate = /* @__PURE__ */ __name((ctx) => {
       return this.repo.update(id, body, req);
     }, "updateFn"),
     decorators: /* @__PURE__ */ __name(() => {
-      (0, import_common18.Param)("id")(cls.prototype, methodName, 0);
+      (0, import_common20.Param)("id")(cls.prototype, methodName, 0);
       bodyDecorator(updateSchema)(cls.prototype, methodName, 1);
-      (0, import_common18.Req)()(cls.prototype, methodName, 2);
+      (0, import_common20.Req)()(cls.prototype, methodName, 2);
     }, "decorators")
   };
 }, "defaultUpdate");
@@ -5934,10 +6130,10 @@ var childUpdate = /* @__PURE__ */ __name((sub) => (ctx) => {
     return this.repo.updateChild(sub, childId, body, req);
   }, "updateFn");
   const decorators = /* @__PURE__ */ __name(() => {
-    (0, import_common18.Param)("id")(cls.prototype, methodName, 0);
-    (0, import_common18.Param)("childId")(cls.prototype, methodName, 1);
-    (0, import_common18.Body)()(cls.prototype, methodName, 2);
-    (0, import_common18.Req)()(cls.prototype, methodName, 3);
+    (0, import_common20.Param)("id")(cls.prototype, methodName, 0);
+    (0, import_common20.Param)("childId")(cls.prototype, methodName, 1);
+    (0, import_common20.Body)()(cls.prototype, methodName, 2);
+    (0, import_common20.Req)()(cls.prototype, methodName, 3);
   }, "decorators");
   return {
     route: `:id/${sub.childRoute}/:childId`,
@@ -5955,7 +6151,7 @@ var registerUpdate = /* @__PURE__ */ __name((ctx, sub) => {
   const { cls } = ctx;
   def(cls, methodName, properties.updateFn);
   const d = desc(cls, methodName);
-  (0, import_common18.Put)(route)(cls.prototype, methodName, d);
+  (0, import_common20.Put)(route)(cls.prototype, methodName, d);
   (0, import_swagger10.ApiOperation)({
     summary: `Replace a ${name}`
   })(cls.prototype, methodName, d);
@@ -5967,6 +6163,7 @@ var registerUpdate = /* @__PURE__ */ __name((ctx, sub) => {
     description: "Not found"
   })(cls.prototype, methodName, d);
   properties.decorators();
+  ctx.secure(methodName, "update", sub);
 }, "registerUpdate");
 
 // src/lib/crud/operations/register-endpoints.ts
@@ -5999,7 +6196,7 @@ var registerEndpoint = /* @__PURE__ */ __name((ctx, sub) => {
 }, "registerEndpoint");
 
 // src/lib/crud/crud-controller.factory.ts
-function createCrudController(config, baseUrl) {
+function createCrudController(config, baseUrl, moduleDefaultSecurity, securityEnabled = false) {
   const { route, name, tag, idType = "string" } = config;
   const definition = resolveDefinition(config);
   const listSchema = schemaFor(definition, "findAll");
@@ -6013,9 +6210,9 @@ function createCrudController(config, baseUrl) {
     throw new Error(`Resource "${name}" declares 'upsert' but no upsertOn`);
   }
   const bodyDecorator = /* @__PURE__ */ __name((schema, options) => {
-    if (!schema) return (0, import_common19.Body)();
-    if (isZodSchema(schema)) return (0, import_common19.Body)(new ZodValidationPipe(schema, options));
-    return (0, import_common19.Body)();
+    if (!schema) return (0, import_common21.Body)();
+    if (isZodSchema(schema)) return (0, import_common21.Body)(new ZodValidationPipe(schema, options));
+    return (0, import_common21.Body)();
   }, "bodyDecorator");
   const resolveClient = /* @__PURE__ */ __name((registry, resource) => {
     try {
@@ -6037,6 +6234,12 @@ function createCrudController(config, baseUrl) {
       this.configRegistry = configRegistry;
     }
   };
+  const secure = /* @__PURE__ */ __name((methodName, op, sub) => {
+    const sec = sub ? securityForSub(config, sub, op, moduleDefaultSecurity) : securityFor(config, definition, op, moduleDefaultSecurity);
+    if (sec) {
+      (0, import_common21.SetMetadata)(CROUTON_SECURITY, sec)(CrudControllerBase.prototype, methodName, Object.getOwnPropertyDescriptor(CrudControllerBase.prototype, methodName));
+    }
+  }, "secure");
   const ctx = {
     cls: CrudControllerBase,
     config,
@@ -6052,10 +6255,15 @@ function createCrudController(config, baseUrl) {
       type: idType === "number" ? "number" : "string"
     },
     bodyDecorator,
-    baseUrl
+    baseUrl,
+    moduleDefaultSecurity,
+    secure
   };
   registerEndpoints(ctx);
-  (0, import_common19.Controller)(resourceControllerPath(route, config.parent))(CrudControllerBase);
+  (0, import_common21.Controller)(resourceControllerPath(route, config.parent))(CrudControllerBase);
+  if (securityEnabled) {
+    (0, import_common21.UseGuards)(CroutonSecurityGuard)(CrudControllerBase);
+  }
   (0, import_swagger11.ApiTags)(tag)(CrudControllerBase);
   Object.defineProperty(CrudControllerBase, "name", {
     value: `${name.charAt(0).toUpperCase() + name.slice(1)}Controller`
@@ -6069,7 +6277,7 @@ function createCrudController(config, baseUrl) {
 __name(createCrudController, "createCrudController");
 
 // src/lib/crud/dev-tools/dev-resources.controller.ts
-var import_common20 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 var import_swagger12 = require("@nestjs/swagger");
 
 // ../crouton-codegen/src/naming.ts
@@ -6765,12 +6973,12 @@ var makeSchemaExportName = /* @__PURE__ */ __name((config) => {
 var resolveFromRoot = /* @__PURE__ */ __name((root, p) => (0, import_node_path11.isAbsolute)(p) ? p : (0, import_node_path11.join)(root, p), "resolveFromRoot");
 
 // ../crouton-codegen/src/scaffold.ts
-var import_zod30 = require("zod");
+var import_zod31 = require("zod");
 var import_promises5 = require("fs/promises");
 var import_node_path12 = require("path");
 var ScallfoldDatasourceSchema = DataSourceShape.extend({
   /** Folder name under `dataSourcesDir`. */
-  folder: import_zod30.z.string().default("default")
+  folder: import_zod31.z.string().default("default")
 }).transform(transformDataSource);
 
 // ../crouton-codegen/src/datasource-scaffold.ts
@@ -7087,7 +7295,7 @@ var ResourceLoadReportRegistry = class ResourceLoadReportRegistry2 {
 var resourceLoadReportRegistry = new ResourceLoadReportRegistry();
 
 // src/lib/crud/dev-tools/dev-resources.controller.ts
-function _ts_decorate6(decorators, target, key, desc2) {
+function _ts_decorate8(decorators, target, key, desc2) {
   var c = arguments.length, r = c < 3 ? target : desc2 === null ? desc2 = Object.getOwnPropertyDescriptor(target, key) : desc2, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc2);
@@ -7100,13 +7308,13 @@ function _ts_decorate6(decorators, target, key, desc2) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata8(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata6, "_ts_metadata");
+__name(_ts_metadata8, "_ts_metadata");
 function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -7125,7 +7333,7 @@ var DevResourcesController = class {
   }
   assertDev() {
     if (!IS_DEV) {
-      throw new import_common20.ForbiddenException("The database sync tools are only available when CROUTON_SCHEMA_EDITOR is enabled.");
+      throw new import_common22.ForbiddenException("The database sync tools are only available when CROUTON_SCHEMA_EDITOR is enabled.");
     }
   }
   /** Loads project config + resolves the datasource + Prisma schema path. Throws 404/400 with a clear message on misconfiguration. */
@@ -7134,14 +7342,14 @@ var DevResourcesController = class {
     try {
       loaded = await loadConfig2(process.cwd());
     } catch (e) {
-      throw new import_common20.NotFoundException(e.message ?? "No crouton.json config found.");
+      throw new import_common22.NotFoundException(e.message ?? "No crouton.json config found.");
     }
     const datasources = await loadDatasources(loaded);
     let ds;
     try {
       ds = resolveDatasource(datasources, datasourceName);
     } catch (e) {
-      throw new import_common20.BadRequestException(e.message);
+      throw new import_common22.BadRequestException(e.message);
     }
     const schemaPath = resolveFromRoot(loaded.root, ds.prismaSchema);
     return {
@@ -7156,7 +7364,7 @@ var DevResourcesController = class {
         schemaPath
       });
     } catch (e) {
-      throw new import_common20.BadRequestException(`Failed to read Prisma schema at ${schemaPath}: ${e.message}`);
+      throw new import_common22.BadRequestException(`Failed to read Prisma schema at ${schemaPath}: ${e.message}`);
     }
   }
   buildApplyContext(loaded, ds) {
@@ -7226,7 +7434,7 @@ var DevResourcesController = class {
       zodOutputDir: zodDir
     });
     if (!result.ok) {
-      throw new import_common20.BadRequestException(`prisma db pull failed:
+      throw new import_common22.BadRequestException(`prisma db pull failed:
 ${result.dbPull.output}`);
     }
     return {
@@ -7243,13 +7451,13 @@ ${result.dbPull.output}`);
   async sync(body) {
     this.assertDev();
     if (!body?.model) {
-      throw new import_common20.BadRequestException('"model" is required.');
+      throw new import_common22.BadRequestException('"model" is required.');
     }
     const { loaded, ds, schemaPath } = await this.loadProject(body.datasource);
     const models = await this.introspectModels(schemaPath);
     const model = models.find((m) => m.prismaName === body.model || m.clientAccessor === body.model);
     if (!model) {
-      throw new import_common20.NotFoundException(`Model "${body.model}" not found in ${schemaPath}.`);
+      throw new import_common22.NotFoundException(`Model "${body.model}" not found in ${schemaPath}.`);
     }
     const resolveRelationResource = await makeRelationResolver(loaded);
     const diff2 = await buildResourceDiff(model, {
@@ -7371,14 +7579,14 @@ ${result.dbPull.output}`);
     const resourcesDir = resolveFromRoot(loaded.root, loaded.config.resourcesDir);
     const jsonPath = resolveResourcePath(resourcesDir, name);
     const raw = readRawResourceJson(jsonPath);
-    if (!raw) throw new import_common20.NotFoundException(`Resource "${name}" not found.`);
-    if (jsonPath.endsWith(".ts")) throw new import_common20.ForbiddenException("TypeScript resources cannot be edited.");
+    if (!raw) throw new import_common22.NotFoundException(`Resource "${name}" not found.`);
+    if (jsonPath.endsWith(".ts")) throw new import_common22.ForbiddenException("TypeScript resources cannot be edited.");
     const patched = applyResourceFlagPatch(raw, {
       draft: false
     });
     const result = validateResourceJson(patched);
     if (!result.success) {
-      throw new import_common20.BadRequestException(`Validation failed: ${result.error.message}`);
+      throw new import_common22.BadRequestException(`Validation failed: ${result.error.message}`);
     }
     writeRawResourceJson(jsonPath, patched);
     return {
@@ -7391,8 +7599,8 @@ ${result.dbPull.output}`);
     const resourcesDir = resolveFromRoot(loaded.root, loaded.config.resourcesDir);
     const jsonPath = resolveResourcePath(resourcesDir, name);
     const raw = readRawResourceJson(jsonPath);
-    if (!raw) throw new import_common20.NotFoundException(`Resource "${name}" not found.`);
-    if (jsonPath.endsWith(".ts")) throw new import_common20.ForbiddenException("TypeScript resources cannot be edited.");
+    if (!raw) throw new import_common22.NotFoundException(`Resource "${name}" not found.`);
+    if (jsonPath.endsWith(".ts")) throw new import_common22.ForbiddenException("TypeScript resources cannot be edited.");
     const patched = applyResourceFlagPatch(raw, {
       sidebar: {
         hide: true
@@ -7400,7 +7608,7 @@ ${result.dbPull.output}`);
     });
     const result = validateResourceJson(patched);
     if (!result.success) {
-      throw new import_common20.BadRequestException(`Validation failed: ${result.error.message}`);
+      throw new import_common22.BadRequestException(`Validation failed: ${result.error.message}`);
     }
     writeRawResourceJson(jsonPath, patched);
     return {
@@ -7413,8 +7621,8 @@ ${result.dbPull.output}`);
     const resourcesDir = resolveFromRoot(loaded.root, loaded.config.resourcesDir);
     const jsonPath = resolveResourcePath(resourcesDir, name);
     const raw = readRawResourceJson(jsonPath);
-    if (!raw) throw new import_common20.NotFoundException(`Resource "${name}" not found.`);
-    if (jsonPath.endsWith(".ts")) throw new import_common20.ForbiddenException("TypeScript resources cannot be edited.");
+    if (!raw) throw new import_common22.NotFoundException(`Resource "${name}" not found.`);
+    if (jsonPath.endsWith(".ts")) throw new import_common22.ForbiddenException("TypeScript resources cannot be edited.");
     const sidebarPatch = {
       hide: false
     };
@@ -7427,7 +7635,7 @@ ${result.dbPull.output}`);
     });
     const result = validateResourceJson(patched);
     if (!result.success) {
-      throw new import_common20.BadRequestException(`Validation failed: ${result.error.message}`);
+      throw new import_common22.BadRequestException(`Validation failed: ${result.error.message}`);
     }
     writeRawResourceJson(jsonPath, patched);
     return {
@@ -7440,12 +7648,12 @@ ${result.dbPull.output}`);
     const resourcesDir = resolveFromRoot(loaded.root, loaded.config.resourcesDir);
     const jsonPath = resolveResourcePath(resourcesDir, name);
     const raw = readRawResourceJson(jsonPath);
-    if (!raw) throw new import_common20.NotFoundException(`Resource "${name}" not found.`);
-    if (jsonPath.endsWith(".ts")) throw new import_common20.ForbiddenException("TypeScript resources cannot be edited.");
+    if (!raw) throw new import_common22.NotFoundException(`Resource "${name}" not found.`);
+    if (jsonPath.endsWith(".ts")) throw new import_common22.ForbiddenException("TypeScript resources cannot be edited.");
     const patched = applyResourceFlagPatch(raw, body);
     const result = validateResourceJson(patched);
     if (!result.success) {
-      throw new import_common20.BadRequestException(`Validation failed: ${result.error.message}`);
+      throw new import_common22.BadRequestException(`Validation failed: ${result.error.message}`);
     }
     writeRawResourceJson(jsonPath, patched);
     return {
@@ -7453,8 +7661,8 @@ ${result.dbPull.output}`);
     };
   }
 };
-_ts_decorate6([
-  (0, import_common20.Get)("models"),
+_ts_decorate8([
+  (0, import_common22.Get)("models"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: list DB models from the Prisma schema, flagging which already have a resource.json and whether the running backend can actually use them yet"
   }),
@@ -7462,12 +7670,12 @@ _ts_decorate6([
     status: 200,
     description: "DB models and their resource/client status"
   }),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", []),
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "listModels", null);
-_ts_decorate6([
-  (0, import_common20.Post)("restart"),
+_ts_decorate8([
+  (0, import_common22.Post)("restart"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: exit this process so a dev watcher/process manager (nodemon, `nest start --watch`, pm2, a Docker restart policy, ...) restarts it with a fresh Prisma client. Does nothing useful if this process isn't supervised by one of those."
   }),
@@ -7475,12 +7683,12 @@ _ts_decorate6([
     status: 200,
     description: "Restart scheduled \u2014 the connection will drop shortly after"
   }),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", Object)
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", []),
+  _ts_metadata8("design:returntype", Object)
 ], DevResourcesController.prototype, "restart", null);
-_ts_decorate6([
-  (0, import_common20.Post)("pull"),
+_ts_decorate8([
+  (0, import_common22.Post)("pull"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: run `prisma db pull` + case-format + `prisma generate` for a datasource, refreshing schema.prisma and the generated Prisma client/Zod types from the live database"
   }),
@@ -7488,15 +7696,15 @@ _ts_decorate6([
     status: 200,
     description: "Result of each step, or requiresConfirmation if schema.prisma has uncommitted changes"
   }),
-  _ts_param2(0, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     Object
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "pull", null);
-_ts_decorate6([
-  (0, import_common20.Post)("sync"),
+_ts_decorate8([
+  (0, import_common22.Post)("sync"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: generate or update a single resource.json from its DB model, using recommended defaults (non-interactive)"
   }),
@@ -7504,15 +7712,15 @@ _ts_decorate6([
     status: 200,
     description: "Files written for this resource"
   }),
-  _ts_param2(0, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     Object
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "sync", null);
-_ts_decorate6([
-  (0, import_common20.Post)("plan"),
+_ts_decorate8([
+  (0, import_common22.Post)("plan"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: dry-run introspect + diff across all (or selected) DB models using recommended defaults \u2014 computes what would change, writes nothing"
   }),
@@ -7520,15 +7728,15 @@ _ts_decorate6([
     status: 200,
     description: "Proposed per-resource changes"
   }),
-  _ts_param2(0, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     Object
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "plan", null);
-_ts_decorate6([
-  (0, import_common20.Post)("apply"),
+_ts_decorate8([
+  (0, import_common22.Post)("apply"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: commit resource.json/schema.ts changes to disk for the given resources (or all, if omitted), using recommended defaults"
   }),
@@ -7536,15 +7744,15 @@ _ts_decorate6([
     status: 200,
     description: "Per-resource commit results"
   }),
-  _ts_param2(0, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     Object
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "apply", null);
-_ts_decorate6([
-  (0, import_common20.Get)("visibility"),
+_ts_decorate8([
+  (0, import_common22.Get)("visibility"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: list all resources with their menu visibility state (in-menu, hidden, draft, error)"
   }),
@@ -7552,12 +7760,12 @@ _ts_decorate6([
     status: 200,
     description: "Resource visibility list"
   }),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", []),
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "visibility", null);
-_ts_decorate6([
-  (0, import_common20.Post)(":name/publish"),
+_ts_decorate8([
+  (0, import_common22.Post)(":name/publish"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: publish a draft resource (removes `draft: true` from resource.json)"
   }),
@@ -7565,15 +7773,15 @@ _ts_decorate6([
     status: 200,
     description: "Resource published"
   }),
-  _ts_param2(0, (0, import_common20.Param)("name")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Param)("name")),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "publish", null);
-_ts_decorate6([
-  (0, import_common20.Post)(":name/remove-from-menu"),
+_ts_decorate8([
+  (0, import_common22.Post)(":name/remove-from-menu"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: hide a resource from the sidebar menu (sets `sidebar.hide: true` in resource.json)"
   }),
@@ -7581,15 +7789,15 @@ _ts_decorate6([
     status: 200,
     description: "Resource removed from menu"
   }),
-  _ts_param2(0, (0, import_common20.Param)("name")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Param)("name")),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "removeFromMenu", null);
-_ts_decorate6([
-  (0, import_common20.Post)(":name/add-to-menu"),
+_ts_decorate8([
+  (0, import_common22.Post)(":name/add-to-menu"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: publish + un-hide a resource and optionally set sidebar group/position/label"
   }),
@@ -7597,17 +7805,17 @@ _ts_decorate6([
     status: 200,
     description: "Resource added to menu"
   }),
-  _ts_param2(0, (0, import_common20.Param)("name")),
-  _ts_param2(1, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Param)("name")),
+  _ts_param2(1, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "addToMenu", null);
-_ts_decorate6([
-  (0, import_common20.Patch)(":name/flags"),
+_ts_decorate8([
+  (0, import_common22.Patch)(":name/flags"),
   (0, import_swagger12.ApiOperation)({
     summary: "Dev-only: set arbitrary resource flags (draft, sidebar.hide, group, position, label)"
   }),
@@ -7615,32 +7823,32 @@ _ts_decorate6([
     status: 200,
     description: "Flags updated"
   }),
-  _ts_param2(0, (0, import_common20.Param)("name")),
-  _ts_param2(1, (0, import_common20.Body)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param2(0, (0, import_common22.Param)("name")),
+  _ts_param2(1, (0, import_common22.Body)()),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String,
     typeof ResourceFlagPatch === "undefined" ? Object : ResourceFlagPatch
   ]),
-  _ts_metadata6("design:returntype", Promise)
+  _ts_metadata8("design:returntype", Promise)
 ], DevResourcesController.prototype, "updateFlags", null);
-DevResourcesController = _ts_decorate6([
-  (0, import_common20.Controller)("_app/resources"),
+DevResourcesController = _ts_decorate8([
+  (0, import_common22.Controller)("_app/resources"),
   (0, import_swagger12.ApiTags)("Dev tools"),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     typeof DataSourceRegistry === "undefined" ? Object : DataSourceRegistry,
     typeof ResourceConfigRegistry === "undefined" ? Object : ResourceConfigRegistry
   ])
 ], DevResourcesController);
 
 // src/lib/crud/enum-registry/enum-registry.types.ts
-var import_zod31 = require("zod");
-var EnumEntrySchema = import_zod31.z.object({
-  value: import_zod31.z.unknown(),
-  label: import_zod31.z.string()
+var import_zod32 = require("zod");
+var EnumEntrySchema = import_zod32.z.object({
+  value: import_zod32.z.unknown(),
+  label: import_zod32.z.string()
 });
-var EnumRegistrySchema = import_zod31.z.record(import_zod31.z.string(), import_zod31.z.array(EnumEntrySchema)).default({});
+var EnumRegistrySchema = import_zod32.z.record(import_zod32.z.string(), import_zod32.z.array(EnumEntrySchema)).default({});
 
 // src/lib/crud/enum-registry/enum-registry.loader.ts
 var import_node_fs8 = require("fs");
@@ -7720,11 +7928,40 @@ var upsertOp = /* @__PURE__ */ __name((entry, schema) => {
   }
   return void 0;
 }, "upsertOp");
+var buildResourceDefinitions = /* @__PURE__ */ __name((schema, operations, enrichedColumns) => {
+  const picked = pickByColumns(schema, enrichedColumns);
+  const createSchema = pickByColumns(schema, enrichedColumns, (c) => !c.idField && c.createable !== false);
+  const updateSchema = pickByColumns(schema, enrichedColumns, (c) => !c.idField && c.updateable !== false);
+  const definition = {
+    ...opWithSchema(operations.findAll, picked) && {
+      findAll: opWithSchema(operations.findAll, picked)
+    },
+    ...opWithSchema(operations.findOne, picked) && {
+      findOne: opWithSchema(operations.findOne, picked)
+    },
+    ...opWithSchema(operations.create, createSchema) && {
+      create: opWithSchema(operations.create, createSchema)
+    },
+    ...opWithSchema(operations.update, updateSchema) && {
+      update: opWithSchema(operations.update, updateSchema)
+    },
+    ...upsertOp(operations.upsert, createSchema) && {
+      upsert: upsertOp(operations.upsert, createSchema)
+    },
+    ...operations.patch !== false && {
+      patch: true
+    },
+    ...operations.delete !== false && {
+      delete: true
+    }
+  };
+  return definition;
+}, "buildResourceDefinitions");
 
 // src/lib/crud/adapter/relation-type.ts
-var import_zod32 = require("zod");
+var import_zod33 = require("zod");
 var unwrapZodType = /* @__PURE__ */ __name((type) => {
-  if (type instanceof import_zod32.ZodOptional || type instanceof import_zod32.ZodNullable) {
+  if (type instanceof import_zod33.ZodOptional || type instanceof import_zod33.ZodNullable) {
     return unwrapZodType(type.unwrap());
   }
   return type;
@@ -7734,7 +7971,7 @@ var deriveRelationType = /* @__PURE__ */ __name((schema, columnId) => {
   const field = schema.shape[columnId];
   if (!field) return void 0;
   const inner = unwrapZodType(field);
-  return inner instanceof import_zod32.ZodArray ? "oneToMany" : "manyToOne";
+  return inner instanceof import_zod33.ZodArray ? "oneToMany" : "manyToOne";
 }, "deriveRelationType");
 var deriveRelationTypeFromColumns = /* @__PURE__ */ __name((col, cols) => {
   const base = col.column ?? col.id;
@@ -7977,9 +8214,6 @@ var fromJson = /* @__PURE__ */ __name((json, schema, hooks, dirPath, baseUrl, ac
   const subResources = isCustom ? [] : buildSubResources(columns, json.route, json.model ?? "", dirPath, enums, baseUrl);
   const enrichedColumns = resolveColumnFieldVariants(enrichResourceRefColumns(enrichActionColumns(columns, json.route, subResources, baseUrl), dirPath, baseUrl) ?? columns);
   const calculatedColumns = json.calculatedColumns ?? [];
-  const picked = pickByColumns(schema, enrichedColumns);
-  const createSchema = pickByColumns(schema, enrichedColumns, (c) => !c.idField && c.createable !== false);
-  const updateSchema = pickByColumns(schema, enrichedColumns, (c) => !c.idField && c.updateable !== false);
   let views = isCustom ? buildViewsFromColumnTypes(enrichedColumns) : buildViews(schema, enrichedColumns);
   if (views && calculatedColumns.length) {
     views = {
@@ -7995,29 +8229,7 @@ var fromJson = /* @__PURE__ */ __name((json, schema, hooks, dirPath, baseUrl, ac
   }
   const lookup = buildLookup(enrichedColumns);
   const enrichedInclude = enrichIncludeWithSort(json.include, enrichedColumns);
-  const definition = {
-    ...opWithSchema(json.operations.findAll, picked) && {
-      findAll: opWithSchema(json.operations.findAll, picked)
-    },
-    ...opWithSchema(json.operations.findOne, picked) && {
-      findOne: opWithSchema(json.operations.findOne, picked)
-    },
-    ...opWithSchema(json.operations.create, createSchema) && {
-      create: opWithSchema(json.operations.create, createSchema)
-    },
-    ...opWithSchema(json.operations.update, updateSchema) && {
-      update: opWithSchema(json.operations.update, updateSchema)
-    },
-    ...upsertOp(json.operations.upsert, createSchema) && {
-      upsert: upsertOp(json.operations.upsert, createSchema)
-    },
-    ...json.operations.patch !== false && {
-      patch: true
-    },
-    ...json.operations.delete !== false && {
-      delete: true
-    }
-  };
+  const definition = buildResourceDefinitions(schema, json.operations, enrichedColumns);
   return {
     ...json,
     name: json.name,
@@ -8541,9 +8753,9 @@ var buildStatus = /* @__PURE__ */ __name(async (registry, loadedConfigs, enumReg
 }, "buildStatus");
 
 // src/lib/crud/status/status.controller.ts
-var import_common21 = require("@nestjs/common");
+var import_common23 = require("@nestjs/common");
 var import_swagger13 = require("@nestjs/swagger");
-function _ts_decorate7(decorators, target, key, desc2) {
+function _ts_decorate9(decorators, target, key, desc2) {
   var c = arguments.length, r = c < 3 ? target : desc2 === null ? desc2 = Object.getOwnPropertyDescriptor(target, key) : desc2, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc2);
@@ -8556,13 +8768,13 @@ function _ts_decorate7(decorators, target, key, desc2) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata7(metadataKey, metadataValue) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata9(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata7, "_ts_metadata");
+__name(_ts_metadata9, "_ts_metadata");
 var createStatusController = /* @__PURE__ */ __name((enumRegistry, translationRegistry) => {
   let StatusController = class StatusController {
     static {
@@ -8579,8 +8791,8 @@ var createStatusController = /* @__PURE__ */ __name((enumRegistry, translationRe
       return buildStatus(this.dataSourceRegistry, configs, enumRegistry, translationRegistry);
     }
   };
-  _ts_decorate7([
-    (0, import_common21.Get)("status.json"),
+  _ts_decorate9([
+    (0, import_common23.Get)("status.json"),
     (0, import_swagger13.ApiOperation)({
       summary: "Crouton system status (db, resources, version)"
     }),
@@ -8588,15 +8800,15 @@ var createStatusController = /* @__PURE__ */ __name((enumRegistry, translationRe
       status: 200,
       description: "System status"
     }),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", []),
-    _ts_metadata7("design:returntype", Promise)
+    _ts_metadata9("design:type", Function),
+    _ts_metadata9("design:paramtypes", []),
+    _ts_metadata9("design:returntype", Promise)
   ], StatusController.prototype, "getStatus", null);
-  StatusController = _ts_decorate7([
-    (0, import_common21.Controller)("crouton"),
+  StatusController = _ts_decorate9([
+    (0, import_common23.Controller)("crouton"),
     (0, import_swagger13.ApiTags)("Status"),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", [
+    _ts_metadata9("design:type", Function),
+    _ts_metadata9("design:paramtypes", [
       typeof DataSourceRegistry === "undefined" ? Object : DataSourceRegistry,
       typeof ResourceConfigRegistry === "undefined" ? Object : ResourceConfigRegistry
     ])
@@ -8611,7 +8823,7 @@ var createStatusController = /* @__PURE__ */ __name((enumRegistry, translationRe
 // src/lib/crouton-api.module.ts
 var import_node_path20 = require("path");
 var import_node_url2 = require("url");
-function _ts_decorate8(decorators, target, key, desc2) {
+function _ts_decorate10(decorators, target, key, desc2) {
   var c = arguments.length, r = c < 3 ? target : desc2 === null ? desc2 = Object.getOwnPropertyDescriptor(target, key) : desc2, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc2);
@@ -8624,7 +8836,7 @@ function _ts_decorate8(decorators, target, key, desc2) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
+__name(_ts_decorate10, "_ts_decorate");
 var CroutonApiModule = class _CroutonApiModule {
   static {
     __name(this, "CroutonApiModule");
@@ -8636,8 +8848,11 @@ var CroutonApiModule = class _CroutonApiModule {
       };
     }
   }
-  static forResources(configs, dataSources, loader, { baseUrl }, config) {
+  static forResources(configs, dataSources, loader, appConfig, config) {
+    const { baseUrl, security } = appConfig;
     const dataSourceRegistry = new DataSourceRegistry(dataSources);
+    const guardRegistry = new SecurityGuardRegistry(security?.guards ?? {});
+    const moduleDefaultSecurity = security?.default;
     const startDir = typeof __dirname !== "undefined" ? __dirname : (0, import_node_path20.dirname)((0, import_node_url2.fileURLToPath)(importMetaUrl));
     const enumRegistry = loadEnumRegistry(startDir, config.enumsFile);
     const validConfigs = [];
@@ -8690,12 +8905,12 @@ var CroutonApiModule = class _CroutonApiModule {
     const configRegistry = new ResourceConfigRegistry(loader, validConfigs);
     let translationRegistry;
     if (config.i18n) {
-      const translationsDir = (0, import_node_path20.join)(process.cwd(), config.i18n.translationsDir);
+      const translationsDir = (0, import_node_path20.join)(config.configDir, config.i18n.translationsDir);
       translationRegistry = new TranslationRegistry2(translationsDir, config.i18n);
       configRegistry.setTranslationRegistry(translationRegistry);
     }
     const controllers = [
-      ...validConfigs.map((c) => createCrudController(c, baseUrl)),
+      ...validConfigs.map((c) => createCrudController(c, baseUrl, moduleDefaultSecurity, !!security)),
       createAppLayoutController(configs, config.sidebarGroups, config.title, config.autoSave ?? true, translationRegistry, config.i18n),
       // Only registered (and thus only visible in Swagger/routing) when the
       // visual resource builder is enabled — see dev-resources.controller.ts.
@@ -8709,7 +8924,7 @@ var CroutonApiModule = class _CroutonApiModule {
       controllers,
       providers: [
         {
-          provide: import_core.APP_FILTER,
+          provide: import_core2.APP_FILTER,
           useClass: CroutonValidationExceptionFilter
         },
         {
@@ -8720,35 +8935,43 @@ var CroutonApiModule = class _CroutonApiModule {
           provide: ResourceConfigRegistry,
           useValue: configRegistry
         },
+        // Security providers only registered when security is configured;
+        // without guards the dispatching guard is never applied (see factory).
+        ...security ? [
+          {
+            provide: SecurityGuardRegistry,
+            useValue: guardRegistry
+          },
+          CroutonSecurityGuard,
+          ...guardRegistry.classes()
+        ] : [],
         ...translationRegistry ? [
           {
             provide: TranslationRegistry2,
             useValue: translationRegistry
           },
           {
-            provide: import_core.APP_INTERCEPTOR,
+            provide: import_core2.APP_INTERCEPTOR,
             useFactory: /* @__PURE__ */ __name(() => new LanguageInterceptor(translationRegistry), "useFactory")
           }
         ] : []
       ]
     };
   }
-  static async forResourceDir(dirPath, dataSourcesPath, { baseUrl }) {
+  static async forResourceDir(dirPath, dataSourcesPath, appConfig) {
     const config = await loadConfig();
-    const loader = new FileSystemResourceConfigLoader(dirPath, baseUrl, config.enumsFile);
-    const configs = await loadResourceConfigsFromDir(dirPath, baseUrl, config.enumsFile);
+    const loader = new FileSystemResourceConfigLoader(dirPath, appConfig.baseUrl, config.enumsFile);
+    const configs = await loadResourceConfigsFromDir(dirPath, appConfig.baseUrl, config.enumsFile);
     const dataSources = await loadDataSourcesFromDir(dataSourcesPath);
-    return _CroutonApiModule.forResources(configs, dataSources, loader, {
-      baseUrl
-    }, config);
+    return _CroutonApiModule.forResources(configs, dataSources, loader, appConfig, config);
   }
   static async forLoader(loader, configs, dataSources, appConfig) {
     const config = await loadConfig();
     return _CroutonApiModule.forResources(configs, dataSources, loader, appConfig, config);
   }
 };
-CroutonApiModule = _ts_decorate8([
-  (0, import_common22.Module)({
+CroutonApiModule = _ts_decorate10([
+  (0, import_common24.Module)({
     controllers: [],
     providers: [],
     exports: []
@@ -8756,13 +8979,16 @@ CroutonApiModule = _ts_decorate8([
 ], CroutonApiModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CROUTON_SECURITY,
   CroutonApiModule,
+  CroutonSecurityGuard,
   DataSourceRegistry,
   FileSystemResourceConfigLoader,
   ReadOpSchema,
   ResourceConfigLoader,
   ResourceConfigRegistry,
   ResourceHooksSchema,
+  SecurityGuardRegistry,
   WriteOpSchema,
   buildFilterWhere,
   buildViews,
@@ -8780,6 +9006,8 @@ CroutonApiModule = _ts_decorate8([
   prepareWrite,
   resolveDefinition,
   schemaFor,
+  securityFor,
+  securityForSub,
   upsertOnFor
 });
 //# sourceMappingURL=index.cjs.map