@opensaas/stack-core 0.27.1 → 0.29.0

package/dist/internal.d.ts

@@ -4,5 +4,5 @@ export type { Fragment, FieldSelection } from './query/index.js';
 export { hashPassword, comparePassword, isHashedPassword, HashedPassword, } from './utils/password.js';
 export { pascalToCamel, pascalToKebab, kebabToPascal, kebabToCamel } from './lib/case-utils.js';
 export { validateWithZod, generateZodSchema } from './validation/schema.js';
-export type { DatabaseConfig, SessionConfig, ThemeConfig, ThemePreset, ThemeColors, FileMetadata, ImageMetadata, ImageTransformationResult, } from './config/index.js';
+export type { DatabaseConfig, SessionConfig, ThemeConfig, ThemePreset, ThemeColors, ThemeFonts, ThemeShadows, FileMetadata, ImageMetadata, ImageTransformationResult, } from './config/index.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAG1B,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGhE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAG/F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG3E,YAAY,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA;AAG1B,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGhE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAG/F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG3E,YAAY,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,mBAAmB,CAAA"}

package/dist/query/relationship-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-options.d.ts","sourceRoot":"","sources":["../../src/query/relationship-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,EACtB,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAkC/B"}
+{"version":3,"file":"relationship-options.d.ts","sourceRoot":"","sources":["../../src/query/relationship-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAI9E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,cAAc,EACtB,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA0C/B"}

package/dist/query/relationship-options.js

@@ -23,9 +23,15 @@ export async function getRelationshipOptions(context, config, relatedListKey, ar
     const { search, take = DEFAULT_TAKE, selectedIds = [] } = args;
     const labelFieldConfig = relatedListConfig.fields[labelField];
     const where = search && labelFieldConfig?.type === 'text' ? { [labelField]: { contains: search } } : undefined;
+    // Virtual/computed label fields (resolved at read time via `resolveOutput`)
+    // have no backing database column, so passing them into `orderBy` fails
+    // Prisma validation and 500s the request. Fall back to ordering by `id` —
+    // always a real, orderable column — whenever the label field is virtual.
+    const isVirtualLabel = labelFieldConfig?.type === 'virtual' || labelFieldConfig?.virtual === true;
+    const orderBy = isVirtualLabel ? { id: 'asc' } : { [labelField]: 'asc' };
     const primary = await runQuery(context, relatedListKey, fragment, {
         where,
-        orderBy: { [labelField]: 'asc' },
+        orderBy,
         take,
     });
     const seenIds = new Set(primary.map((item) => item.id));

package/dist/query/relationship-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-options.js","sourceRoot":"","sources":["../../src/query/relationship-options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAA2B,MAAM,YAAY,CAAA;AAE9E,MAAM,YAAY,GAAG,EAAE,CAAA;AAgBvB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,MAAsB,EACtB,cAAsB,EACtB,IAAI,GAA4B,EAAE;IAElC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IACtD,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAEjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,cAAc,EAA2B,CAAC;QACzD,EAAE,EAAE,IAAI;QACR,CAAC,UAAU,CAAC,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,YAAY,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,IAAI,CAAA;IAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAkC,CAAA;IAC9F,MAAM,KAAK,GACT,MAAM,IAAI,gBAAgB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAElG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE;QAChE,KAAK;QACL,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;QAChC,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM;QACxC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE;SAC1C,CAAC;QACJ,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAG,IAAuB,CAAC,EAAE;QAC/B,KAAK,EAAE,YAAY,CAAC,iBAAiB,EAAE,IAA+B,CAAC;KACxE,CAAC,CAAC,CAAA;AACL,CAAC"}
+{"version":3,"file":"relationship-options.js","sourceRoot":"","sources":["../../src/query/relationship-options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAA2B,MAAM,YAAY,CAAA;AAE9E,MAAM,YAAY,GAAG,EAAE,CAAA;AAgBvB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,MAAsB,EACtB,cAAsB,EACtB,IAAI,GAA4B,EAAE;IAElC,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IACtD,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAEjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,cAAc,EAA2B,CAAC;QACzD,EAAE,EAAE,IAAI;QACR,CAAC,UAAU,CAAC,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,YAAY,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,IAAI,CAAA;IAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CACV,CAAA;IAClD,MAAM,KAAK,GACT,MAAM,IAAI,gBAAgB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAElG,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,cAAc,GAAG,gBAAgB,EAAE,IAAI,KAAK,SAAS,IAAI,gBAAgB,EAAE,OAAO,KAAK,IAAI,CAAA;IACjG,MAAM,OAAO,GAA0B,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAA;IAE/F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE;QAChE,KAAK;QACL,OAAO;QACP,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM;QACxC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE;SAC1C,CAAC;QACJ,CAAC,CAAC,EAAE,CAAA;IAEN,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAG,IAAuB,CAAC,EAAE;QAC/B,KAAK,EAAE,YAAY,CAAC,iBAAiB,EAAE,IAA+B,CAAC;KACxE,CAAC,CAAC,CAAA;AACL,CAAC"}

package/dist/query/relationship-options.test.js

@@ -31,6 +31,13 @@ function makeConfig() {
                 ui: { labelField: 'rank' },
                 access: { operation: { query: () => true } },
             },
+            VirtualLabel: {
+                fields: {
+                    displayName: { type: 'virtual', virtual: true },
+                },
+                ui: { labelField: 'displayName' },
+                access: { operation: { query: () => true } },
+            },
         },
     };
 }
@@ -75,6 +82,28 @@ describe('getRelationshipOptions', () => {
         expect(call.where).toBeUndefined();
         expect(call.orderBy).toEqual({ rank: 'asc' });
     });
+    it('falls back to ordering by id when the label field is virtual (no backing column)', async () => {
+        const rows = [{ id: 'v1', displayName: 'Computed One' }];
+        const delegate = makeDelegate(rows);
+        const context = makeContext({ virtualLabel: delegate });
+        const config = makeConfig();
+        const result = await getRelationshipOptions(context, config, 'VirtualLabel', { search: 'One' });
+        const call = delegate.findMany.mock.calls[0][0];
+        // Virtual label fields have no backing column, so ordering by them would
+        // 500 in Prisma — order by id instead, and skip the text `contains` filter.
+        expect(call.orderBy).toEqual({ id: 'asc' });
+        expect(call.where).toBeUndefined();
+        expect(result).toEqual([{ id: 'v1', label: 'Computed One' }]);
+    });
+    it('treats a field flagged virtual via type alone as non-orderable (orders by id)', async () => {
+        const config = makeConfig();
+        config.lists.VirtualLabel.fields.displayName.virtual = undefined;
+        const delegate = makeDelegate([{ id: 'v1', displayName: 'Computed One' }]);
+        const context = makeContext({ virtualLabel: delegate });
+        await getRelationshipOptions(context, config, 'VirtualLabel', { search: 'One' });
+        const call = delegate.findMany.mock.calls[0][0];
+        expect(call.orderBy).toEqual({ id: 'asc' });
+    });
     it('unions currently-selected ids even when beyond take / not matching search', async () => {
         // The bounded/search-scoped query only returns a1 (mimicking take:1 + search).
         const primaryDelegate = makeDelegate([authors[0]]);

package/dist/query/relationship-options.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-options.test.js","sourceRoot":"","sources":["../../src/query/relationship-options.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAIlE,SAAS,YAAY,CAAC,IAAoC;IACxD,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC;QAChD,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAClB,SAA0D;IAE1D,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;IAClC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;IACjC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;CACnC,CAAA;AAED,SAAS,UAAU;IACjB,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE;QACjD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN,MAAM,EAAE;oBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBACvB;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC1B;gBACD,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;gBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C;SACF;KAC2B,CAAA;AAChC,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAE1E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;YACnC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE;YAClC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;SACpC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAEpE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAE1E,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACzB,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE9E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,+EAA+E;QAC/E,MAAM,eAAe,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,4EAA4E;QAC5E,8BAA8B;QAC9B,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACrE,IAAI,EAAE,CAAC;YACP,WAAW,EAAE,CAAC,IAAI,CAAC;SACpB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;YACnC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;SACpC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QACzF,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEhF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACrE,WAAW,EAAE,CAAC,IAAI,CAAC;SACpB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QAE3E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"relationship-options.test.js","sourceRoot":"","sources":["../../src/query/relationship-options.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAIlE,SAAS,YAAY,CAAC,IAAoC;IACxD,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC;QAChD,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAClB,SAA0D;IAE1D,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;IAClC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;IACjC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE;CACnC,CAAA;AAED,SAAS,UAAU;IACjB,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE;QACjD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN,MAAM,EAAE;oBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBACvB;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBAC1B;gBACD,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;gBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C;YACD,YAAY,EAAE;gBACZ,MAAM,EAAE;oBACN,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;iBAChD;gBACD,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;gBACjC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C;SACF;KAC2B,CAAA;AAChC,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAE1E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;YACnC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE;YAClC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;SACpC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAEpE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAE1E,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YACpC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACzB,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE9E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;QACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAE/F,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,UAAU,EAAE,CAG1B;QAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,WAAqC,CAAC,OAAO,GAAG,SAAS,CAAA;QAC5F,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAA;QAEvD,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAEhF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,+EAA+E;QAC/E,MAAM,eAAe,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,4EAA4E;QAC5E,8BAA8B;QAC9B,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzE,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACrE,IAAI,EAAE,CAAC;YACP,WAAW,EAAE,CAAC,IAAI,CAAC;SACpB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;YACnC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;SACpC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAA;QACzF,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEhF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACrE,WAAW,EAAE,CAAC,IAAI,CAAC;SACpB,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QAE3E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.27.1",
+  "version": "0.29.0",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "bcryptjs": "^3.0.3",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@prisma/client": "^7.8.0",

package/src/config/index.ts

@@ -153,6 +153,8 @@ export type {
   ThemeConfig,
   ThemePreset,
   ThemeColors,
+  ThemeFonts,
+  ThemeShadows,
   McpConfig,
   McpToolsConfig,
   McpAuthConfig,

package/src/config/plugin-engine.ts

@@ -4,7 +4,6 @@ import type {
   PluginContext,
   ListConfig,
   Hooks,
-  OperationAccess,
   McpCustomTool,
   BaseFieldConfig,
 } from './types.js'
@@ -125,29 +124,6 @@ function mergeHooks(existing: Hooks | undefined, extension: Hooks | undefined):
   return Object.keys(merged).length > 0 ? (merged as Hooks) : undefined
 }
 
-/**
- * Merge access control from extension into existing access
- */
-function mergeAccess(
-  existing: { operation?: OperationAccess } | undefined,
-  extension: { operation?: OperationAccess } | undefined,
-): { operation?: OperationAccess } | undefined {
-  if (!extension) return existing
-  if (!existing) return extension
-
-  const merged: { operation?: OperationAccess } = {}
-
-  // Merge operation access (use extension if provided, otherwise keep existing)
-  if (existing.operation || extension.operation) {
-    merged.operation = {
-      ...existing.operation,
-      ...extension.operation,
-    }
-  }
-
-  return merged
-}
-
 /**
  * Execute plugins and transform config
  * Returns modified config with plugin data attached
@@ -197,6 +173,19 @@ export async function executePlugins(config: OpenSaasConfig): Promise<OpenSaasCo
           )
         }
 
+        // Operation-level access belongs to whoever owns the list (the
+        // application, or an earlier plugin that created it via addList).
+        // An extension of a pre-existing list must never define or override
+        // that access — see ADR-0013. Fields/hooks/relationships/mcp may
+        // still be merged in below.
+        if (extension.access?.operation) {
+          throw new Error(
+            `Plugin "${plugin.name}" tried to set operation-level access while extending list "${name}", ` +
+              `but access control belongs to the application (or whichever party created the list), never a ` +
+              `plugin extending it. Remove "access" from this extension — see ADR-0013.`,
+          )
+        }
+
         // Deep merge fields
         const mergedFields = {
           ...existing.fields,
@@ -206,9 +195,6 @@ export async function executePlugins(config: OpenSaasConfig): Promise<OpenSaasCo
         // Merge hooks
         const mergedHooks = mergeHooks(existing.hooks, extension.hooks)
 
-        // Merge access control
-        const mergedAccess = mergeAccess(existing.access, extension.access)
-
         // Merge MCP config
         const mergedMcp = extension.mcp
           ? {
@@ -221,7 +207,6 @@ export async function executePlugins(config: OpenSaasConfig): Promise<OpenSaasCo
           ...existing,
           fields: mergedFields,
           hooks: mergedHooks,
-          access: mergedAccess,
           mcp: mergedMcp,
         }
       },

package/src/config/types.ts

@@ -593,6 +593,21 @@ export type BaseFieldConfig<TTypeInfo extends TypeInfo> = {
      * e.g., "color" to use a globally registered ColorPickerField
      */
     fieldType?: string
+    /**
+     * Help / description text rendered beneath the field control in the admin UI.
+     *
+     * `FieldRenderer` surfaces this to the rendered field component as its
+     * `helpText` prop, so it appears via the shared field-shell `FieldHelp`
+     * rhythm (data-slot="field-help") for admin-rendered fields.
+     *
+     * @example
+     * ```typescript
+     * fields: {
+     *   slug: text({ ui: { description: 'URL-friendly identifier, lowercase only.' } })
+     * }
+     * ```
+     */
+    description?: string
     /**
      * Transform field value before sending to client (browser)
      * Useful for sensitive fields (e.g., passwords) or complex data structures
@@ -2029,8 +2044,13 @@ export type SessionConfig = {
 export type ThemePreset = 'modern' | 'classic' | 'neon'
 
 /**
- * Custom theme colors (HSL values without hsl() wrapper)
- * Format: "220 20% 97%" (hue saturation lightness)
+ * Custom theme colors.
+ *
+ * Each value is passed through verbatim to the corresponding CSS custom
+ * property, so any valid CSS color string works: `oklch(…)`, `#hex`, `rgb(…)`,
+ * or a wrapped `hsl(…)`. Bare HSL triplets (`"220 20% 97%"`) are a clean break —
+ * they are no longer accepted and trigger a dev-mode warning. See
+ * `specs/THEMING.md` and ADR-0015.
  */
 export type ThemeColors = {
   background?: string
@@ -2049,6 +2069,10 @@ export type ThemeColors = {
   accentForeground?: string
   destructive?: string
   destructiveForeground?: string
+  success?: string
+  successForeground?: string
+  warning?: string
+  warningForeground?: string
   border?: string
   input?: string
   ring?: string
@@ -2057,27 +2081,59 @@ export type ThemeColors = {
 }
 
 /**
- * Theme configuration
+ * Font family tokens. Each value is a CSS `font-family` string, designed to
+ * compose with `next/font`: set the value to the font's CSS variable, e.g.
+ * `sans: 'var(--font-inter), system-ui, sans-serif'`. `heading` defaults to the
+ * `sans` value when omitted.
+ */
+export type ThemeFonts = {
+  sans?: string
+  mono?: string
+  heading?: string
+}
+
+/**
+ * Elevation shadow tokens. Each value is a CSS `box-shadow` string. Set them to
+ * `'none'` for a fully flat theme without forking components.
+ */
+export type ThemeShadows = {
+  sm?: string
+  md?: string
+  lg?: string
+}
+
+/**
+ * Theme configuration. Compiles to token overrides written onto the same CSS
+ * custom properties the UI package stylesheet declares — the config layer and
+ * the stylesheet write to one token set so they can never drift (ADR-0015).
  */
 export type ThemeConfig = {
   /**
-   * Preset theme to use
+   * Preset theme to start from. Individual tokens can be overridden on top.
    * @default "modern"
    */
   preset?: ThemePreset
   /**
-   * Custom color overrides for light mode
+   * Custom color overrides for light mode.
    */
   colors?: ThemeColors
   /**
-   * Custom color overrides for dark mode
+   * Custom color overrides for dark mode.
    */
   darkColors?: ThemeColors
   /**
-   * Border radius in rem
-   * @default 0.75
+   * Font family overrides (`--font-sans`, `--font-mono`, `--font-heading`).
+   */
+  fonts?: ThemeFonts
+  /**
+   * Base border radius in rem. Derived sm/md/lg radii are computed from it.
+   * @default 0.625
    */
   radius?: number
+  /**
+   * Elevation shadow overrides (`--shadow-sm`, `--shadow-md`, `--shadow-lg`).
+   */
+  shadows?: ThemeShadows
 }
 
 /**
@@ -2437,8 +2493,21 @@ export type Plugin = {
    * Optional: Provide runtime services
    * Called when creating context to provide plugin-specific services
    * Return value is stored in context.plugins[pluginName]
-   */
-  runtime?: (context: import('../access/types.js').AccessContext) => unknown
+   *
+   * `sudo` returns an access-bypassing (but still hook-firing) `AccessContext`
+   * for the same request — use `sudo().db` for reads/writes that must not
+   * depend on the caller's own list access policy (e.g. an identity lookup
+   * like "who is this session"). Deliberately NOT a method on `AccessContext`
+   * itself — a self-referential `sudo(): AccessContext` field on that shared,
+   * widely-instantiated interface tripped up TypeScript's structural checking
+   * of unrelated generated Prisma types elsewhere (nullable JSON `CreateInput`
+   * fields) in a downstream app; passing it as a plain second argument avoids
+   * that recursion entirely.
+   */
+  runtime?: (
+    context: import('../access/types.js').AccessContext,
+    sudo: () => import('../access/types.js').AccessContext,
+  ) => unknown
 
   /**
    * Optional: Type metadata for runtime services

package/src/context/index.ts

@@ -393,7 +393,12 @@ export function getContext<
     for (const plugin of pluginsToExecute) {
       if (plugin.runtime) {
         try {
-          context.plugins[plugin.name] = plugin.runtime(context)
+          // Passed as a plain second argument rather than a method on
+          // `context` itself — see the `sudo` param doc on `Plugin['runtime']`.
+          context.plugins[plugin.name] = plugin.runtime(
+            context,
+            () => sudo() as unknown as AccessContext<TPrisma>,
+          )
         } catch (error) {
           console.error(`Error executing runtime for plugin "${plugin.name}":`, error)
           // Continue with other plugins even if one fails

package/src/internal.ts

@@ -43,6 +43,8 @@ export type {
   ThemeConfig,
   ThemePreset,
   ThemeColors,
+  ThemeFonts,
+  ThemeShadows,
   FileMetadata,
   ImageMetadata,
   ImageTransformationResult,

package/src/query/relationship-options.test.ts

@@ -39,6 +39,13 @@ function makeConfig(): OpenSaasConfig {
         ui: { labelField: 'rank' },
         access: { operation: { query: () => true } },
       },
+      VirtualLabel: {
+        fields: {
+          displayName: { type: 'virtual', virtual: true },
+        },
+        ui: { labelField: 'displayName' },
+        access: { operation: { query: () => true } },
+      },
     },
   } as unknown as OpenSaasConfig
 }
@@ -99,6 +106,36 @@ describe('getRelationshipOptions', () => {
     expect(call.orderBy).toEqual({ rank: 'asc' })
   })
 
+  it('falls back to ordering by id when the label field is virtual (no backing column)', async () => {
+    const rows = [{ id: 'v1', displayName: 'Computed One' }]
+    const delegate = makeDelegate(rows)
+    const context = makeContext({ virtualLabel: delegate })
+    const config = makeConfig()
+
+    const result = await getRelationshipOptions(context, config, 'VirtualLabel', { search: 'One' })
+
+    const call = delegate.findMany.mock.calls[0][0] as Record<string, unknown>
+    // Virtual label fields have no backing column, so ordering by them would
+    // 500 in Prisma — order by id instead, and skip the text `contains` filter.
+    expect(call.orderBy).toEqual({ id: 'asc' })
+    expect(call.where).toBeUndefined()
+    expect(result).toEqual([{ id: 'v1', label: 'Computed One' }])
+  })
+
+  it('treats a field flagged virtual via type alone as non-orderable (orders by id)', async () => {
+    const config = makeConfig()
+    // Only `type: 'virtual'` is set here (no `virtual: true`) to lock in the
+    // discriminator against future refactors.
+    ;(config.lists.VirtualLabel.fields.displayName as { virtual?: boolean }).virtual = undefined
+    const delegate = makeDelegate([{ id: 'v1', displayName: 'Computed One' }])
+    const context = makeContext({ virtualLabel: delegate })
+
+    await getRelationshipOptions(context, config, 'VirtualLabel', { search: 'One' })
+
+    const call = delegate.findMany.mock.calls[0][0] as Record<string, unknown>
+    expect(call.orderBy).toEqual({ id: 'asc' })
+  })
+
   it('unions currently-selected ids even when beyond take / not matching search', async () => {
     // The bounded/search-scoped query only returns a1 (mimicking take:1 + search).
     const primaryDelegate = makeDelegate([authors[0]])

package/src/query/relationship-options.ts

@@ -44,13 +44,21 @@ export async function getRelationshipOptions(
   })
 
   const { search, take = DEFAULT_TAKE, selectedIds = [] } = args
-  const labelFieldConfig = relatedListConfig.fields[labelField] as { type?: string } | undefined
+  const labelFieldConfig = relatedListConfig.fields[labelField] as
+    { type?: string; virtual?: boolean } | undefined
   const where =
     search && labelFieldConfig?.type === 'text' ? { [labelField]: { contains: search } } : undefined
 
+  // Virtual/computed label fields (resolved at read time via `resolveOutput`)
+  // have no backing database column, so passing them into `orderBy` fails
+  // Prisma validation and 500s the request. Fall back to ordering by `id` —
+  // always a real, orderable column — whenever the label field is virtual.
+  const isVirtualLabel = labelFieldConfig?.type === 'virtual' || labelFieldConfig?.virtual === true
+  const orderBy: Record<string, 'asc'> = isVirtualLabel ? { id: 'asc' } : { [labelField]: 'asc' }
+
   const primary = await runQuery(context, relatedListKey, fragment, {
     where,
-    orderBy: { [labelField]: 'asc' },
+    orderBy,
     take,
   })
 

package/tests/plugin-engine.test.ts

@@ -681,8 +681,8 @@ describe('Plugin Engine', () => {
     })
   })
 
-  describe('access control merging', () => {
-    test('merges access control from plugins', async () => {
+  describe('access control guardrail (ADR-0013)', () => {
+    test('throws when an extension carries operation access for a pre-existing list', async () => {
       const plugin: Plugin = {
         name: 'test-plugin',
         init: async (context) => {
@@ -711,23 +711,19 @@ describe('Plugin Engine', () => {
         plugins: [plugin],
       }
 
-      const result = await executePlugins(config)
-
-      expect(result.lists.Post.access?.operation?.query).toBeDefined()
-      expect(result.lists.Post.access?.operation?.create).toBeDefined()
-      expect(result.lists.Post.access?.operation?.update).toBeDefined()
+      await expect(executePlugins(config)).rejects.toThrow(
+        'Plugin "test-plugin" tried to set operation-level access while extending list "Post"',
+      )
     })
 
-    test('plugin access control overrides existing', async () => {
-      const pluginQuery = vi.fn(() => false)
-
+    test('extension attempting to override existing access throws instead of silently winning', async () => {
       const plugin: Plugin = {
         name: 'test-plugin',
         init: async (context) => {
           context.extendList('Post', {
             access: {
               operation: {
-                query: pluginQuery,
+                query: () => false,
               },
             },
           })
@@ -750,10 +746,67 @@ describe('Plugin Engine', () => {
         plugins: [plugin],
       }
 
+      await expect(executePlugins(config)).rejects.toThrow('Post')
+
+      // The host's access is untouched — the throw happens before any mutation.
+      expect(config.lists.Post.access?.operation?.query).toBe(originalQuery)
+    })
+
+    test('extension providing only fields/hooks for a pre-existing list leaves its access untouched', async () => {
+      const originalQuery = vi.fn(() => true)
+
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async (context) => {
+          context.extendList('Post', {
+            fields: { views: integer() },
+          })
+        },
+      }
+
+      const config: OpenSaasConfig = {
+        lists: {
+          Post: {
+            fields: { title: text() },
+            access: {
+              operation: {
+                query: originalQuery,
+              },
+            },
+          },
+        },
+        plugins: [plugin],
+      }
+
+      const result = await executePlugins(config)
+
+      expect(result.lists.Post.fields.views).toBeDefined()
+      expect(result.lists.Post.access?.operation?.query).toBe(originalQuery)
+    })
+
+    test('a plugin creating a new list may still set its access via addList', async () => {
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async (context) => {
+          context.addList('Widget', {
+            fields: { name: text() },
+            access: {
+              operation: {
+                query: () => true,
+              },
+            },
+          })
+        },
+      }
+
+      const config: OpenSaasConfig = {
+        lists: {},
+        plugins: [plugin],
+      }
+
       const result = await executePlugins(config)
 
-      // Plugin's access control should override original
-      expect(result.lists.Post.access?.operation?.query).toBe(pluginQuery)
+      expect(result.lists.Widget.access?.operation?.query).toBeDefined()
     })
   })
 

package/tests/sudo.test.ts

@@ -3,6 +3,8 @@ import { getContext } from '../src/context/index.js'
 import { config, list } from '../src/config/index.js'
 import { text, integer, relationship } from '../src/fields/index.js'
 import type { PrismaClient } from '@prisma/client'
+import type { Plugin } from '../src/config/types.js'
+import type { AccessContext } from '../src/access/types.js'
 
 describe('Sudo Context', () => {
   // Mock Prisma client
@@ -624,4 +626,51 @@ describe('Sudo Context', () => {
       ).rejects.toThrow('Access denied')
     })
   })
+
+  describe('Plugin runtime sudo access', () => {
+    // A plugin's `runtime(context, sudo)` factory receives a `sudo` helper as a
+    // plain second argument — NOT a method on `AccessContext` itself. A
+    // self-referential `sudo(): AccessContext` field on that shared, widely
+    // instantiated interface was found to break TypeScript's structural
+    // checking of unrelated generated Prisma types in a downstream app
+    // (nullable JSON `CreateInput` fields); passing it as a separate argument
+    // avoids that recursion while still giving plugins (e.g. the auth
+    // plugin's getUser/getCurrentUser, see ADR-0013) an access-bypassing
+    // identity-lookup path.
+    it('passes a working sudo() as the second argument to plugin.runtime()', async () => {
+      let capturedSudo: (() => AccessContext<typeof mockPrisma>) | undefined
+
+      const plugin: Plugin = {
+        name: 'test-plugin',
+        init: async () => {},
+        runtime: (_context, sudo) => {
+          capturedSudo = sudo as () => AccessContext<typeof mockPrisma>
+          return {}
+        },
+      }
+
+      const pluginConfig = await config({
+        db: { provider: 'sqlite' },
+        plugins: [plugin],
+        lists: {
+          Post: list({
+            fields: { title: text({ validation: { isRequired: true } }) },
+            // Closed list: only sudo() should be able to read from it.
+            access: { operation: { query: () => false } },
+          }),
+        },
+      })
+
+      mockPrisma.post.findMany.mockResolvedValue([{ id: '1', title: 'Test Post' }])
+
+      getContext(pluginConfig, mockPrisma, null)
+
+      expect(capturedSudo).toBeTypeOf('function')
+
+      const sudoContext = capturedSudo!()
+      const sudoResult = await sudoContext.db.post.findMany()
+      expect(sudoResult).toHaveLength(1)
+      expect(sudoResult[0].title).toBe('Test Post')
+    })
+  })
 })