@appxdigital/appx-core 0.1.120 → 0.1.121-beta.4

package/dist/common/interceptors/prisma.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.interceptor.d.ts","sourceRoot":"","sources":["../../../src/common/interceptors/prisma.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAC,UAAU,EAAa,MAAM,MAAM,CAAC;AAK5C,qBACa,iBAAkB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,aAAa;IALzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;gBAG1B,aAAa,EAAE,aAAa,EACrC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa;IAKxC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC;CAoE3E"}
+{"version":3,"file":"prisma.interceptor.d.ts","sourceRoot":"","sources":["../../../src/common/interceptors/prisma.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAoB,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAC,UAAU,EAAa,MAAM,MAAM,CAAC;AAK5C,qBACa,iBAAkB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,aAAa;IALzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;gBAG1B,aAAa,EAAE,aAAa,EACrC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa;IAKxC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC;CA+E3E"}

package/dist/common/interceptors/prisma.interceptor.js

@@ -39,31 +39,43 @@ let PrismaInterceptor = exports.PrismaInterceptor = class PrismaInterceptor {
             }, () => {
                 const useTransaction = this.reflector.get('useTransaction', context.getHandler()) ?? this.defaultUseTransaction === 'true';
                 if (useTransaction) {
+                    // Run the handler inside the transaction and CAPTURE its result,
+                    // but do not emit the response yet: the client must not see a
+                    // success response until the transaction has actually committed.
+                    // Emitting inside the transaction (before it commits) races the
+                    // commit — an immediate read-after-write can miss the row.
+                    let handlerResult;
                     this.prismaService
                         .$transaction(async (transactionClient) => {
                         nestjs_request_context_1.RequestContext.currentContext.req.prisma = transactionClient;
-                        await new Promise((resolve, reject) => {
+                        handlerResult = await new Promise((resolve, reject) => {
+                            let captured;
                             next
                                 .handle()
-                                .pipe((0, operators_1.tap)(() => { }), (0, operators_1.catchError)((err) => {
+                                .pipe((0, operators_1.catchError)((err) => {
                                 const handledError = (0, error_handler_1.handleError)(err);
                                 reject(handledError);
                                 return (0, rxjs_1.throwError)(() => handledError);
                             }))
                                 .subscribe({
-                                next: (result) => observer.next(result),
+                                next: (result) => {
+                                    captured = result;
+                                },
                                 complete: () => {
                                     delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;
-                                    observer.complete();
-                                    resolve(null);
+                                    resolve(captured);
                                 },
                                 error: (err) => {
                                     delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;
-                                    observer.error(err);
                                     reject(err);
                                 },
                             });
                         });
+                    })
+                        .then(() => {
+                        // The transaction has committed — now it is safe to respond.
+                        observer.next(handlerResult);
+                        observer.complete();
                     })
                         .catch((err) => {
                         delete nestjs_request_context_1.RequestContext.currentContext.req.prisma;

package/dist/common/setup/core-config.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Boot-time configuration helpers used by the scaffold's `main.ts` /
+ * `app.module.ts`. They fail fast on insecure or ambiguous configuration
+ * instead of silently falling back.
+ */
+/** Minimum length we require of a session signing secret. */
+export declare const MIN_SESSION_SECRET_LENGTH = 32;
+export interface CoreSessionOptionsInput {
+    /** The session signing secret. Required — no fallback. */
+    secret?: string;
+    /** The express-session store (e.g. `CorePrismaSessionStore`). */
+    store: any;
+    /** Cookie name. */
+    cookieName?: string;
+    /** Session TTL in seconds (drives cookie `maxAge`). Default 86400. */
+    ttlSeconds?: number;
+    /**
+     * Force the `Secure` cookie flag. Defaults to `true` in production
+     * (`NODE_ENV === 'production'`), `false` otherwise so local HTTP dev works.
+     */
+    secure?: boolean;
+    /** `SameSite` policy. Default `'lax'`. */
+    sameSite?: boolean | 'lax' | 'strict' | 'none';
+}
+/**
+ * Builds hardened `express-session` options.
+ *
+ * - **:** throws if `secret` is missing or shorter than
+ *   {@link MIN_SESSION_SECRET_LENGTH}. There is no hardcoded fallback — a
+ *   missing secret must stop the boot, never silently sign sessions with a
+ *   public constant.
+ * - **:** sets `cookie: { httpOnly, secure, sameSite, maxAge }` so session
+ *   cookies are not readable by JS, are `Secure` in production, and carry a
+ *   `SameSite` policy.
+ *
+ * Pass the result straight to `session(...)`.
+ */
+export declare function buildCoreSessionOptions(input: CoreSessionOptionsInput): {
+    secret: string;
+    resave: boolean;
+    saveUninitialized: boolean;
+    name: string | undefined;
+    store: any;
+    cookie: {
+        httpOnly: boolean;
+        secure: boolean;
+        sameSite: boolean | "none" | "lax" | "strict";
+        maxAge: number;
+    };
+};
+/**
+ * Resolves the env file paths for `ConfigModule.forRoot({ envFilePath })`.
+ *
+ * Returns `['.env.<NODE_ENV>', '.env']`. `ConfigModule` gives the **first**
+ * existing file precedence, so environment-specific values in `.env.<NODE_ENV>`
+ * win, and a plain `.env` (what `appx-core create` generates) is loaded as a
+ * base/fallback. Without the `.env` fallback a freshly scaffolded project —
+ * which ships only `.env` — would load nothing and then fail the * `SESSION_SECRET` check at boot.
+ *
+ * **:** throws if `NODE_ENV` is unset instead of silently defaulting to
+ * `development` — a production deploy that forgets `NODE_ENV` must fail fast
+ * rather than load `.env.development` (dev DB creds, loose CORS, insecure
+ * cookies). Set `NODE_ENV` explicitly (`production` / `development` / `test`).
+ */
+export declare function coreEnvFilePath(): string[];
+//# sourceMappingURL=core-config.d.ts.map

package/dist/common/setup/core-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../../../src/common/setup/core-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,MAAM,WAAW,uBAAuB;IACpC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,GAAG,CAAC;IACX,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB;;;;;;;;;;;;EAuBrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAS1C"}

package/dist/common/setup/core-config.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Boot-time configuration helpers used by the scaffold's `main.ts` /
+ * `app.module.ts`. They fail fast on insecure or ambiguous configuration
+ * instead of silently falling back.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreEnvFilePath = exports.buildCoreSessionOptions = exports.MIN_SESSION_SECRET_LENGTH = void 0;
+/** Minimum length we require of a session signing secret. */
+exports.MIN_SESSION_SECRET_LENGTH = 32;
+/**
+ * Builds hardened `express-session` options.
+ *
+ * - **:** throws if `secret` is missing or shorter than
+ *   {@link MIN_SESSION_SECRET_LENGTH}. There is no hardcoded fallback — a
+ *   missing secret must stop the boot, never silently sign sessions with a
+ *   public constant.
+ * - **:** sets `cookie: { httpOnly, secure, sameSite, maxAge }` so session
+ *   cookies are not readable by JS, are `Secure` in production, and carry a
+ *   `SameSite` policy.
+ *
+ * Pass the result straight to `session(...)`.
+ */
+function buildCoreSessionOptions(input) {
+    const { secret, store, cookieName, ttlSeconds = 86400, secure, sameSite = 'lax' } = input;
+    if (!secret || secret.length < exports.MIN_SESSION_SECRET_LENGTH) {
+        throw new Error(`SESSION_SECRET must be set and at least ${exports.MIN_SESSION_SECRET_LENGTH} characters. ` +
+            'Refusing to start with a missing or weak session secret.');
+    }
+    return {
+        secret,
+        resave: false,
+        saveUninitialized: false,
+        name: cookieName,
+        store,
+        cookie: {
+            httpOnly: true,
+            secure: secure ?? process.env.NODE_ENV === 'production',
+            sameSite,
+            maxAge: ttlSeconds * 1000,
+        },
+    };
+}
+exports.buildCoreSessionOptions = buildCoreSessionOptions;
+/**
+ * Resolves the env file paths for `ConfigModule.forRoot({ envFilePath })`.
+ *
+ * Returns `['.env.<NODE_ENV>', '.env']`. `ConfigModule` gives the **first**
+ * existing file precedence, so environment-specific values in `.env.<NODE_ENV>`
+ * win, and a plain `.env` (what `appx-core create` generates) is loaded as a
+ * base/fallback. Without the `.env` fallback a freshly scaffolded project —
+ * which ships only `.env` — would load nothing and then fail the * `SESSION_SECRET` check at boot.
+ *
+ * **:** throws if `NODE_ENV` is unset instead of silently defaulting to
+ * `development` — a production deploy that forgets `NODE_ENV` must fail fast
+ * rather than load `.env.development` (dev DB creds, loose CORS, insecure
+ * cookies). Set `NODE_ENV` explicitly (`production` / `development` / `test`).
+ */
+function coreEnvFilePath() {
+    const env = process.env.NODE_ENV;
+    if (!env) {
+        throw new Error('NODE_ENV must be explicitly set (e.g. "production" or "development"). ' +
+            'Refusing to default to development.');
+    }
+    return [`.env.${env}`, '.env'];
+}
+exports.coreEnvFilePath = coreEnvFilePath;

package/dist/common/setup/setup-core-security.d.ts

@@ -0,0 +1,62 @@
+import { INestApplication, ValidationPipeOptions } from '@nestjs/common';
+/**
+ * Minimal CORS options accepted by {@link setupCoreSecurity}. Mirrors the
+ * subset of Nest's `CorsOptions` that most apps set; extra keys are passed
+ * through to `app.enableCors` untouched. Declared locally to avoid a fragile
+ * deep import into Nest internals.
+ */
+export interface CoreCorsOptions {
+    origin?: string | string[] | boolean | RegExp | (string | RegExp)[];
+    credentials?: boolean;
+    [key: string]: any;
+}
+/**
+ * Options for {@link setupCoreSecurity}. Each concern can be disabled by
+ * passing `false`, or tuned by passing an options object that is merged over
+ * the secure defaults.
+ */
+export interface CoreSecurityOptions {
+    /**
+     * Global `ValidationPipe`. Secure default:
+     * `{ transform: true, whitelist: true, forbidNonWhitelisted: true }`.
+     *
+     * `whitelist` strips body properties that carry no validation decorator;
+     * `forbidNonWhitelisted` turns such properties into a `400` instead of
+     * silently dropping them. Combined with DTOs that declare every accepted
+     * field, this rejects unknown body properties on `POST /auth/register`
+     * and every other class-validated request body.
+     *
+     * Pass `false` to skip (you must then register your own pipe), or an
+     * options object to override individual flags.
+     */
+    validationPipe?: ValidationPipeOptions | false;
+    /**
+     * CORS. Default: `{ origin: 'http://localhost:3000', credentials: true }`
+     * — the scaffold's historical default. Read `origin` from configuration
+     * (e.g. a `CORS_ORIGIN` env var) and pass it here so the allowed origin is
+     * deployment-configurable rather than hardcoded.
+     *
+     * Guardrail: `origin: '*'` together with `credentials: true` throws at
+     * setup — that combination is rejected by browsers and is a common footgun.
+     *
+     * Pass `false` to skip (you manage CORS yourself).
+     */
+    cors?: CoreCorsOptions | false;
+    /**
+     * Security headers via Helmet: `Content-Security-Policy`,
+     * `X-Content-Type-Options`, `Strict-Transport-Security`, frame-ancestors, etc.
+     * Default: enabled with Helmet's defaults. Pass an options object to tune
+     * (e.g. a custom CSP for the AdminJS UI), or `false` to skip.
+     */
+    helmet?: Record<string, any> | false;
+}
+/**
+ * Applies AppX Core's baseline HTTP hardening to a Nest application.
+ *
+ * Call once in `main.ts`, after `NestFactory.create(...)` and before
+ * `app.listen(...)`. New scaffolds call it for you; existing projects should
+ * add the call when upgrading — see the CHANGELOG migration note for the
+ * version that introduced each concern.
+ */
+export declare function setupCoreSecurity(app: INestApplication, options?: CoreSecurityOptions): void;
+//# sourceMappingURL=setup-core-security.d.ts.map

package/dist/common/setup/setup-core-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-core-security.d.ts","sourceRoot":"","sources":["../../../src/common/setup/setup-core-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gBAAgB,EAAkB,qBAAqB,EAAC,MAAM,gBAAgB,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACpE,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAE/C;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAE/B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,gBAAgB,EACrB,OAAO,GAAE,mBAAwB,GAClC,IAAI,CAkCN"}

package/dist/common/setup/setup-core-security.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCoreSecurity = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Applies AppX Core's baseline HTTP hardening to a Nest application.
+ *
+ * Call once in `main.ts`, after `NestFactory.create(...)` and before
+ * `app.listen(...)`. New scaffolds call it for you; existing projects should
+ * add the call when upgrading — see the CHANGELOG migration note for the
+ * version that introduced each concern.
+ */
+function setupCoreSecurity(app, options = {}) {
+    if (options.validationPipe !== false) {
+        app.useGlobalPipes(new common_1.ValidationPipe({
+            transform: true,
+            whitelist: true,
+            forbidNonWhitelisted: true,
+            ...(options.validationPipe ?? {}),
+        }));
+    }
+    if (options.cors !== false) {
+        const cors = options.cors ?? {};
+        const origin = cors.origin ?? 'http://localhost:3000';
+        const credentials = cors.credentials ?? true;
+        if (credentials && origin === '*') {
+            throw new Error("setupCoreSecurity: CORS origin '*' is incompatible with credentials:true — " +
+                'browsers reject it and it exposes credentialed endpoints to every origin. ' +
+                'Set an explicit origin (e.g. via a CORS_ORIGIN env var) or disable credentials.');
+        }
+        app.enableCors({ ...cors, origin, credentials });
+    }
+    if (options.helmet !== false) {
+        // Lazy require: helmet is a peer dependency, only needed when enabled.
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const helmet = require('helmet');
+        app.use(typeof options.helmet === 'object' ? helmet(options.helmet) : helmet());
+    }
+}
+exports.setupCoreSecurity = setupCoreSecurity;

package/dist/config/generate-all.js

@@ -43,6 +43,10 @@ console.log('Generating Services...');
 (0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-services.js')}`, {
     stdio: 'inherit',
 });
+console.log('Generating DTOs...');
+(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-dtos.js')}`, {
+    stdio: 'inherit',
+});
 console.log('Generating Controllers...');
 (0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-controllers.js')}`, {
     stdio: 'inherit',

package/dist/config/generate-controllers.js

@@ -34,10 +34,12 @@ const modulesOutputPath = path.join(process.cwd(), 'src/modules');
  * @param folder
  */
 const genericControllerTemplate = (model, folder) => `
-import { Controller } from '@nestjs/common';
+import { Body, Controller, Param, Post, Put } from '@nestjs/common';
 import { ${model}Service } from './${folder}.service';
 import { ${model} } from '@prisma/client';
-import { CoreController } from '@appxdigital/appx-core';
+import { CoreController, Permission } from '@appxdigital/appx-core';
+import { Create${model}Dto } from './dto/create-${folder}.dto';
+import { Update${model}Dto } from './dto/update-${folder}.dto';
 
 @Controller('${model.toLowerCase()}s')
 export class ${model}Controller extends CoreController<${model}> {
@@ -48,6 +50,21 @@ export class ${model}Controller extends CoreController<${model}> {
   static get entityName(): string {
     return '${model}';
   }
+
+  // Overridden so the @Body() type is a concrete DTO — this is what lets
+  // ValidationPipe (whitelist) strip unknown fields.
+  // Custom validation goes in the DTO subclass, not here.
+  @Post()
+  @Permission('create')
+  async create(@Body() data: Create${model}Dto) {
+    return super.create(data as any);
+  }
+
+  @Put(':id')
+  @Permission('updateMany')
+  async update(@Param('id') id: string, @Body() data: Update${model}Dto) {
+    return super.update(id, data as any);
+  }
 }
 `;
 /**

package/dist/config/generate-dtos.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=generate-dtos.d.ts.map

package/dist/config/generate-dtos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":""}

package/dist/config/generate-dtos.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const utils_1 = require("./utils");
+/**
+ * DTO generator.
+ *
+ * Generated CRUD controllers type `@Body()` as a generic, so NestJS's
+ * ValidationPipe has no concrete class to validate against and unknown fields
+ * are accepted. This generator emits a class-validator DTO per model+action so
+ * the controller can type its body concretely.
+ *
+ * Two-file, schema-is-source-of-truth model:
+ *   - `src/generated/dto/<model>/create-<model>.generated.dto.ts` — the base
+ *     class, derived from the Prisma schema, ALWAYS overwritten (gitignored).
+ *   - `src/modules/<model>/dto/create-<model>.dto.ts` — a hand-owned subclass,
+ *     generated ONCE, where the developer adds custom validation. Never
+ *     overwritten. The controller imports this subclass.
+ *
+ * A scalar field is writable (appears in the DTO) unless it is:
+ *   - the primary key (`@id`),
+ *   - a server-managed timestamp (`@default(now())` or `@updatedAt`),
+ *   - annotated `/// @NoWrite`, or
+ *   - annotated `/// @Role(none)` (readable by nobody ⇒ not CRUD-writable).
+ * Relation navigation fields are excluded; their scalar foreign keys are kept.
+ */
+const cwd = process.cwd();
+// Read the consumer's generated Prisma client for the DMMF (authoritative
+// field metadata incl. `documentation`, which carries /// @Role / @NoWrite).
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { Prisma } = require(path.join(cwd, 'node_modules', '@prisma/client'));
+const generatedDtoRoot = path.join(cwd, 'src/generated/dto');
+const modulesRoot = path.join(cwd, 'src/modules');
+function isNoWrite(doc) {
+    if (!doc)
+        return false;
+    if (/@NoWrite\b/i.test(doc))
+        return true;
+    // @Role(none): readable by nobody ⇒ treat as not CRUD-writable.
+    const roleMatch = doc.match(/@Role\((.*?)\)/);
+    if (roleMatch) {
+        const roles = roleMatch[1].split(',').map((r) => r.trim().toLowerCase());
+        if (roles.includes('none'))
+            return true;
+    }
+    return false;
+}
+function isServerManagedTimestamp(field) {
+    if (field.isUpdatedAt)
+        return true;
+    const def = field.default;
+    return !!def && typeof def === 'object' && def.name === 'now';
+}
+/** Decision for a scalar/enum field: base validator, TS type, optional enum arg. */
+function mapField(field) {
+    if (field.kind === 'enum') {
+        return { validator: 'IsEnum', tsType: field.type, enumArg: field.type };
+    }
+    switch (field.type) {
+        case 'String':
+            return { validator: 'IsString', tsType: 'string' };
+        case 'Boolean':
+            return { validator: 'IsBoolean', tsType: 'boolean' };
+        case 'Int':
+        case 'BigInt':
+            return { validator: 'IsInt', tsType: 'number' };
+        case 'Float':
+        case 'Decimal':
+            return { validator: 'IsNumber', tsType: 'number' };
+        case 'DateTime':
+            return { validator: 'IsDateString', tsType: 'string' };
+        default:
+            // Json, Bytes, and anything unrecognised: keep the field (so it isn't
+            // stripped by whitelist) without a strict type validator.
+            return { validator: 'Allow', tsType: 'any' };
+    }
+}
+function writableFields(model) {
+    return model.fields.filter((f) => {
+        if (f.kind === 'object')
+            return false; // relation navigation
+        if (f.isId)
+            return false;
+        if (isServerManagedTimestamp(f))
+            return false;
+        if (isNoWrite(f.documentation))
+            return false;
+        return true;
+    });
+}
+/** Renders a base DTO class body + its import block. */
+function renderBaseDto(className, fields, mode) {
+    const validatorImports = new Set();
+    const enumImports = new Set();
+    const lines = [];
+    for (const field of fields) {
+        const m = mapField(field);
+        validatorImports.add(m.validator);
+        if (m.enumArg)
+            enumImports.add(m.enumArg);
+        // update: everything optional. create: optional if not required or has a default.
+        const optional = mode === 'update' || !field.isRequired || field.hasDefaultValue;
+        const isList = field.isList;
+        const tsType = isList ? `${m.tsType}[]` : m.tsType;
+        // Compose the validator decorator. @Allow takes no options; for other
+        // validators on a list field, add `{ each: true }` (+ @IsArray).
+        let validatorDecorator;
+        if (m.validator === 'Allow') {
+            validatorDecorator = '@Allow()';
+        }
+        else {
+            const args = [];
+            if (m.enumArg)
+                args.push(m.enumArg);
+            if (isList)
+                args.push('{ each: true }');
+            validatorDecorator = `@${m.validator}(${args.join(', ')})`;
+        }
+        const decoratorLines = [];
+        if (optional) {
+            validatorImports.add('IsOptional');
+            decoratorLines.push('    @IsOptional()');
+        }
+        if (isList && m.validator !== 'Allow') {
+            validatorImports.add('IsArray');
+            decoratorLines.push('    @IsArray()');
+        }
+        decoratorLines.push(`    ${validatorDecorator}`);
+        lines.push(decoratorLines.join('\n'));
+        lines.push(`    ${field.name}${optional ? '?' : '!'}: ${tsType};`);
+        lines.push('');
+    }
+    const importLines = [];
+    if (validatorImports.size > 0) {
+        importLines.push(`import { ${[...validatorImports].sort().join(', ')} } from 'class-validator';`);
+    }
+    if (enumImports.size > 0) {
+        importLines.push(`import { ${[...enumImports].sort().join(', ')} } from '@prisma/client';`);
+    }
+    return (utils_1.GENERATED_BANNER +
+        '\n' +
+        (importLines.length ? importLines.join('\n') + '\n\n' : '') +
+        `export class ${className} {\n` +
+        (lines.length ? lines.map((l) => l).join('\n') : '') +
+        `}\n`);
+}
+/** Renders the hand-owned subclass (generated once, then customizable). */
+function renderSubclassDto(subclass, baseClass, importPath) {
+    return (`import { ${baseClass} } from '${importPath}';\n\n` +
+        `/**\n` +
+        ` * Hand-owned DTO for the CRUD endpoint. Add custom class-validator rules\n` +
+        ` * here; this file is generated once and never overwritten by \`appx generate\`.\n` +
+        ` * The base class is regenerated from the Prisma schema.\n` +
+        ` */\n` +
+        `export class ${subclass} extends ${baseClass} {}\n`);
+}
+for (const model of Prisma.dmmf.datamodel.models) {
+    const modelName = model.name; // Pascal, e.g. ProjectMember
+    const folder = (0, utils_1.pascalToKebabCase)(modelName); // kebab, e.g. project-member
+    if (utils_1.IGNORE_FOLDERS.includes(folder))
+        continue;
+    const fields = writableFields(model);
+    for (const mode of ['create', 'update']) {
+        const capMode = mode.charAt(0).toUpperCase() + mode.slice(1);
+        const baseClass = `${capMode}${modelName}GeneratedDto`;
+        const subclass = `${capMode}${modelName}Dto`;
+        // Base (overwritten, gitignored).
+        const basePath = path.join(generatedDtoRoot, folder, `${mode}-${folder}.generated.dto.ts`);
+        (0, utils_1.writeGeneratedFile)(basePath, renderBaseDto(baseClass, fields, mode));
+        // Subclass (once, hand-owned, committed).
+        const subPath = path.join(modulesRoot, folder, 'dto', `${mode}-${folder}.dto.ts`);
+        const importPath = `../../../generated/dto/${folder}/${mode}-${folder}.generated.dto`;
+        (0, utils_1.createFileIfNotExists)(subPath, renderSubclassDto(subclass, baseClass, importPath));
+    }
+}
+console.log('DTOs generated.');

package/dist/config/utils.d.ts

@@ -1,4 +1,18 @@
 export declare const kebabToPascalCase: (str: string) => string;
+export declare const pascalToKebabCase: (str: string) => string;
 export declare const createFileIfNotExists: (filePath: string, content: string) => void;
+/**
+ * Banner stamped on every fully-generated file. These files live under
+ * `src/generated/` (gitignored) and are OVERWRITTEN on every `appx generate`.
+ * Never hand-edit them — customize the hand-owned subclass under
+ * `src/modules/<model>/dto/` instead.
+ */
+export declare const GENERATED_BANNER: string;
+/**
+ * Writes a fully-generated file, always overwriting. Use only for artifacts
+ * under `src/generated/` that carry {@link GENERATED_BANNER}. Creates parent
+ * directories as needed.
+ */
+export declare const writeGeneratedFile: (filePath: string, content: string) => void;
 export declare const IGNORE_FOLDERS: string[];
 //# sourceMappingURL=utils.d.ts.map

package/dist/config/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/config/utils.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,aAAc,MAAM,WAAW,MAAM,SAQtE,CAAC;AAEF,eAAO,MAAM,cAAc,UAK1B,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/config/utils.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,aAAc,MAAM,WAAW,MAAM,SAStE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAGoD,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,WAAW,MAAM,SAInE,CAAC;AAEF,eAAO,MAAM,cAAc,UAS1B,CAAC"}

package/dist/config/utils.js

@@ -23,8 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IGNORE_FOLDERS = exports.createFileIfNotExists = exports.kebabToPascalCase = void 0;
+exports.IGNORE_FOLDERS = exports.writeGeneratedFile = exports.GENERATED_BANNER = exports.createFileIfNotExists = exports.pascalToKebabCase = exports.kebabToPascalCase = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const kebabToPascalCase = (str) => {
     return str
         .split("-")
@@ -32,9 +33,17 @@ const kebabToPascalCase = (str) => {
         .join("");
 };
 exports.kebabToPascalCase = kebabToPascalCase;
+const pascalToKebabCase = (str) => {
+    return str
+        .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1-$2')
+        .toLowerCase();
+};
+exports.pascalToKebabCase = pascalToKebabCase;
 const createFileIfNotExists = (filePath, content) => {
     console.log(`Creating ${filePath}...`);
     if (!fs.existsSync(filePath)) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
         fs.writeFileSync(filePath, content);
         console.log(`${filePath} created.`);
     }
@@ -43,9 +52,33 @@ const createFileIfNotExists = (filePath, content) => {
     }
 };
 exports.createFileIfNotExists = createFileIfNotExists;
+/**
+ * Banner stamped on every fully-generated file. These files live under
+ * `src/generated/` (gitignored) and are OVERWRITTEN on every `appx generate`.
+ * Never hand-edit them — customize the hand-owned subclass under
+ * `src/modules/<model>/dto/` instead.
+ */
+exports.GENERATED_BANNER = '// @Generated by appx-core — do not edit.\n' +
+    '// Regenerated by `appx generate`; lives under src/generated (gitignored).\n' +
+    '// To customize, edit the hand-owned subclass in src/modules/<model>/dto.\n';
+/**
+ * Writes a fully-generated file, always overwriting. Use only for artifacts
+ * under `src/generated/` that carry {@link GENERATED_BANNER}. Creates parent
+ * directories as needed.
+ */
+const writeGeneratedFile = (filePath, content) => {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+    console.log(`Generated ${filePath}`);
+};
+exports.writeGeneratedFile = writeGeneratedFile;
 exports.IGNORE_FOLDERS = [
     'prisma',
     'schema.gql',
     'session',
-    'user-refresh-token'
+    'user-refresh-token',
+    // Generated DTOs live under src/generated/dto/. The model generators scan
+    // src/generated's top-level dirs as model names, so this must be skipped or
+    // they emit a bogus `dto` module.
+    'dto',
 ];

package/dist/index.d.ts

@@ -22,6 +22,8 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/setup/setup-core-security';
+export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';
 export * from './modules/auth/authenticated.guard';
 export * from './modules/auth/jwt-auth.guard';