@appxdigital/appx-core 0.1.121 → 0.1.123

package/CHANGELOG.md

@@ -14,6 +14,51 @@ This project follows the `MAJOR.MINOR.PATCH` scheme in `package.json`.
 
 ---
 
+## [0.1.123] — 2026-07-22
+
+Two changes: the `generate` command is split into a deploy-safe pass + a module wizard, and generated CRUD DTOs now type each scalar column to match its Prisma model type.
+
+### Generate command split
+
+Regenerating types no longer mutates your code.
+
+- **`appx-core generate`** — regenerates only the overwrite-safe artifacts under the gitignored `src/generated/**` (Prisma client, GraphQL types, DTO **base** classes). It **no longer** writes `src/modules/**` or edits `src/app.module.ts`. Idempotent and safe for CI / postinstall / predeploy.
+- **`appx-core generate models`** — new interactive wizard that scaffolds CRUD (module/service/controller/resolver + DTO subclass) for the models you choose and registers them in `app.module.ts`, then runs the safe pass. Non-interactive: `appx-core generate models <Name…>` and `--all`. Only models **without** an existing module are offered; if there are none it prints `No modules available to generate`.
+- Model discovery is driven by the Prisma **DMMF** (the schema), not by scanning the GraphQL plugin's output folders.
+- The **`User`** model is framework-owned (auth already serves user endpoints; generic User CRUD is a mass-assignment surface) and is no longer scaffolded.
+- Module-registration in `app.module.ts` finds the `@Module` `imports` array's real closing bracket (skipping strings/comments/nested arrays) and **appends** there, preserving order — it no longer breaks on a nested array literal like `ThrottlerModule.forRoot([...])`, never double-registers, and never adds a duplicate import.
+- "Already has a module" is detected by the model a module serves (`CoreController<Model>` / `CoreService<Model>`), not by folder name — so a hand-written module under a non-canonical (e.g. pluralised) folder isn't duplicated.
+- Full reference: [`docs/generate.md`](./docs/generate.md). GraphQL stays **read-only**; every scaffolded module still gets its resolver.
+
+### Generated-CRUD DTO scalar typing
+
+Generated CRUD DTOs now type each scalar column to match its Prisma model type, so a controller override type-checks:
+
+- **`DateTime` → `Date`** (was `string`), via `@Type(() => Date)`.
+- **`Decimal` → `Prisma.Decimal`** (was `number`), via the new `@DecimalField()`.
+- **`BigInt` → `bigint`** (was `number`), via the new `@BigIntField()`.
+
+`@DecimalField()` / `@BigIntField()` accept a **string or number** on the wire and coerce/validate it (bad input → `400`), so there is no API change. `BigInt` columns serialize as a **string** in JSON responses (JSON has no bigint), pairing with the string-accepting input.
+
+### Migration
+
+> **Behaviour change — a bare `appx-core generate` no longer creates modules or edits `app.module.ts`.** Intentional (it makes the command CI-safe), but new tables are not auto-exposed.
+
+1. Keep running `appx-core generate` after every schema change — it refreshes the Prisma client, GraphQL types and DTO bases, and is now guaranteed not to touch your committed code.
+2. **To expose a new table** as CRUD, run `appx-core generate models` and pick it (or `appx-core generate models <Name>`) — the only command that scaffolds `src/modules/**` and registers a module.
+3. **Existing modules are unaffected.** To reproduce the old "expose every table" behaviour in one shot, run `appx-core generate models --all`.
+4. If you relied on the generated **`/users`** CRUD, it is no longer scaffolded (auth owns `/auth/*`) — re-create it by hand only if you truly need generic user CRUD.
+5. **`Decimal` columns + GraphQL:** the GraphQL generator emits imports of `prisma-graphql-type-decimal` — a **peer dependency**, so `npm install` pulls it in (npm 7+ auto-installs peers); confirm with `npm ls prisma-graphql-type-decimal` if your package manager doesn't.
+6. If you hand-typed an `OmitType(...)` override to re-type a `DateTime` / `Decimal` / `BigInt` field (because the old type made your controller override fail with `TS2416`), delete it, let the generated base DTO stand, and regenerate. No wire change.
+
+---
+
+## [0.1.122] — 2026-07-21
+
+**No migration necessary.**
+
+---
+
 ## [0.1.121] — 2026-07-14
 
 Hardening release: request validation, boot configuration, generated-CRUD DTOs, and data-access create enforcement.
@@ -38,8 +83,7 @@ Hardening release: request validation, boot configuration, generated-CRUD DTOs,
   - `src/generated/dto/<model>/<action>-<model>.generated.dto.ts` — base class, **always overwritten**, under the gitignored `src/generated/`. Never hand-edit.
   - `src/modules/<model>/dto/<action>-<model>.dto.ts` — a hand-owned subclass, generated **once**, for custom validation. The controller imports this.
 - **`/// @NoWrite` field annotation** — excludes a field from the generated create/update DTOs (all roles). Fields annotated `/// @Role(none)` are also treated as non-writable.
-- **Create-permission enforcement in the data-access proxy.** `create` / `createMany` validate that the incoming data satisfies the permission's `conditions` before insert (own-scalar fields against the data; relation conditions by looking up the referenced parent), and default-deny when the model/role has no `create` permission. A development-only warning fires when a created row would not satisfy the model's `find` conditions.
-- **`restrictedFields` on `create`** in `CoreController` (previously only `update`, which also read the wrong permission key so it never applied under `updateMany`).
+- **Create-permission enforcement in the data-access proxy.** `create` / `createMany` validate that the incoming data satisfies the permission's `conditions` before insert (the model's **own scalar fields** — relationship authorization is handled by the `connect` action; see Migration), and default-deny when the model/role has no `create` permission. A development-only warning fires when a created row would not satisfy the model's `find` conditions.
 
 ### Writable-field policy (generated DTOs)
 
@@ -65,7 +109,7 @@ import { setupCoreSecurity } from '@appxdigital/appx-core';
 const corsOrigin = configService.get<string>('CORS_ORIGIN') ?? 'http://localhost:3000';
 setupCoreSecurity(app, { cors: { origin: corsOrigin, credentials: true } });
 ```
-- Install Helmet: `npm install helmet@^8.0.0` (applied automatically by `setupCoreSecurity`; tune with `{ helmet: {...} }`, disable with `{ helmet: false }`).
+- Helmet is applied automatically by `setupCoreSecurity` (tune with `{ helmet: {...} }`, disable with `{ helmet: false }`). It's a peer dependency, so `npm install` pulls it in for you (npm 7+ auto-installs peers) — just confirm it's present with `npm ls helmet`. Only if your package manager doesn't auto-install peers (or reports it missing) add it explicitly.
 - If you register a `ValidationPipe` with custom options, pass them through: `setupCoreSecurity(app, { validationPipe: { /* overrides */ } })`.
 - With `whitelist` + `forbidNonWhitelisted`, body properties not declared on a `class-validator` DTO are rejected (`400`). Confirm every DTO declares every field it legitimately accepts before deploying.
 - Set `CORS_ORIGIN` to your real front-end origin in production. Do not combine `'*'` with credentials — the helper throws at boot. For a public credential-less API pass `{ cors: { origin: '*', credentials: false } }`.
@@ -112,7 +156,7 @@ async create(@Body() data: Create<Model>Dto) { return super.create(data as any);
 @Put(':id') @Permission('updateMany')
 async update(@Param('id') id: string, @Body() data: Update<Model>Dto) { return super.update(id, data as any); }
 ```
-(Or delete an un-customized controller and re-run `appx generate` for the new template.) Add custom validation in the hand-owned `dto/*.dto.ts` subclasses — never in the `.generated.dto.ts` base. Lock sensitive columns with `/// @NoWrite` (all roles) or `restrictedFields` on the permission (per role), then regenerate. To drop a field from one endpoint's DTO, extend `OmitType(<Model>GeneratedDto, ['field'] as const)`. Full details in [`docs/dtos.md`](../docs/dtos.md).
+(Or delete an un-customized controller and re-run `appx generate` for the new template.) Add custom validation in the hand-owned `dto/*.dto.ts` subclasses — never in the `.generated.dto.ts` base. Lock sensitive columns with `/// @NoWrite` / `/// @Role(none)` (all roles), then regenerate. To drop a field from one endpoint's DTO, extend `OmitType(<Model>GeneratedDto, ['field'] as const)`. Full details in [`docs/dtos.md`](../docs/dtos.md).
 
 > **Nested relation writes are now an explicit, permission-gated allowlist — this is a behaviour restriction; a migrating agent MUST flag it to the developer.** Generated **create** DTOs accept only two nested operators, each authorized by ABAC: **`create`** (checked against the related model's `create` rule) and **`connect`** (checked against the related model's new dedicated **`connect`** permission — a `connect` rule is required; no rule ⇒ refused). Every other operator (`set`, `disconnect`, `update`, `upsert`, `delete`, …) is rejected (`400`). Nested writes are available on **`create` only** — `update` resolves to `updateMany`, whose payload is scalar-only. **Keep `forbidNonWhitelisted: true` on (fail loud); never `whitelist`-strip on writes.**
 >
@@ -147,4 +191,3 @@ prefix. The auth building blocks (`AuthController`, `AuthService`, `RegisterDto`
 **5. Create-permission enforcement (behaviour change — review before upgrading).**
 - Ensure every model/role that legitimately creates records has an explicit `create` permission (or `'ALL'`). Without one, create now returns `403` (previously unchecked). Internal framework flows (registration, sessions, tokens) are unaffected.
 - If you supplied arbitrary values for a field a `create` condition constrains (e.g. an owner id), those requests now return `403` unless the value matches — use `setUserIdField` to have the framework set it.
-- **`restrictedFields` under `updateMany` now applies** (it was a no-op before). Fields listed there are stripped on `PUT`. Remove any field that should remain writable.

package/README.md

@@ -202,13 +202,35 @@ npx prisma db pull
 
 ### 5) Generate Modules and CRUD
 
-After you edit `schema.prisma`, run:
+There are two generation commands, split by what they touch:
 
 ```bash
+# Deploy-safe: regenerate the Prisma client, GraphQL types and DTO base classes
+# under src/generated/ (gitignored). Never writes src/modules/ or app.module.ts,
+# so it is safe in CI / postinstall / predeploy. Run it every time the schema
+# changes (no need to run `prisma generate` separately).
 appx-core generate
+
+# Scaffold CRUD for the tables you want to EXPOSE. Interactive picker listing
+# models that don't yet have a module; for each selected model it creates the
+# module/service/controller/resolver + DTO subclass and registers the module in
+# app.module.ts, then runs the safe pass above.
+appx-core generate models
+#   appx-core generate models Habit Log   # non-interactive: named models
+#   appx-core generate models --all       # every generatable model
 ```
 
-Run this **every time** you change the Prisma schema. This is the only required generation step (no need to run `prisma generate` separately).
+Not every table needs its own module — because CRUD supports permission-gated
+nested writes (`create` / `connect`), you can expose a parent and write related
+rows through it. Scaffold modules only for the resources you actually serve.
+
+> **`generate` is deploy-safe; `generate models` mutates code.** Only `generate
+> models` writes hand-owned files and edits `app.module.ts` — run it during
+> development. `generate` alone is idempotent and touches only `src/generated/`.
+> The `User` model is framework-owned (auth already serves user endpoints) and is
+> never offered by the wizard.
+
+Full reference: **[docs/generate.md](./docs/generate.md)**.
 
 ### 6) Run Migrations
 

package/dist/appx-core.module.d.ts

@@ -1,3 +1,4 @@
+import './common/bigint-serializer';
 import { DynamicModule } from '@nestjs/common';
 import { PermissionsConfigType } from './common/config/permissionsConfigTypes';
 import { FileUploadModuleOptions } from './common/interfaces/file-upload.interface';

package/dist/appx-core.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appx-core.module.d.ts","sourceRoot":"","sources":["../src/appx-core.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAA2B,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAC,qBAAqB,EAAC,MAAM,wCAAwC,CAAC;AAG7E,OAAO,EAAC,uBAAuB,EAAC,MAAM,2CAA2C,CAAC;AAElF,qBAEa,cAAc;IACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,EAAE,uBAAuB,GAAG,aAAa;CA6B5G"}
+{"version":3,"file":"appx-core.module.d.ts","sourceRoot":"","sources":["../src/appx-core.module.ts"],"names":[],"mappings":"AAAA,OAAO,4BAA4B,CAAC;AACpC,OAAO,EAAC,aAAa,EAA2B,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAC,qBAAqB,EAAC,MAAM,wCAAwC,CAAC;AAG7E,OAAO,EAAC,uBAAuB,EAAC,MAAM,2CAA2C,CAAC;AAElF,qBAEa,cAAc;IACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,EAAE,uBAAuB,GAAG,aAAa;CA6B5G"}

package/dist/appx-core.module.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var AppxCoreModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppxCoreModule = void 0;
+require("./common/bigint-serializer"); // side effect: BigInt → string in JSON output
 const common_1 = require("@nestjs/common");
 const permissions_config_provider_1 = require("./common/config/permissions.config.provider");
 const permissions_service_1 = require("./common/config/permissions.service");

package/dist/common/bigint-serializer.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=bigint-serializer.d.ts.map

package/dist/common/bigint-serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bigint-serializer.d.ts","sourceRoot":"","sources":["../../src/common/bigint-serializer.ts"],"names":[],"mappings":""}

package/dist/common/bigint-serializer.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * `JSON.stringify` throws on a `bigint` ("Do not know how to serialize a
+ * BigInt"), so any model with a Prisma `BigInt` column would 500 when a CRUD
+ * endpoint serialises the row. Teach BigInt to serialise as its decimal string
+ * in JSON output (HTTP responses, logs). Applied once, on import — imported for
+ * its side effect by the core module, so it is active in every AppX Core app.
+ *
+ * String output pairs with `@BigIntField()` on the input side, which accepts a
+ * string (or number) — so a BigInt round-trips as a string over HTTP.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+if (typeof BigInt.prototype.toJSON !== 'function') {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any, no-extend-native
+    BigInt.prototype.toJSON = function () {
+        return this.toString();
+    };
+}

package/dist/common/decorators/scalar-field.decorator.d.ts

@@ -0,0 +1,22 @@
+import { ValidatorConstraintInterface } from 'class-validator';
+export declare class IsDecimalInputConstraint implements ValidatorConstraintInterface {
+    validate(value: unknown): boolean;
+    defaultMessage(): string;
+}
+export declare class IsBigIntInputConstraint implements ValidatorConstraintInterface {
+    validate(value: unknown): boolean;
+    defaultMessage(): string;
+}
+/**
+ * Marks a DTO field as a Prisma `Decimal`: accepts a string or number on the
+ * wire and validates it (Prisma coerces it to `Prisma.Decimal` on write). Pair
+ * with `@IsOptional` for optional columns.
+ */
+export declare function DecimalField(): PropertyDecorator;
+/**
+ * Marks a DTO field as a Prisma `BigInt`: accepts a string or number on the wire,
+ * coerces it to `bigint`, and validates it. Pair with `@IsOptional` for optional
+ * columns.
+ */
+export declare function BigIntField(): PropertyDecorator;
+//# sourceMappingURL=scalar-field.decorator.d.ts.map

package/dist/common/decorators/scalar-field.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalar-field.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/scalar-field.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,4BAA4B,EAAC,MAAM,iBAAiB,CAAC;AAiD5F,qBACa,wBAAyB,YAAW,4BAA4B;IACzE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,cAAc,IAAI,MAAM;CAG3B;AAED,qBACa,uBAAwB,YAAW,4BAA4B;IACxE,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIjC,cAAc,IAAI,MAAM;CAG3B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,iBAAiB,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CAK/C"}

package/dist/common/decorators/scalar-field.decorator.js

@@ -0,0 +1,103 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BigIntField = exports.DecimalField = exports.IsBigIntInputConstraint = exports.IsDecimalInputConstraint = void 0;
+const common_1 = require("@nestjs/common");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * DTO field decorators for Prisma `Decimal` and `BigInt` columns.
+ *
+ * Generated CRUD DTOs must type these columns as `Prisma.Decimal` / `bigint`
+ * (the Prisma model types) so a controller override type-checks against
+ * `CoreController<T>`. But JSON can't carry them and class-transformer doesn't
+ * know how to build them. These decorators accept a **string or number** on the
+ * wire and validate it; a value that isn't numeric yields a clean `400`.
+ *
+ * - `@DecimalField()` validates the value and passes it through unchanged —
+ *   Prisma's create/update input accepts `string | number | Decimal` and coerces
+ *   it to a real `Prisma.Decimal` on write. (We deliberately do NOT construct a
+ *   `Prisma.Decimal` here: the framework's own bundled client is a stub, so a
+ *   `require('@prisma/client').Prisma.Decimal` isn't reliably available at the
+ *   framework's runtime location.)
+ * - `@BigIntField()` coerces to a real `bigint` (Prisma's BigInt input doesn't
+ *   accept a string); `BigInt()` is a global, so no client is involved.
+ */
+const isNullish = (v) => v === null || v === undefined;
+// A finite number, or a string that is a plain/scientific decimal literal.
+const DECIMAL_STRING = /^[+-]?(\d+(\.\d*)?|\.\d+)([eE][+-]?\d+)?$/;
+function isDecimalWire(v) {
+    if (typeof v === 'number')
+        return Number.isFinite(v);
+    if (typeof v === 'string') {
+        const s = v.trim();
+        return s !== '' && DECIMAL_STRING.test(s);
+    }
+    return false;
+}
+function toBigInt(value) {
+    if (isNullish(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map(toBigInt);
+    if (typeof value !== 'string' && typeof value !== 'number')
+        return value;
+    try {
+        return BigInt(value);
+    }
+    catch {
+        return value; // non-integer / garbage → validator produces a 400
+    }
+}
+// Constraints reject nullish so a missing REQUIRED column fails with a clean 400;
+// optional columns carry `@IsOptional`, which short-circuits before the
+// constraint runs, so null/undefined is still accepted there.
+let IsDecimalInputConstraint = exports.IsDecimalInputConstraint = class IsDecimalInputConstraint {
+    validate(value) {
+        if (Array.isArray(value))
+            return value.every(isDecimalWire);
+        return isDecimalWire(value);
+    }
+    defaultMessage() {
+        return '$property must be a decimal (a numeric string or number)';
+    }
+};
+exports.IsDecimalInputConstraint = IsDecimalInputConstraint = __decorate([
+    (0, class_validator_1.ValidatorConstraint)({ name: 'isDecimalInput', async: false })
+], IsDecimalInputConstraint);
+let IsBigIntInputConstraint = exports.IsBigIntInputConstraint = class IsBigIntInputConstraint {
+    validate(value) {
+        if (Array.isArray(value))
+            return value.every((v) => typeof v === 'bigint');
+        return typeof value === 'bigint';
+    }
+    defaultMessage() {
+        return '$property must be an integer (a numeric string or number)';
+    }
+};
+exports.IsBigIntInputConstraint = IsBigIntInputConstraint = __decorate([
+    (0, class_validator_1.ValidatorConstraint)({ name: 'isBigIntInput', async: false })
+], IsBigIntInputConstraint);
+/**
+ * Marks a DTO field as a Prisma `Decimal`: accepts a string or number on the
+ * wire and validates it (Prisma coerces it to `Prisma.Decimal` on write). Pair
+ * with `@IsOptional` for optional columns.
+ */
+function DecimalField() {
+    return (0, common_1.applyDecorators)((0, class_validator_1.Validate)(IsDecimalInputConstraint));
+}
+exports.DecimalField = DecimalField;
+/**
+ * Marks a DTO field as a Prisma `BigInt`: accepts a string or number on the wire,
+ * coerces it to `bigint`, and validates it. Pair with `@IsOptional` for optional
+ * columns.
+ */
+function BigIntField() {
+    return (0, common_1.applyDecorators)((0, class_transformer_1.Transform)(({ value }) => toBigInt(value)), (0, class_validator_1.Validate)(IsBigIntInputConstraint));
+}
+exports.BigIntField = BigIntField;

package/dist/config/generate-all.js

@@ -1,58 +1,25 @@
 #!/usr/bin/env node
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `appx generate` — the DEPLOY-SAFE pass.
+ *
+ * Regenerates only the overwrite-safe artifacts under the gitignored
+ * `src/generated/**`:
+ *   - the Prisma client and the prisma-nestjs-graphql outputs (`prisma generate`
+ *     runs both generator blocks), and
+ *   - the DTO base classes (`src/generated/dto/**`).
+ *
+ * It NEVER writes `src/modules/**` and NEVER edits `src/app.module.ts`, so it is
+ * safe to run in CI / postinstall / predeploy and re-run any number of times.
+ * Scaffolding CRUD modules (which mutates code) is the separate, interactive
+ * `appx generate models` wizard.
+ */
 const child_process_1 = require("child_process");
-const path = __importStar(require("path"));
-const scriptsDir = path.join(__dirname);
-console.log('Running Prisma Generate...');
-(0, child_process_1.execSync)(`prisma generate`, {
-    stdio: 'inherit',
-});
-console.log('Generating Modules...');
-(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-modules.js')}`, {
-    stdio: 'inherit',
-});
-console.log('Generating Resolvers...');
-(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-resolvers.js')}`, {
-    stdio: 'inherit',
-});
-console.log('Generating Services...');
-(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-services.js')}`, {
-    stdio: 'inherit',
-});
-console.log('Generating DTOs...');
-(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-dtos.js')}`, {
-    stdio: 'inherit',
-});
-console.log('Generating Controllers...');
-(0, child_process_1.execSync)(`node ${path.join(scriptsDir, 'generate-controllers.js')}`, {
-    stdio: 'inherit',
-});
-// console.log('Generating Session Schema...');
-// execSync(`node ${path.join(scriptsDir, 'generate-session-schema.js')}`, {
-//   stdio: 'inherit',
-// });
-console.log('All generators ran successfully.');
+const utils_1 = require("./utils");
+const generate_dtos_1 = require("./generate-dtos");
+console.log('Running Prisma Generate (client + GraphQL artifacts)...');
+(0, child_process_1.execSync)('prisma generate', { stdio: 'inherit' });
+console.log('Generating DTO base classes...');
+(0, generate_dtos_1.generateDtoBases)((0, utils_1.loadAllModels)());
+console.log('Deploy-safe generation complete — src/generated only, no code changes.');

package/dist/config/generate-controllers.d.ts

@@ -1,2 +1,3 @@
-export {};
+/** Scaffold the controller file for a single model (once; never overwritten). */
+export declare function scaffoldController(modelName: string): void;
 //# sourceMappingURL=generate-controllers.d.ts.map

package/dist/config/generate-controllers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-controllers.d.ts","sourceRoot":"","sources":["../../src/config/generate-controllers.ts"],"names":[],"mappings":""}
+{"version":3,"file":"generate-controllers.d.ts","sourceRoot":"","sources":["../../src/config/generate-controllers.ts"],"names":[],"mappings":"AA6CA,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI1D"}

package/dist/config/generate-controllers.js

@@ -23,10 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
+exports.scaffoldController = void 0;
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
-const modelsPath = path.join(process.cwd(), 'src/generated');
 const modulesOutputPath = path.join(process.cwd(), 'src/modules');
 /**
  * Generic controller template for a given model
@@ -67,24 +66,10 @@ export class ${model}Controller extends CoreController<${model}> {
   }
 }
 `;
-/**
- * Generate controllers for each model
- */
-fs.readdirSync(modelsPath).forEach((folder) => {
-    if (utils_1.IGNORE_FOLDERS.includes(folder))
-        return;
-    const modelName = (0, utils_1.kebabToPascalCase)(folder); // Capitalize model name e.g., 'Comment', 'Post'
-    const modelOutputPath = path.join(modulesOutputPath, folder);
-    if (!fs.existsSync(modelOutputPath)) {
-        fs.mkdirSync(modelOutputPath, { recursive: true });
-        console.log(`Folder for model ${modelName} created.`);
-    }
-    else {
-        console.log(`Folder for model ${modelName} already exists, skipping creation.`);
-    }
-    /**
-     * Create the controller file
-     */
-    const controllerPath = path.join(modelOutputPath, `${folder}.controller.ts`);
+/** Scaffold the controller file for a single model (once; never overwritten). */
+function scaffoldController(modelName) {
+    const folder = (0, utils_1.modelFolder)(modelName);
+    const controllerPath = path.join(modulesOutputPath, folder, `${folder}.controller.ts`);
     (0, utils_1.createFileIfNotExists)(controllerPath, genericControllerTemplate(modelName, folder));
-});
+}
+exports.scaffoldController = scaffoldController;

package/dist/config/generate-dtos.d.ts

@@ -1,2 +1,15 @@
-export {};
+/**
+ * Deploy-safe pass: (re)generate the DTO **base** classes under the gitignored
+ * `src/generated/dto/`, one per non-framework model. Overwrite-only — never
+ * touches `src/modules/`. `allModels` is the full DMMF list (framework models
+ * included) so relation-nested-write members can resolve their target model;
+ * bases are only emitted for non-framework models.
+ */
+export declare function generateDtoBases(allModels: any[]): void;
+/**
+ * Wizard/scaffold pass: create the hand-owned DTO **subclass** files (create +
+ * update) for a single model under `src/modules/<model>/dto/`. Generated once,
+ * never overwritten — this is where the developer adds custom validation.
+ */
+export declare function scaffoldDtoSubclass(modelName: string): void;
 //# sourceMappingURL=generate-dtos.d.ts.map

package/dist/config/generate-dtos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":""}
+{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":"AA0UA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAiBvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAU3D"}