@appxdigital/appx-core 0.1.127 → 0.1.128-beta.1

package/CHANGELOG.md

@@ -14,6 +14,37 @@ This project follows the `MAJOR.MINOR.PATCH` scheme in `package.json`.
 
 ---
 
+## [0.1.128] — 2026-08-04
+
+Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
+
+### Added
+
+- **Namespaced read API.** Each exposed model gets one root query field (its camelCase name) with three operations: `find` (→ list), `get` (→ first match or null), `count` (→ Int). Example: `query { project { find(where:{…}){ id } get(where:{…}){ id } count } }`. Short names live on the per-model namespace, so they never collide, aliases work (`recent: find(...)`), and several models can be queried in one request.
+- **Opt-in per module — one line, no resolver file.** Expose a model by importing its generated resolver and adding it to `providers`: `import { <Model>Resolver } from '../../generated/<model>/graphql'; providers: [<Model>Service, <Model>Resolver]`. The generated module ships this commented, copy-paste-ready. `<Model>Resolver` (and the underlying `<Model>Graphql` bundle) live at `src/generated/<model>/graphql.ts`, emitted by the deploy-safe pass. Remove the line to un-expose.
+- **`/graphql` mounted by default** in new projects (Apollo; Sandbox on `GET /graphql`). The schema stays valid before any model opts in.
+- **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (`count` included — it's filtered to accessible rows), restricted fields (`@Role`) come back null at the top level and nested, and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
+- **Filter/sort limited to readable fields.** A client `where` / `orderBy` / `distinct` that references a field the caller's role can't read is **rejected** (`403`), recursing through relations and `AND`/`OR`/`NOT` — the input-side counterpart to output field omission, applied in `PrismaService` for every transport.
+
+### Changed / Removed
+
+- The old root-level `findAll<Model>s` / `findOne<Model>` / `findFirst<Model>` queries and the `GenericResolverFactory` export are **removed**, replaced by the generated per-model `<Model>Resolver` (built on the exported `CoreGraphqlResolver`).
+- `appx-core generate models` **no longer scaffolds a per-module `*.resolver.ts` file**; GraphQL is opt-in via the one-liner above.
+- **`@apollo/server` is now a declared peer dependency** (`GraphqlModule` mounts Apollo by default). A normal `npm install` pulls it — no manual install.
+
+### Migration
+
+> **Behaviour change — the GraphQL resolver API changed and per-module resolver files are no longer generated.** Only relevant if you use GraphQL.
+
+1. **Delete the generated `src/modules/<model>/<model>.resolver.ts` files** — they import the removed `GenericResolverFactory` and will not compile. Remove `<Model>Resolver` from each module's `providers`.
+2. Run **`appx-core generate`** to emit the new `src/generated/<model>/graphql.ts` bundles, then **`npm install`** (pulls the newly-declared `@apollo/server` peer that `GraphqlModule` needs).
+3. Add **`GraphqlModule`** to your `app.module` imports (new projects already have it): `import { GraphqlModule } from '@appxdigital/appx-core';`.
+4. **Expose each model** you want in GraphQL by adding one provider line to its module: import `<Model>Resolver` from `../../generated/<model>/graphql` and add it to `providers`. See [docs/graphql.md](./docs/graphql.md).
+5. **Update clients:** `findAllProjects(...)` → `project { find(...) }`, `findFirstProject` / `findOneProject` → `project { get(...) }`. Mutations remain REST-only.
+6. **If a client filtered or ordered by a field a role can't read, that now returns `403`** — move such queries to a role that may read the field, or don't reference it.
+
+---
+
 ## [0.1.127] — 2026-08-03
 
 ### Changed

package/README.md

@@ -81,7 +81,11 @@ AppX Core puts **security and data-access control first**, while keeping develop
   - JWT auth (recommended)
 - **Fast CRUD acceleration**
   - Generated modules, controllers, and services per model
-  - Standard REST CRUD endpoints
+  - Standard REST CRUD endpoints (the write surface)
+- **GraphQL read API — recommended for querying**
+  - Namespaced, **opt-in per model**: `model { find get count }`
+  - **Native pagination** (`take` / `skip` / `cursor`), nested relations, and several models per request — prefer it over the CRUD list endpoint for reads/filtering, and enable it on your main queryable models
+  - Same ABAC as REST (row / field / nested-record filtering; filter & sort limited to readable fields)
 - **Developer-friendly extension points**
   - Add custom endpoints with `@Permission(...)`
   - Use services for business logic, controllers as transport layer
@@ -614,7 +618,7 @@ Operational guidance:
 
 ### GraphQL status
 
-GraphQL is part of the direction, but is **not fully ready** in the current release. REST CRUD + AdminJS are the primary integration surfaces for now.
+GraphQL exposes a **read-only** API — `find` / `get` / `count`, namespaced per model and **opt-in per module** (one line) — that runs through the same ABAC proxy as REST: row filtering, field omission, nested-relation filtering, and filter/sort limited to fields the role can read all apply. It supports nested selections and native pagination (`take`/`skip`/`cursor`), so it's the recommended surface for querying/filtering/paginating reads. See **[docs/graphql.md](./docs/graphql.md)**. Not yet: mutations and full aggregates — REST CRUD + AdminJS remain the write surfaces.
 
 ---
 

package/dist/common/guards/user-population.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-population.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/user-population.guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,qBACa,mBAAoB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa;IAG3C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAyBjE"}
+{"version":3,"file":"user-population.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/user-population.guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAG9D,qBACa,mBAAoB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa;IAG3C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA4BjE"}

package/dist/common/guards/user-population.guard.js

@@ -14,6 +14,7 @@ const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
 const config_1 = require("@nestjs/config");
 const auth_service_1 = require("../../modules/auth/auth.service");
+const context_transformer_util_1 = require("../utils/context-transformer.util");
 let UserPopulationGuard = exports.UserPopulationGuard = class UserPopulationGuard {
     constructor(jwtService, authService, configService) {
         this.jwtService = jwtService;
@@ -21,7 +22,10 @@ let UserPopulationGuard = exports.UserPopulationGuard = class UserPopulationGuar
         this.configService = configService;
     }
     async canActivate(context) {
-        const request = context.switchToHttp().getRequest();
+        // Resolve the request across transports (HTTP and GraphQL) so JWT/session
+        // population also applies to GraphQL requests — otherwise a GraphQL query
+        // would reach the ABAC proxy with no user and be treated as a GUEST.
+        const { req: request } = (0, context_transformer_util_1.transformContext)(context);
         if (request.isAuthenticated && request.isAuthenticated()) {
             return true;
         }

package/dist/config/generate-all.js

@@ -17,9 +17,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const utils_1 = require("./utils");
 const generate_dtos_1 = require("./generate-dtos");
+const generate_graphql_1 = require("./generate-graphql");
 console.log('Running Prisma Generate (client + GraphQL artifacts)...');
 // Project-local prisma: the CLI is usually global, so PATH has no project .bin.
 (0, utils_1.runProjectBin)('prisma', 'generate');
+const allModels = (0, utils_1.loadAllModels)();
 console.log('Generating DTO base classes...');
-(0, generate_dtos_1.generateDtoBases)((0, utils_1.loadAllModels)());
+(0, generate_dtos_1.generateDtoBases)(allModels);
+console.log('Generating GraphQL bundles...');
+(0, generate_graphql_1.generateGraphqlBundles)(allModels);
 console.log('Deploy-safe generation complete — src/generated only, no code changes.');

package/dist/config/generate-graphql.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Emit the GraphQL bundle for every model. Part of the deploy-safe pass — it
+ * only writes under `src/generated/**`, overwriting each time so the bundle
+ * tracks the schema. Requires `prisma generate` (the GraphQL artifacts) to have
+ * run first; a model whose generated folder is missing is skipped with a note.
+ */
+export declare function generateGraphqlBundles(allModels: {
+    name: string;
+}[]): void;
+//# sourceMappingURL=generate-graphql.d.ts.map

package/dist/config/generate-graphql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE"}

package/dist/config/generate-graphql.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateGraphqlBundles = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const utils_1 = require("./utils");
+const generatedRoot = path.join(process.cwd(), 'src/generated');
+/**
+ * The per-model GraphQL bundle: re-exports the `prisma-nestjs-graphql` types
+ * `CoreGraphqlResolver` needs (model + find/get/count inputs), as one import.
+ *
+ * Emitted for every model into `src/generated/<folder>/graphql.ts` (gitignored,
+ * overwrite-safe) so opting a module into GraphQL is a single import + a single
+ * provider line — no hand-written resolver file:
+ *
+ *   import { <Model>Graphql } from '../../generated/<folder>/graphql';
+ *   providers: [<Model>Service, CoreGraphqlResolver(<Model>Graphql)]
+ */
+const bundleTemplate = (model, folder) => {
+    const camel = model.charAt(0).toLowerCase() + model.slice(1);
+    return `import { CoreGraphqlResolver, GraphqlModelBundle } from '@appxdigital/appx-core';
+import { ${model} } from './${folder}.model';
+import { FindMany${model}Args } from './find-many-${folder}.args';
+import { FindFirst${model}Args } from './find-first-${folder}.args';
+import { ${model}WhereInput } from './${folder}-where.input';
+
+export const ${model}Graphql: GraphqlModelBundle<${model}> = {
+  model: ${model},
+  name: '${camel}',
+  findManyArgs: FindMany${model}Args,
+  findFirstArgs: FindFirst${model}Args,
+  whereInput: ${model}WhereInput,
+};
+
+/**
+ * Ready-to-register read-only GraphQL resolver for ${model} (\`${camel} { find get count }\`).
+ * Add it to your ${model} module's \`providers\` to expose the model — no CoreGraphqlResolver
+ * import or resolver file needed:
+ *
+ *   import { ${model}Resolver } from '../../generated/${folder}/graphql';
+ *   providers: [${model}Service, ${model}Resolver]
+ */
+export const ${model}Resolver = CoreGraphqlResolver(${model}Graphql);
+`;
+};
+/**
+ * Emit the GraphQL bundle for every model. Part of the deploy-safe pass — it
+ * only writes under `src/generated/**`, overwriting each time so the bundle
+ * tracks the schema. Requires `prisma generate` (the GraphQL artifacts) to have
+ * run first; a model whose generated folder is missing is skipped with a note.
+ */
+function generateGraphqlBundles(allModels) {
+    for (const { name } of allModels) {
+        const folder = (0, utils_1.modelFolder)(name);
+        const dir = path.join(generatedRoot, folder);
+        if (!fs.existsSync(dir)) {
+            console.warn(`Skipping GraphQL bundle for ${name}: ${dir} not found (run prisma generate first).`);
+            continue;
+        }
+        fs.writeFileSync(path.join(dir, 'graphql.ts'), bundleTemplate(name, folder));
+    }
+}
+exports.generateGraphqlBundles = generateGraphqlBundles;

package/dist/config/generate-models.js

@@ -27,7 +27,6 @@ const generate_dtos_1 = require("./generate-dtos");
 const generate_modules_1 = require("./generate-modules");
 const generate_services_1 = require("./generate-services");
 const generate_controllers_1 = require("./generate-controllers");
-const generate_resolvers_1 = require("./generate-resolvers");
 // inquirer is ESM-only; this file compiles to CommonJS, where tsc would
 // down-level a normal `import('inquirer')` into `require()` (ERR_REQUIRE_ESM at
 // runtime). Wrapping in `new Function` keeps a genuine dynamic `import()` that
@@ -95,7 +94,6 @@ async function main() {
         (0, generate_modules_1.scaffoldModule)(name);
         (0, generate_services_1.scaffoldService)(name);
         (0, generate_controllers_1.scaffoldController)(name);
-        (0, generate_resolvers_1.scaffoldResolver)(name);
         (0, generate_dtos_1.scaffoldDtoSubclass)(name);
     }
     (0, generate_modules_1.registerModulesInAppModule)(selected);

package/dist/config/generate-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AA2BA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}
+{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AAmCA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}

package/dist/config/generate-modules.js

@@ -34,20 +34,28 @@ const appModulePath = path.join(process.cwd(), 'src/app.module.ts');
  * @param model
  * @param folder
  */
-const moduleTemplate = (model, folder) => `
+const moduleTemplate = (model, folder) => {
+    const camel = model.charAt(0).toLowerCase() + model.slice(1);
+    return `
 import { Module } from '@nestjs/common';
 import { PrismaModule } from '../../prisma/prisma.module';
 import { ${model}Controller } from './${folder}.controller';
 import { ${model}Service } from './${folder}.service';
-import { ${model}Resolver } from './${folder}.resolver';
+// To expose this model over GraphQL (read-only: \`${camel} { find get count }\`),
+// uncomment the import and the provider line below. See docs/graphql.md.
+// import { ${model}Resolver } from '../../generated/${folder}/graphql';
 
 @Module({
   imports: [PrismaModule],
   controllers: [${model}Controller],
-  providers: [${model}Service, ${model}Resolver],
+  providers: [
+    ${model}Service,
+    // ${model}Resolver,
+  ],
 })
 export class ${model}Module {}
 `;
+};
 /** Scaffold the module file for a single model (once; never overwritten). */
 function scaffoldModule(modelName) {
     const folder = (0, utils_1.modelFolder)(modelName);

package/dist/graphql/generic.resolver.d.ts

@@ -1,15 +1,51 @@
 import { Type } from '../common/types';
-import { GraphQLResolveInfo } from 'graphql';
-import { PrismaService } from '../prisma/prisma.service';
-export declare function GenericResolverFactory<ModelType, CreateInput, UpdateInput, WhereInput, WhereUniqueInput, FindManyArgsType, AggregateArgsType, AggregateOutputType, CreateManyArgsType, CreateManyInput>(model: string, returnType: Type<ModelType>, createInputType: Type<CreateInput>, updateInputType: Type<UpdateInput>, whereInputType: Type<WhereInput>, whereUniqueInputType: Type<WhereUniqueInput>, findManyArgsType: Type<FindManyArgsType>, aggregateArgsType: Type<AggregateArgsType>, aggregateOutputType: Type<AggregateOutputType>, createManyArgsType: Type<CreateManyArgsType>, createManyInputType: Type<CreateManyInput>, guardedMethods?: {
-    [key: string]: string[];
-}): {
-    new (prisma: PrismaService): {
-        readonly prisma: PrismaService;
-        findAll(args: FindManyArgsType, info: GraphQLResolveInfo): Promise<ModelType[]>;
-        findOne(where: WhereUniqueInput, info: GraphQLResolveInfo): Promise<ModelType>;
-        findFirst(args: FindManyArgsType, info: GraphQLResolveInfo): Promise<ModelType>;
-        aggregate(args: AggregateArgsType, info: GraphQLResolveInfo): Promise<AggregateOutputType>;
-    };
-};
+/**
+ * The generated `prisma-nestjs-graphql` types a model needs to expose its
+ * read API. Produced per model by the deploy-safe generator as
+ * `src/generated/<model>/graphql.ts` (see `generate-graphql.ts`).
+ */
+export interface GraphqlModelBundle<ModelType = any> {
+    /** The `@ObjectType()` model class (also used to derive the root field name). */
+    model: Type<ModelType>;
+    /** Root query field name. Defaults to camelCase(model name), e.g. `project`. */
+    name?: string;
+    /** `FindMany<Model>Args` — arguments for `find`. */
+    findManyArgs: Type<any>;
+    /** `FindFirst<Model>Args` — arguments for `get`. */
+    findFirstArgs: Type<any>;
+    /** `<Model>WhereInput` — the `where` argument for `count`. */
+    whereInput: Type<any>;
+}
+/**
+ * Build a **namespaced, read-only** GraphQL resolver for one model.
+ *
+ * Every model contributes a single root query field (its camelCase name) that
+ * returns a per-model namespace type exposing three operations:
+ *
+ *   query {
+ *     project {                         # one root field per model — collision-free
+ *       find(where, orderBy, take, …)   # → [Project]   (Prisma findMany)
+ *       get(where, …)                   # → Project|null (Prisma findFirst)
+ *       count(where)                    # → Int          (Prisma count)
+ *     }
+ *   }
+ *
+ * Because the operation names (`find`/`get`/`count`) live on the namespace type
+ * rather than the root, they repeat freely across models and aliases work as
+ * expected (`recent: find(...)`, plus multiple models in one request).
+ *
+ * Every operation routes through `PrismaService.getModelDelegate`, so the exact
+ * same ABAC applies as for REST: row-level filtering, field omission (`@Role`),
+ * and nested-relation filtering. `PrismaSelect` turns the GraphQL selection set
+ * (including nested relations/children) into a Prisma `select`, so a single
+ * query resolves relations in one authorized round-trip.
+ *
+ * Returned value is a NestJS provider — add it to a module's `providers` to
+ * opt that model into GraphQL:
+ *
+ *   import { CoreGraphqlResolver } from '@appxdigital/appx-core';
+ *   import { ProjectGraphql } from '../../generated/project/graphql';
+ *   providers: [ProjectService, CoreGraphqlResolver(ProjectGraphql)]
+ */
+export declare function CoreGraphqlResolver<ModelType>(bundle: GraphqlModelBundle<ModelType>): Type<any>;
 //# sourceMappingURL=generic.resolver.d.ts.map

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAErC,OAAO,EAAC,kBAAkB,EAAC,MAAM,SAAS,CAAC;AAE3C,OAAO,EAAC,aAAa,EAAC,MAAM,0BAA0B,CAAC;AAEvD,wBAAgB,sBAAsB,CAAC,SAAS,EAC5C,WAAW,EACX,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAEf,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAC3B,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAClC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAClC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,EAChC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,EACxC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAC1C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAC9C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAC5C,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC,EAC1C,cAAc,CAAC,EAAE;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAC;iBAIF,aAAa;yBAAb,aAAa;sBAWnC,gBAAgB,QACZ,kBAAkB,GACjC,QAAQ,SAAS,EAAE,CAAC;uBAcR,gBAAgB,QACb,kBAAkB,GACjC,QAAQ,SAAS,CAAC;wBAcP,gBAAgB,QACZ,kBAAkB,GACjC,QAAQ,SAAS,CAAC;wBAcP,iBAAiB,QACb,kBAAkB,GACjC,QAAQ,mBAAmB,CAAC;;EA0ItC"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAKrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CA+C/F"}

package/dist/graphql/generic.resolver.js

@@ -12,97 +12,105 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GenericResolverFactory = void 0;
+exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
 const plugins_1 = require("@paljs/plugins");
-const guard_decorator_1 = require("../common/decorators/guard.decorator");
 const prisma_service_1 = require("../prisma/prisma.service");
-function GenericResolverFactory(model, returnType, createInputType, updateInputType, whereInputType, whereUniqueInputType, findManyArgsType, aggregateArgsType, aggregateOutputType, createManyArgsType, createManyInputType, guardedMethods) {
-    var GenericResolverClass_1;
-    let GenericResolverClass = GenericResolverClass_1 = class GenericResolverClass {
+/**
+ * Build a **namespaced, read-only** GraphQL resolver for one model.
+ *
+ * Every model contributes a single root query field (its camelCase name) that
+ * returns a per-model namespace type exposing three operations:
+ *
+ *   query {
+ *     project {                         # one root field per model — collision-free
+ *       find(where, orderBy, take, …)   # → [Project]   (Prisma findMany)
+ *       get(where, …)                   # → Project|null (Prisma findFirst)
+ *       count(where)                    # → Int          (Prisma count)
+ *     }
+ *   }
+ *
+ * Because the operation names (`find`/`get`/`count`) live on the namespace type
+ * rather than the root, they repeat freely across models and aliases work as
+ * expected (`recent: find(...)`, plus multiple models in one request).
+ *
+ * Every operation routes through `PrismaService.getModelDelegate`, so the exact
+ * same ABAC applies as for REST: row-level filtering, field omission (`@Role`),
+ * and nested-relation filtering. `PrismaSelect` turns the GraphQL selection set
+ * (including nested relations/children) into a Prisma `select`, so a single
+ * query resolves relations in one authorized round-trip.
+ *
+ * Returned value is a NestJS provider — add it to a module's `providers` to
+ * opt that model into GraphQL:
+ *
+ *   import { CoreGraphqlResolver } from '@appxdigital/appx-core';
+ *   import { ProjectGraphql } from '../../generated/project/graphql';
+ *   providers: [ProjectService, CoreGraphqlResolver(ProjectGraphql)]
+ */
+function CoreGraphqlResolver(bundle) {
+    const { model, findManyArgs, findFirstArgs, whereInput } = bundle;
+    const modelName = model.name; // Pascal, e.g. 'Project'
+    const rootName = bundle.name ?? modelName.charAt(0).toLowerCase() + modelName.slice(1);
+    let ModelQueries = class ModelQueries {
+    };
+    ModelQueries = __decorate([
+        (0, graphql_1.ObjectType)(`${modelName}Queries`)
+    ], ModelQueries);
+    let ModelQueriesResolver = class ModelQueriesResolver {
         constructor(prisma) {
             this.prisma = prisma;
-            if (guardedMethods) {
-                (0, guard_decorator_1.applyMethodGuards)(GenericResolverClass_1, guardedMethods);
-            }
         }
-        async findAll(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
-            const modelDelegate = this.prisma.getModelDelegate(model);
-            return await modelDelegate.findMany({
-                ...args,
-                ...select,
-            });
+        // The root field. Returns an empty object; the operations below are
+        // resolved lazily as fields of the namespace, so `project { count }`
+        // never runs `find`/`get`.
+        namespace() {
+            return {};
         }
-        async findOne(where, info) {
+        async find(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            const modelDelegate = this.prisma.getModelDelegate(model);
-            return modelDelegate.findFirst({
-                where,
-                ...select,
-            });
+            return this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select });
         }
-        async findFirst(args, info) {
+        async get(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            const modelDelegate = this.prisma.getModelDelegate(model);
-            return modelDelegate.findFirst({
-                ...args,
-                ...select,
-            });
+            return this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select });
         }
-        async aggregate(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
-            const modelDelegate = this.prisma.getModelDelegate(model);
-            return modelDelegate.aggregate({
-                ...args,
-                ...select,
-            });
+        async count(where) {
+            return this.prisma.getModelDelegate(modelName).count({ where });
         }
     };
     __decorate([
-        (0, graphql_1.Query)(() => [returnType], {
-            name: `findAll${model.charAt(0).toUpperCase() + model.slice(1)}s`,
-        }),
-        __param(0, (0, graphql_1.Args)({ type: () => findManyArgsType, nullable: true })),
-        __param(1, (0, graphql_1.Info)()),
+        (0, graphql_1.Query)(() => ModelQueries, { name: rootName }),
         __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object]),
-        __metadata("design:returntype", Promise)
-    ], GenericResolverClass.prototype, "findAll", null);
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", ModelQueries)
+    ], ModelQueriesResolver.prototype, "namespace", null);
     __decorate([
-        (0, graphql_1.Query)(() => returnType, {
-            name: `findOne${model.charAt(0).toUpperCase() + model.slice(1)}`,
-        }),
-        __param(0, (0, graphql_1.Args)('where', { type: () => whereUniqueInputType, nullable: false })),
+        (0, graphql_1.ResolveField)(() => [model], { name: 'find' }),
+        __param(0, (0, graphql_1.Args)({ type: () => findManyArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", [Object, Object]),
         __metadata("design:returntype", Promise)
-    ], GenericResolverClass.prototype, "findOne", null);
+    ], ModelQueriesResolver.prototype, "find", null);
     __decorate([
-        (0, graphql_1.Query)(() => returnType, {
-            name: `findFirst${model.charAt(0).toUpperCase() + model.slice(1)}`,
-        }),
-        __param(0, (0, graphql_1.Args)({ type: () => findManyArgsType, nullable: true })),
+        (0, graphql_1.ResolveField)(() => model, { name: 'get', nullable: true }),
+        __param(0, (0, graphql_1.Args)({ type: () => findFirstArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", [Object, Object]),
         __metadata("design:returntype", Promise)
-    ], GenericResolverClass.prototype, "findFirst", null);
+    ], ModelQueriesResolver.prototype, "get", null);
     __decorate([
-        (0, graphql_1.Query)(() => aggregateOutputType, {
-            name: `aggregate${model.charAt(0).toUpperCase() + model.slice(1)}`,
-        }),
-        __param(0, (0, graphql_1.Args)({ type: () => aggregateArgsType, nullable: true })),
-        __param(1, (0, graphql_1.Info)()),
+        (0, graphql_1.ResolveField)(() => graphql_1.Int, { name: 'count' }),
+        __param(0, (0, graphql_1.Args)('where', { type: () => whereInput, nullable: true })),
         __metadata("design:type", Function),
-        __metadata("design:paramtypes", [Object, Object]),
+        __metadata("design:paramtypes", [Object]),
         __metadata("design:returntype", Promise)
-    ], GenericResolverClass.prototype, "aggregate", null);
-    GenericResolverClass = GenericResolverClass_1 = __decorate([
-        (0, graphql_1.Resolver)({ isAbstract: true }),
+    ], ModelQueriesResolver.prototype, "count", null);
+    ModelQueriesResolver = __decorate([
+        (0, graphql_1.Resolver)(() => ModelQueries),
         __metadata("design:paramtypes", [prisma_service_1.PrismaService])
-    ], GenericResolverClass);
-    return GenericResolverClass;
+    ], ModelQueriesResolver);
+    return ModelQueriesResolver;
 }
-exports.GenericResolverFactory = GenericResolverFactory;
+exports.CoreGraphqlResolver = CoreGraphqlResolver;

package/dist/graphql/graphql.module.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Always-present root query. GraphQL requires a non-empty `Query` type, but a
+ * project may register `GraphqlModule` before any model has opted in (models
+ * opt in per-module via `CoreGraphqlResolver`). This trivial field keeps the
+ * schema valid in that state so `/graphql` is live from the start.
+ */
+export declare class AppxCoreRootResolver {
+    appxCore(): string;
+}
 export declare class GraphqlModule {
 }
 //# sourceMappingURL=graphql.module.d.ts.map

package/dist/graphql/graphql.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAMA,qBAUa,aAAa;CAAG"}
+{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAca,aAAa;CAAG"}

package/dist/graphql/graphql.module.js

@@ -5,12 +5,37 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GraphqlModule = void 0;
+exports.GraphqlModule = exports.AppxCoreRootResolver = void 0;
 const common_1 = require("@nestjs/common");
 const graphql_1 = require("@nestjs/graphql");
-const path_1 = require("path");
 const apollo_1 = require("@nestjs/apollo");
+/**
+ * Always-present root query. GraphQL requires a non-empty `Query` type, but a
+ * project may register `GraphqlModule` before any model has opted in (models
+ * opt in per-module via `CoreGraphqlResolver`). This trivial field keeps the
+ * schema valid in that state so `/graphql` is live from the start.
+ */
+let AppxCoreRootResolver = exports.AppxCoreRootResolver = class AppxCoreRootResolver {
+    appxCore() {
+        return '@appxdigital/appx-core';
+    }
+};
+__decorate([
+    (0, graphql_1.Query)(() => String, {
+        name: '_appxCore',
+        description: 'Liveness field. Ensures a valid GraphQL schema even before any model opts in.',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", String)
+], AppxCoreRootResolver.prototype, "appxCore", null);
+exports.AppxCoreRootResolver = AppxCoreRootResolver = __decorate([
+    (0, graphql_1.Resolver)()
+], AppxCoreRootResolver);
 let GraphqlModule = exports.GraphqlModule = class GraphqlModule {
 };
 exports.GraphqlModule = GraphqlModule = __decorate([
@@ -19,9 +44,13 @@ exports.GraphqlModule = GraphqlModule = __decorate([
             graphql_1.GraphQLModule.forRoot({
                 driver: apollo_1.ApolloDriver,
                 context: ({ req, res }) => ({ req, res }),
-                autoSchemaFile: (0, path_1.join)(process.cwd(), 'src/generated/schema.gql'),
+                // Build the schema in memory (code-first). Nothing consumes the SDL
+                // file, and an in-memory schema avoids depending on a writable
+                // `src/generated/` path at boot (CI, read-only deploys, tests).
+                autoSchemaFile: true,
                 sortSchema: true,
             }),
         ],
+        providers: [AppxCoreRootResolver],
     })
 ], GraphqlModule);

package/dist/prisma/prisma.service.d.ts

@@ -102,6 +102,18 @@ export declare class PrismaService {
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    private assertFilterFieldsReadable;
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    private assertClauseFieldsReadable;
+    private throwUnreadableFilterField;
     private applyWhereConditions;
     /**
      * Enforces permission `conditions` on `create` / `createMany`.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAkFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IA0ClC,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -136,6 +136,11 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                             await this.enforceNestedWrites(String(propKey), params.data, user, userRole);
                                         }
                                         else {
+                                            // Reject a client where/orderBy/distinct that references a
+                                            // field this role can't read (input counterpart to output
+                                            // field omission). Runs on the client input, BEFORE the
+                                            // trusted ABAC conditions are injected below.
+                                            this.assertFilterFieldsReadable(String(propKey), userRole, params);
                                             params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
                                             // An update can re-point a foreign key (scalar column);
                                             // authorize those changes with the same connect rules as create.
@@ -342,6 +347,70 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    assertFilterFieldsReadable(modelName, userRole, args) {
+        if (!args || typeof args !== 'object')
+            return;
+        if (args.where)
+            this.assertClauseFieldsReadable(modelName, userRole, args.where, 'where');
+        if (args.orderBy)
+            this.assertClauseFieldsReadable(modelName, userRole, args.orderBy, 'orderBy');
+        if (args.distinct) {
+            const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+            for (const field of [].concat(args.distinct)) {
+                if (omit.has(field))
+                    this.throwUnreadableFilterField(modelName, field, userRole, 'distinct');
+            }
+        }
+    }
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    assertClauseFieldsReadable(modelName, userRole, clause, kind) {
+        if (Array.isArray(clause)) {
+            for (const c of clause)
+                this.assertClauseFieldsReadable(modelName, userRole, c, kind);
+            return;
+        }
+        if (!clause || typeof clause !== 'object')
+            return;
+        const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+        for (const key of Object.keys(clause)) {
+            const value = clause[key];
+            // Logical grouping — recurse on the same model.
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                this.assertClauseFieldsReadable(modelName, userRole, value, kind);
+                continue;
+            }
+            // Direct reference to a field the role can't read.
+            if (omit.has(key)) {
+                this.throwUnreadableFilterField(modelName, key, userRole, kind);
+            }
+            // Relation — recurse into the related model (unwrapping list/one filters).
+            const relation = this.getRelation(modelName, key);
+            if (relation) {
+                const wrappers = ['some', 'every', 'none', 'is', 'isNot'];
+                const wrapped = value && typeof value === 'object' ? wrappers.filter((w) => w in value) : [];
+                if (wrapped.length) {
+                    for (const w of wrapped)
+                        this.assertClauseFieldsReadable(relation.model, userRole, value[w], kind);
+                }
+                else {
+                    this.assertClauseFieldsReadable(relation.model, userRole, value, kind);
+                }
+            }
+            // Otherwise: a readable scalar field. Its value is an operator object
+            // (where) or 'asc'/'desc' (orderBy) — not a field map, so no recursion.
+        }
+    }
+    throwUnreadableFilterField(modelName, field, userRole, kind) {
+        throw new common_1.HttpException(`Cannot ${kind === 'orderBy' ? 'order by' : 'filter by'} '${modelName}.${field}' — not readable by role ${userRole}.`, common_1.HttpStatus.FORBIDDEN);
+    }
     applyWhereConditions(modelName, userRole, args, user, action) {
         if (!args) {
             args = {};

package/docs/graphql.md

@@ -1,72 +1,134 @@
 # GraphQL (read API)
 
-AppX Core can expose a **read-only GraphQL API** generated from your Prisma schema. Queries run through the same ABAC proxy as REST, so row-level filtering and field omission apply automatically.
+AppX Core exposes a **read-only GraphQL API** generated from your Prisma schema. Every query runs through the same ABAC proxy as REST, so row-level filtering, field omission, and nested-relation filtering all apply automatically — a caller only ever receives rows and fields their role is permitted to read.
 
-> **Scope:** only **read** queries are available today — `findAll<Model>s`, `findOne<Model>`, `findFirst<Model>`. Writes (create/update/delete mutations) are **not available yet**; see [limitations.md](./limitations.md). Use the REST CRUD endpoints for writes.
+> **Scope:** **read only** — `find`, `get`, `count`. Writes (create/update/delete) are **not** exposed; use the REST CRUD endpoints. See [limitations.md](./limitations.md).
+
+> **Recommended for reads.** For querying, filtering, and **pagination** (native `take` / `skip` / `cursor`) prefer GraphQL over the generated CRUD list endpoint — one request can select several models, alias repeated queries, and pull nested relations in a single round-trip. Enable it on your main queryable models (one line per module, below); keep REST for writes.
 
 ---
 
-## Queries
+## The endpoint
+
+The GraphQL server is mounted at **`POST /graphql`** (Apollo; open `GET /graphql` in a browser for the Apollo Sandbox). New projects (`appx-core create`) get it wired in `app.module` by default. To add it to an existing project, register the module once:
+
+```ts
+import { GraphqlModule } from '@appxdigital/appx-core';
+
+@Module({ imports: [ /* … */ GraphqlModule ] })
+export class AppModule {}
+```
+
+The server is always valid even before any model is exposed (it ships a trivial `_appxCore` root field), so `/graphql` is live from the start.
 
-For each model, the generated schema provides:
+---
 
-| Query | Returns |
-|---|---|
-| `findAll<Model>s(...)` | a list |
-| `findFirst<Model>(...)` | the first match, or `null` |
-| `findOne<Model>(where: {...})` | a single record, or `null` |
+## Exposing a model (opt-in, per module — one line)
+
+GraphQL is **off per model** until you opt in. Every generated module ships a commented, copy-paste-ready opt-in; enabling a model is one import + one provider line, with **no resolver file to write or maintain**:
+
+```ts
+import { Module } from '@nestjs/common';
+import { PrismaModule } from '../../prisma/prisma.module';
+import { AlbumController } from './album.controller';
+import { AlbumService } from './album.service';
+import { AlbumResolver } from '../../generated/album/graphql';   // generated by `appx-core generate`
+
+@Module({
+  imports: [PrismaModule],
+  controllers: [AlbumController],
+  providers: [
+    AlbumService,
+    AlbumResolver,   // ← add = exposed; remove = not exposed
+  ],
+})
+export class AlbumModule {}
+```
+
+`AlbumResolver` is a ready-to-register resolver class emitted by the deploy-safe pass (`appx-core generate`) at `src/generated/album/graphql.ts` — regenerated from the schema, never hand-edited. (The same file exports the underlying `AlbumGraphql` bundle if you'd rather build the resolver yourself via the exported `CoreGraphqlResolver`.)
+
+---
+
+## Queries — `find` / `get` / `count`
+
+Each exposed model contributes **one root field** (its camelCase name) whose fields are the three read operations. Naming is uniform across every model, so it's predictable:
+
+| Field | Prisma | Returns |
+|---|---|---|
+| `find(where, orderBy, take, skip, …)` | `findMany` | a list |
+| `get(where, …)` | `findFirst` | a single record, or `null` |
+| `count(where)` | `count` | `Int` |
 
 ```graphql
 query {
-  findAllProjects(where: { status: "active" }) {
-    id
-    name
+  album {
+    find(where: { year: { equals: 2024 } }, take: 20) { id title }
+    get(where: { id: { equals: 1 } }) { id title }
+    count(where: { year: { equals: 2024 } })
   }
 }
 ```
 
-These route through `PrismaService`, so the caller's role and the rules in `permissions.config.ts` are enforced exactly as they are for REST reads (see [permissions.md](./permissions.md) and [data-access.md](./data-access.md)). A user only ever receives rows and fields their role is permitted to read.
+Because `find`/`get`/`count` live on the per-model namespace (not the root), the names repeat freely across models and never collide.
 
----
+### Multiple things in one request + aliases
 
-## Nested queries
+A single query can select many models at once, and aliases let you repeat an operation with different arguments — all in one round-trip:
 
-You can select related models inline, to any depth:
+```graphql
+query {
+  album {
+    recent:  find(where: { year: { equals: 2024 } }) { id title }
+    classics: find(where: { year: { lt: 1990 } })     { id title }
+    total:   count
+  }
+  artist { get(where: { id: { equals: 7 } }) { name } }
+}
+```
+
+Each selected field resolves independently through the proxy (its own authorized query), so multiplexing never weakens enforcement. `count` is filtered too — it counts only the rows the caller may read, never the table total.
+
+### Nested relations & children
+
+Select related models inline, to any depth. The GraphQL selection is compiled into a single Prisma `select`, so relations come back in the same authorized query (no N+1):
 
 ```graphql
 query {
-  findAllProjects {
-    id
-    name
-    tasks {
+  album {
+    find {
       title
-      assignee {
-        name
-      }
+      tracks { title }              # to-many child
+      artist { name }               # to-one relation
     }
   }
 }
 ```
 
-Nested selections are **ABAC-filtered** just like the top level.
+---
+
+## What the caller can and cannot see (ABAC)
 
-> **Caveat — inaccessible nested data comes back empty, not as an error.** If the current user isn't allowed to read a related record, it is simply filtered out:
-> - a **to-many** relation (`tasks`, `members`, …) returns an **empty list** for the parts the user can't see;
-> - an **inaccessible to-one** relation causes the **parent row to be omitted** from the result (you can't see a row whose related record you aren't allowed to read).
->
-> No exception is thrown — the data you're not entitled to just isn't there. Design your queries and UI to treat "empty" as "not visible to you", not "does not exist".
+All three operations route through `PrismaService.getModelDelegate`, so the rules in `permissions.config.ts` apply exactly as they do for REST reads (see [permissions.md](./permissions.md)). Concretely:
 
----
+- **Unauthorized rows are not returned.** `find` returns only rows the role may read; `get` returns `null` for a row the caller can't access even if asked for by unique field; `count` counts only accessible rows.
+- **Restricted fields are omitted.** A column the role can't read (`/// @Role(...)`) comes back **`null`** even though the GraphQL type exposes it — at the top level *and* nested. (`prisma-nestjs-graphql` types every scalar; the proxy is what strips the values.)
+- **Inaccessible nested records are filtered.** If a nested relation points at a record the caller can't read, that relation is filtered out — a to-many yields only the visible rows; an inaccessible to-one drops the parent row. You can hold access to a record while a record it links to is withheld.
+- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either.
+- **Anonymous callers are `GUEST`.** With no valid `Authorization: Bearer <jwt>` (or session), the request is a GUEST; a model with no GUEST rule is denied.
 
-## Field-level visibility
+> Because relation records and fields are filtered by ABAC, "empty / null" means "not visible to you", not "does not exist". Design queries and UI accordingly.
 
-Columns annotated `/// @Role(...)` follow the same rules as everywhere else: a role that can't read a field won't receive it in the GraphQL response, at the top level and nested. See [permissions.md](./permissions.md#field-level-control).
+Always let the generated resolver serve the data — a custom resolver that reaches the **raw** Prisma client bypasses ABAC.
 
 ---
 
 ## Not available yet
 
 - **Mutations** (create/update/delete) — use REST.
-- **`aggregate`** — not ready; see [limitations.md](./limitations.md).
+- **Full `aggregate`** (sum/avg/min/max/groupBy) — only `count` is exposed today.
+
+---
+
+## After changing the schema
 
-Always let the generated resolvers (which go through `PrismaService`) serve the data — a custom resolver that reaches the raw Prisma client would not get ABAC.
+Re-run `appx-core generate`. It refreshes the Prisma client, GraphQL types, DTO bases, and the per-model `graphql.ts` bundles under `src/generated/**`. Your module opt-in lines are untouched.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.127",
+    "version": "0.1.128-beta.1",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -59,6 +59,7 @@
         "@adminjs/nestjs": "~7.0.0",
         "@adminjs/passwords": "~4.0.0",
         "@adminjs/prisma": "~5.0.4",
+        "@apollo/server": "^4.11.3",
         "@as-integrations/express5": "~1.1.2",
         "@aws-sdk/client-s3": "~3.850.0",
         "@aws-sdk/s3-request-presigner": "~3.850.0",

package/dist/config/generate-resolvers.d.ts

@@ -1,8 +0,0 @@
-/**
- * Scaffold the (read-only) GraphQL resolver file for a single model (once;
- * never overwritten). Imports the prisma-nestjs-graphql artifacts under
- * `src/generated/<folder>/`, so the deploy-safe pass (`prisma generate`) must
- * have produced them first.
- */
-export declare function scaffoldResolver(modelName: string): void;
-//# sourceMappingURL=generate-resolvers.d.ts.map

package/dist/config/generate-resolvers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-resolvers.d.ts","sourceRoot":"","sources":["../../src/config/generate-resolvers.ts"],"names":[],"mappings":"AA8CA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAIxD"}

package/dist/config/generate-resolvers.js

@@ -1,80 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.scaffoldResolver = void 0;
-const path = __importStar(require("path"));
-const utils_1 = require("./utils");
-const outputPath = path.join(process.cwd(), 'src/modules');
-/**
- * Generic resolver template for a given model
- * @param model
- * @param folder
- */
-const genericResolverTemplate = (model, folder) => `import { Resolver } from '@nestjs/graphql';
-import { GenericResolverFactory, PrismaService } from '@appxdigital/appx-core';
-import { ${model} } from '../../generated/${folder}/${folder}.model';
-import { ${model}CreateInput } from '../../generated/${folder}/${folder}-create.input';
-import { ${model}UpdateInput } from '../../generated/${folder}/${folder}-update.input';
-import { ${model}WhereInput } from '../../generated/${folder}/${folder}-where.input';
-import { ${model}WhereUniqueInput } from '../../generated/${folder}/${folder}-where-unique.input';
-import { FindMany${model}Args } from '../../generated/${folder}/find-many-${folder}.args';
-import { ${model}AggregateArgs } from '../../generated/${folder}/${folder}-aggregate.args';
-import { Aggregate${model} } from '../../generated/${folder}/aggregate-${folder}.output';
-import { CreateMany${model}Args } from '../../generated/${folder}/create-many-${folder}.args';
-import { ${model}CreateManyInput } from '../../generated/${folder}/${folder}-create-many.input';
-
-const ${model}GenericResolver = GenericResolverFactory(
-  '${model}',
-  ${model},
-  ${model}CreateInput,
-  ${model}UpdateInput,
-  ${model}WhereInput,
-  ${model}WhereUniqueInput,
-  FindMany${model}Args,
-  ${model}AggregateArgs,
-  Aggregate${model},
-  CreateMany${model}Args,
-  ${model}CreateManyInput,
-);
-
-@Resolver(() => ${model})
-export class ${model}Resolver extends ${model}GenericResolver {
-  constructor(prisma: PrismaService) {
-    super(prisma);
-  }
-}
-`;
-/**
- * Scaffold the (read-only) GraphQL resolver file for a single model (once;
- * never overwritten). Imports the prisma-nestjs-graphql artifacts under
- * `src/generated/<folder>/`, so the deploy-safe pass (`prisma generate`) must
- * have produced them first.
- */
-function scaffoldResolver(modelName) {
-    const folder = (0, utils_1.modelFolder)(modelName);
-    const resolverPath = path.join(outputPath, folder, `${folder}.resolver.ts`);
-    (0, utils_1.createFileIfNotExists)(resolverPath, genericResolverTemplate(modelName, folder));
-}
-exports.scaffoldResolver = scaffoldResolver;