@appxdigital/appx-core 0.1.128-beta.0 → 0.1.128-beta.2

package/CHANGELOG.md

@@ -21,26 +21,35 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 ### Added
 
 - **Namespaced read API.** Each exposed model gets one root query field (its camelCase name) with three operations: `find` (→ list), `get` (→ first match or null), `count` (→ Int). Example: `query { project { find(where:{…}){ id } get(where:{…}){ id } count } }`. Short names live on the per-model namespace, so they never collide, aliases work (`recent: find(...)`), and several models can be queried in one request.
-- **Opt-in per module — one line, no resolver file.** Expose a model by adding `CoreGraphqlResolver(<Model>Graphql)` to its module `providers` (the generated module ships this commented, copy-paste-ready). `<Model>Graphql` is a generated bundle at `src/generated/<model>/graphql.ts` (deploy-safe pass). Remove the line to un-expose.
+- **Opt-in per module — one line, no resolver file.** Expose a model by importing its generated resolver and adding it to `providers`: `import { <Model>Resolver } from '../../generated/<model>/graphql'; providers: [<Model>Service, <Model>Resolver]`. The generated module ships this commented, copy-paste-ready. `<Model>Resolver` (and the underlying `<Model>Graphql` bundle) live at `src/generated/<model>/graphql.ts`, emitted by the deploy-safe pass. Remove the line to un-expose.
 - **`/graphql` mounted by default** in new projects (Apollo; Sandbox on `GET /graphql`). The schema stays valid before any model opts in.
-- **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (incl. `count`, which is filtered — no total leak), restricted fields come back null at top level and nested (`@Role`), and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
+- **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (`count` included — it's filtered to accessible rows), restricted fields (`@Role`) come back null at the top level and nested, and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
+- **Filter/sort limited to readable fields.** A client `where` / `orderBy` / `distinct` that references a field the caller's role can't read is **rejected** (`403`), recursing through relations and `AND`/`OR`/`NOT` — the input-side counterpart to output field omission, applied in `PrismaService` for **every transport (REST and GraphQL)**. Exception: a **presence/nullness** check on a hidden field — `{ field: null }`, `{ not: null }`, `{ NOT: { field: null } }` — is **allowed**, since it reveals only whether a value is set, not the value (the `hasX` / `isDeleted` pattern, without `BYPASS_OMISSION`). Value-bearing operators (`equals: "x"`, `not: "x"`, `contains`, `gt`, …) stay rejected.
+- **Slimmer generated output.** The deploy-safe pass now prunes the `prisma-nestjs-graphql` types the read-only API never imports (create/update/upsert/delete/aggregate/groupBy inputs), keeping only the model + `find`/`where`/`orderBy` read types reachable from the generated resolvers — roughly **80% fewer files** under `src/generated/`, so `tsc` and your editor do far less work. The DTO tree (`src/generated/dto/`) is untouched.
+- **Nested selection is to-one only.** Generated GraphQL model types expose scalars, **to-one** relations, and `_count`; **to-many relations are not nested-selectable** (nested lists have no pagination, so they could return unbounded rows). Fetch a list at the top level with pagination — `track { find(where: { albumId … }, take, skip) }`. Filtering by a to-many relation in `where` (`some`/`every`/`none`) and `_count { … }` still work.
+- **Self-documenting operations.** `find` / `get` / `count` and their `where` arg carry GraphQL descriptions (visible in the Apollo Sandbox); model-field descriptions come from Prisma `///` doc comments as before. See [docs/graphql.md](./docs/graphql.md) for the full `where`/`orderBy`/pagination reference.
+- **Malformed filter values return `400`, not `500`.** A `where`/`orderBy` value Prisma can't parse (e.g. `createdAt: { gt: 2024 }` — a number where a date is expected) now surfaces a clean `400`, instead of an internal error that leaked the raw Prisma invocation.
 
 ### Changed / Removed
 
-- The old root-level `findAll<Model>s` / `findOne<Model>` / `findFirst<Model>` queries and the `GenericResolverFactory` export are **removed**, replaced by `CoreGraphqlResolver`.
+- The old root-level `findAll<Model>s` / `findOne<Model>` / `findFirst<Model>` queries and the `GenericResolverFactory` export are **removed**, replaced by the generated per-model `<Model>Resolver` (built on the exported `CoreGraphqlResolver`).
 - `appx-core generate models` **no longer scaffolds a per-module `*.resolver.ts` file**; GraphQL is opt-in via the one-liner above.
+- **`@apollo/server` is now a declared peer dependency** (`GraphqlModule` mounts Apollo by default). A normal `npm install` pulls it — no manual install.
 
 ### Migration
 
 > **Behaviour change — the GraphQL resolver API changed and per-module resolver files are no longer generated.** Only relevant if you use GraphQL.
 
 1. **Delete the generated `src/modules/<model>/<model>.resolver.ts` files** — they import the removed `GenericResolverFactory` and will not compile. Remove `<Model>Resolver` from each module's `providers`.
-2. Run **`appx-core generate`** to emit the new `src/generated/<model>/graphql.ts` bundles.
+2. Run **`appx-core generate`** to emit the new `src/generated/<model>/graphql.ts` bundles, then **`npm install`** (pulls the newly-declared `@apollo/server` peer that `GraphqlModule` needs).
 3. Add **`GraphqlModule`** to your `app.module` imports (new projects already have it): `import { GraphqlModule } from '@appxdigital/appx-core';`.
-4. **Expose each model** you want in GraphQL by adding one provider line to its module: `CoreGraphqlResolver(<Model>Graphql)` (import `<Model>Graphql` from `../../generated/<model>/graphql`). See [docs/graphql.md](./docs/graphql.md).
+4. **Expose each model** you want in GraphQL by adding one provider line to its module: import `<Model>Resolver` from `../../generated/<model>/graphql` and add it to `providers`. See [docs/graphql.md](./docs/graphql.md).
 5. **Update clients:** `findAllProjects(...)` → `project { find(...) }`, `findFirstProject` / `findOneProject` → `project { get(...) }`. Mutations remain REST-only.
-
-> **Security caveat (unchanged, still open):** generated `where`/`orderBy` inputs include `@Role`/`@NoWrite` columns (a filter-oracle; output values are omitted). Don't expose models with sensitive filterable columns to untrusted roles until the input scrub lands.
+6. **Filtering/ordering by a `@Role`-restricted column now returns `403` — on EVERY transport, REST included** (the proxy is the enforcement point, so this is not GraphQL-only). An existing `where`/`orderBy` that touches a hidden column will 403.
+   - **Presence checks still work:** `{ field: null }` / `{ NOT: { field: null } }` (e.g. `hasPassword`, `isDeleted`) are allowed — they don't reveal the value.
+   - **If you need the actual value**, read it via `BYPASS_OMISSION` and filter in JS, or move the query to a role permitted to read the column.
+7. **If your own code imported a generated write/aggregate GraphQL input** (e.g. `<Model>CreateInput`, `<Model>AggregateArgs`), it's no longer emitted (the read-only API doesn't use it). Use the REST DTOs under `src/modules/<model>/dto/` for writes.
+8. **Nested to-many relations are no longer selectable in GraphQL** (`project { tasks { … } }` errors). Move a nested list to a top-level query — `task { find(where: { projectId: { equals: … } }, take, skip) }` — or use `_count` for a count. To-one relations (`project { owner { … } }`) are unaffected.
 
 ---
 

package/README.md

@@ -81,7 +81,11 @@ AppX Core puts **security and data-access control first**, while keeping develop
   - JWT auth (recommended)
 - **Fast CRUD acceleration**
   - Generated modules, controllers, and services per model
-  - Standard REST CRUD endpoints
+  - Standard REST CRUD endpoints (the write surface)
+- **GraphQL read API — recommended for querying**
+  - Namespaced, **opt-in per model**: `model { find get count }`
+  - **Native pagination** (`take` / `skip` / `cursor`), nested relations, and several models per request — prefer it over the CRUD list endpoint for reads/filtering, and enable it on your main queryable models
+  - Same ABAC as REST (row / field / nested-record filtering; filter & sort limited to readable fields)
 - **Developer-friendly extension points**
   - Add custom endpoints with `@Permission(...)`
   - Use services for business logic, controllers as transport layer
@@ -614,7 +618,7 @@ Operational guidance:
 
 ### GraphQL status
 
-GraphQL exposes a **read-only** API — `find` / `get` / `count`, namespaced per model and **opt-in per module** (one line) — that runs through the same ABAC proxy as REST, so row filtering, field omission, and nested-relation filtering all apply. See **[docs/graphql.md](./docs/graphql.md)**. Not yet: mutations and full aggregates. One caveat before exposing sensitive models to untrusted roles — the generated `where`/`orderBy` inputs still include restricted columns (a filter-oracle; output values are omitted). REST CRUD + AdminJS remain the primary write surfaces.
+GraphQL exposes a **read-only** API — `find` / `get` / `count`, namespaced per model and **opt-in per module** (one line) — that runs through the same ABAC proxy as REST: row filtering, field omission, nested-relation filtering, and filter/sort limited to fields the role can read all apply. It supports nested selections and native pagination (`take`/`skip`/`cursor`), so it's the recommended surface for querying/filtering/paginating reads. See **[docs/graphql.md](./docs/graphql.md)**. Not yet: mutations and full aggregates — REST CRUD + AdminJS remain the write surfaces.
 
 ---
 

package/dist/config/generate-all.d.ts

@@ -1,3 +1,9 @@
 #!/usr/bin/env node
-export {};
+/**
+ * The deploy-safe pass, as a single reusable unit. `generate models` (the
+ * wizard) runs it too before scaffolding, so keeping it here — rather than
+ * duplicating the steps — stops the two paths from drifting (e.g. one pruning
+ * the GraphQL types and the other regenerating them unpruned).
+ */
+export declare function runDeploySafePass(): void;
 //# sourceMappingURL=generate-all.d.ts.map

package/dist/config/generate-all.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-all.d.ts","sourceRoot":"","sources":["../../src/config/generate-all.ts"],"names":[],"mappings":""}
+{"version":3,"file":"generate-all.d.ts","sourceRoot":"","sources":["../../src/config/generate-all.ts"],"names":[],"mappings":";AAoBA;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAoBxC"}

package/dist/config/generate-all.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDeploySafePass = void 0;
 /**
  * `appx generate` — the DEPLOY-SAFE pass.
  *
@@ -18,12 +19,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const utils_1 = require("./utils");
 const generate_dtos_1 = require("./generate-dtos");
 const generate_graphql_1 = require("./generate-graphql");
-console.log('Running Prisma Generate (client + GraphQL artifacts)...');
-// Project-local prisma: the CLI is usually global, so PATH has no project .bin.
-(0, utils_1.runProjectBin)('prisma', 'generate');
-const allModels = (0, utils_1.loadAllModels)();
-console.log('Generating DTO base classes...');
-(0, generate_dtos_1.generateDtoBases)(allModels);
-console.log('Generating GraphQL bundles...');
-(0, generate_graphql_1.generateGraphqlBundles)(allModels);
-console.log('Deploy-safe generation complete — src/generated only, no code changes.');
+/**
+ * The deploy-safe pass, as a single reusable unit. `generate models` (the
+ * wizard) runs it too before scaffolding, so keeping it here — rather than
+ * duplicating the steps — stops the two paths from drifting (e.g. one pruning
+ * the GraphQL types and the other regenerating them unpruned).
+ */
+function runDeploySafePass() {
+    console.log('Running Prisma Generate (client + GraphQL artifacts)...');
+    // Project-local prisma: the CLI is usually global, so PATH has no project .bin.
+    (0, utils_1.runProjectBin)('prisma', 'generate');
+    const allModels = (0, utils_1.loadAllModels)();
+    console.log('Generating DTO base classes...');
+    (0, generate_dtos_1.generateDtoBases)(allModels);
+    console.log('Generating GraphQL bundles...');
+    (0, generate_graphql_1.generateGraphqlBundles)(allModels);
+    console.log('Hiding to-many relations from GraphQL models (nested lists have no pagination)...');
+    (0, generate_graphql_1.hideListRelationsFromModels)(allModels);
+    console.log('Pruning unused GraphQL types (read-only API)...');
+    (0, generate_graphql_1.pruneGeneratedGraphql)();
+    console.log('Deploy-safe generation complete — src/generated only, no code changes.');
+}
+exports.runDeploySafePass = runDeploySafePass;
+// Only run when invoked directly (`node generate-all.js`), not when imported by
+// the wizard (which calls runDeploySafePass() itself).
+if (require.main === module) {
+    runDeploySafePass();
+}

package/dist/config/generate-graphql.d.ts

@@ -7,4 +7,37 @@
 export declare function generateGraphqlBundles(allModels: {
     name: string;
 }[]): void;
+/**
+ * `prisma-nestjs-graphql` emits the full CRUD surface per model
+ * (create/update/upsert/delete/aggregate/groupBy inputs), but the read-only
+ * GraphQL API only ever imports the model + find/where/orderBy read types. Prune
+ * the rest so `src/generated/` stays small and `tsc` doesn't compile dozens of
+ * unused files per model.
+ *
+ * Method: keep the transitive relative-import closure of the generated
+ * `graphql.ts` bundles (the read entrypoints), delete every other `.ts` under
+ * the model folders + shared `prisma/` folder. The DTO tree (`dto/`, generated
+ * by this framework and independent of these types) is preserved untouched.
+ */
+/**
+ * Hide **to-many (list) relations** from the generated GraphQL model types.
+ *
+ * Nested selection has no pagination, so selecting a to-many relation
+ * (`project { tasks { … } }`) could pull an unbounded number of rows. To-one
+ * relations (`project { owner { … } }`) return a single record and stay
+ * exposed; `_count` (relation counts, bounded) stays too. Fetch a list at the
+ * top level instead — `task { find(where: { projectId … }, take, skip) }` —
+ * where pagination + ABAC apply.
+ *
+ * Implementation: for each model, use the DMMF to find its `kind === 'object'
+ * && isList` fields and remove those `@Field(...) name?: Array<…>;` blocks from
+ * `<model>.model.ts`, then drop any import left unused. Only the OUTPUT model is
+ * touched — `where`/`orderBy` relation filters are unchanged (filtering by a
+ * relation returns the parent rows, not the list).
+ */
+export declare function hideListRelationsFromModels(allModels: {
+    name: string;
+    fields: any[];
+}[]): void;
+export declare function pruneGeneratedGraphql(): void;
 //# sourceMappingURL=generate-graphql.d.ts.map

package/dist/config/generate-graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AAmCA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE"}
+{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAC,EAAE,GAAG,IAAI,CAoC5F;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CA4D5C"}

package/dist/config/generate-graphql.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateGraphqlBundles = void 0;
+exports.pruneGeneratedGraphql = exports.hideListRelationsFromModels = exports.generateGraphqlBundles = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
@@ -41,11 +41,11 @@ const generatedRoot = path.join(process.cwd(), 'src/generated');
  */
 const bundleTemplate = (model, folder) => {
     const camel = model.charAt(0).toLowerCase() + model.slice(1);
-    return `import { ${model} } from './${folder}.model';
+    return `import { CoreGraphqlResolver, GraphqlModelBundle } from '@appxdigital/appx-core';
+import { ${model} } from './${folder}.model';
 import { FindMany${model}Args } from './find-many-${folder}.args';
 import { FindFirst${model}Args } from './find-first-${folder}.args';
 import { ${model}WhereInput } from './${folder}-where.input';
-import type { GraphqlModelBundle } from '@appxdigital/appx-core';
 
 export const ${model}Graphql: GraphqlModelBundle<${model}> = {
   model: ${model},
@@ -54,6 +54,16 @@ export const ${model}Graphql: GraphqlModelBundle<${model}> = {
   findFirstArgs: FindFirst${model}Args,
   whereInput: ${model}WhereInput,
 };
+
+/**
+ * Ready-to-register read-only GraphQL resolver for ${model} (\`${camel} { find get count }\`).
+ * Add it to your ${model} module's \`providers\` to expose the model — no CoreGraphqlResolver
+ * import or resolver file needed:
+ *
+ *   import { ${model}Resolver } from '../../generated/${folder}/graphql';
+ *   providers: [${model}Service, ${model}Resolver]
+ */
+export const ${model}Resolver = CoreGraphqlResolver(${model}Graphql);
 `;
 };
 /**
@@ -74,3 +84,139 @@ function generateGraphqlBundles(allModels) {
     }
 }
 exports.generateGraphqlBundles = generateGraphqlBundles;
+/**
+ * `prisma-nestjs-graphql` emits the full CRUD surface per model
+ * (create/update/upsert/delete/aggregate/groupBy inputs), but the read-only
+ * GraphQL API only ever imports the model + find/where/orderBy read types. Prune
+ * the rest so `src/generated/` stays small and `tsc` doesn't compile dozens of
+ * unused files per model.
+ *
+ * Method: keep the transitive relative-import closure of the generated
+ * `graphql.ts` bundles (the read entrypoints), delete every other `.ts` under
+ * the model folders + shared `prisma/` folder. The DTO tree (`dto/`, generated
+ * by this framework and independent of these types) is preserved untouched.
+ */
+/**
+ * Hide **to-many (list) relations** from the generated GraphQL model types.
+ *
+ * Nested selection has no pagination, so selecting a to-many relation
+ * (`project { tasks { … } }`) could pull an unbounded number of rows. To-one
+ * relations (`project { owner { … } }`) return a single record and stay
+ * exposed; `_count` (relation counts, bounded) stays too. Fetch a list at the
+ * top level instead — `task { find(where: { projectId … }, take, skip) }` —
+ * where pagination + ABAC apply.
+ *
+ * Implementation: for each model, use the DMMF to find its `kind === 'object'
+ * && isList` fields and remove those `@Field(...) name?: Array<…>;` blocks from
+ * `<model>.model.ts`, then drop any import left unused. Only the OUTPUT model is
+ * touched — `where`/`orderBy` relation filters are unchanged (filtering by a
+ * relation returns the parent rows, not the list).
+ */
+function hideListRelationsFromModels(allModels) {
+    for (const model of allModels) {
+        const listRelations = (model.fields || [])
+            .filter((f) => f.kind === 'object' && f.isList)
+            .map((f) => f.name);
+        if (listRelations.length === 0)
+            continue;
+        const folder = (0, utils_1.modelFolder)(model.name);
+        const modelFile = path.join(generatedRoot, folder, `${folder}.model.ts`);
+        if (!fs.existsSync(modelFile))
+            continue;
+        let lines = fs.readFileSync(modelFile, 'utf8').split('\n');
+        for (const field of listRelations) {
+            const propIdx = lines.findIndex((l) => new RegExp(`^\\s*${field}[?!]?\\s*:`).test(l));
+            if (propIdx === -1)
+                continue;
+            let start = propIdx;
+            while (start - 1 >= 0 && /^\s*@/.test(lines[start - 1]))
+                start--; // preceding decorators
+            let end = propIdx;
+            if (lines[end + 1] === '')
+                end++; // absorb the trailing blank line
+            lines.splice(start, end - start + 1);
+        }
+        // Drop imports left unused after the removals (each import is a single name).
+        let content = lines.join('\n');
+        const importRe = /^import\s*\{\s*([A-Za-z0-9_]+)\s*\}\s*from\s*['"][^'"]+['"];?\s*$/;
+        content = content
+            .split('\n')
+            .filter((line) => {
+            const m = line.match(importRe);
+            if (!m)
+                return true;
+            return new RegExp(`\\b${m[1]}\\b`).test(content.replace(line, ''));
+        })
+            .join('\n');
+        fs.writeFileSync(modelFile, content);
+    }
+}
+exports.hideListRelationsFromModels = hideListRelationsFromModels;
+function pruneGeneratedGraphql() {
+    if (!fs.existsSync(generatedRoot))
+        return;
+    const dtoDir = path.resolve(generatedRoot, 'dto');
+    // Every prunable .ts under src/generated, excluding the DTO tree.
+    const allFiles = new Set();
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const p = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (path.resolve(p) === dtoDir)
+                    continue; // preserve DTOs
+                walk(p);
+            }
+            else if (entry.name.endsWith('.ts')) {
+                allFiles.add(path.resolve(p));
+            }
+        }
+    };
+    walk(generatedRoot);
+    const roots = [...allFiles].filter((f) => path.basename(f) === 'graphql.ts');
+    if (roots.length === 0)
+        return; // nothing to anchor the closure — leave as-is
+    // BFS the relative-import graph from the bundles.
+    const keep = new Set();
+    const queue = [...roots];
+    const importRe = /(?:from|import)\s+['"](\.[^'"]+)['"]/g;
+    while (queue.length) {
+        const file = queue.pop();
+        if (keep.has(file))
+            continue;
+        keep.add(file);
+        let src;
+        try {
+            src = fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        importRe.lastIndex = 0;
+        let m;
+        while ((m = importRe.exec(src)) !== null) {
+            const spec = m[1].endsWith('.ts') ? m[1] : `${m[1]}.ts`;
+            const resolved = path.resolve(path.dirname(file), spec);
+            if (allFiles.has(resolved) && !keep.has(resolved))
+                queue.push(resolved);
+        }
+    }
+    let removed = 0;
+    for (const f of allFiles) {
+        if (!keep.has(f)) {
+            fs.rmSync(f);
+            removed++;
+        }
+    }
+    // Drop now-empty model dirs (never the DTO tree).
+    for (const entry of fs.readdirSync(generatedRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const p = path.join(generatedRoot, entry.name);
+        if (path.resolve(p) === dtoDir)
+            continue;
+        if (fs.existsSync(p) && fs.readdirSync(p).length === 0)
+            fs.rmdirSync(p);
+    }
+    console.log(`Pruned ${removed} unused GraphQL type file(s) from src/generated (read-only API).`);
+}
+exports.pruneGeneratedGraphql = pruneGeneratedGraphql;

package/dist/config/generate-models.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const utils_1 = require("./utils");
 const generate_dtos_1 = require("./generate-dtos");
+const generate_all_1 = require("./generate-all");
 const generate_modules_1 = require("./generate-modules");
 const generate_services_1 = require("./generate-services");
 const generate_controllers_1 = require("./generate-controllers");
@@ -33,11 +34,10 @@ const generate_controllers_1 = require("./generate-controllers");
 // Node resolves as ESM. Only used on the interactive path.
 const dynamicImport = new Function('m', 'return import(m)');
 async function main() {
-    // 1) Deploy-safe pass first — refresh client + GraphQL artifacts + DTO bases.
-    console.log('Running Prisma Generate (client + GraphQL artifacts)...');
-    // Project-local prisma: the CLI is usually global, so PATH has no project .bin.
-    (0, utils_1.runProjectBin)('prisma', 'generate');
-    (0, generate_dtos_1.generateDtoBases)((0, utils_1.loadAllModels)());
+    // 1) Deploy-safe pass first — refresh client + GraphQL artifacts + DTO bases
+    //    (+ prune unused GraphQL types). Shared with `appx generate` so the two
+    //    paths can't drift.
+    (0, generate_all_1.runDeploySafePass)();
     // 2) Candidates = non-framework models with no module yet. "Has a module"
     //    means either the canonical folder exists OR some existing module already
     //    serves the model via CoreController/CoreService<Model> — the latter

package/dist/config/generate-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AAoCA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}
+{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AAmCA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}

package/dist/config/generate-modules.js

@@ -42,16 +42,15 @@ import { PrismaModule } from '../../prisma/prisma.module';
 import { ${model}Controller } from './${folder}.controller';
 import { ${model}Service } from './${folder}.service';
 // To expose this model over GraphQL (read-only: \`${camel} { find get count }\`),
-// uncomment the two imports and the provider line below. See docs/graphql.md.
-// import { CoreGraphqlResolver } from '@appxdigital/appx-core';
-// import { ${model}Graphql } from '../../generated/${folder}/graphql';
+// uncomment the import and the provider line below. See docs/graphql.md.
+// import { ${model}Resolver } from '../../generated/${folder}/graphql';
 
 @Module({
   imports: [PrismaModule],
   controllers: [${model}Controller],
   providers: [
     ${model}Service,
-    // CoreGraphqlResolver(${model}Graphql),
+    // ${model}Resolver,
   ],
 })
 export class ${model}Module {}

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAKrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CA+C/F"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAwBrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}

package/dist/graphql/generic.resolver.js

@@ -14,8 +14,28 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
+const common_1 = require("@nestjs/common");
 const plugins_1 = require("@paljs/plugins");
 const prisma_service_1 = require("../prisma/prisma.service");
+/**
+ * Run a read and translate a Prisma **validation** error into a `400`. A
+ * malformed `where`/`orderBy` value (e.g. `createdAt: { gt: 2024 }` — a number
+ * where a DateTime is expected) can slip past GraphQL coercion and reach Prisma,
+ * which throws `PrismaClientValidationError`. That's bad client input, not a
+ * server fault: surface a clean `400` instead of a `500` that leaks the raw
+ * Prisma invocation. Genuine server errors are re-thrown unchanged.
+ */
+async function readOrBadRequest(op) {
+    try {
+        return await op();
+    }
+    catch (e) {
+        if ((e?.name ?? e?.constructor?.name) === 'PrismaClientValidationError') {
+            throw new common_1.BadRequestException('Invalid query arguments (check where / orderBy types).');
+        }
+        throw e;
+    }
+}
 /**
  * Build a **namespaced, read-only** GraphQL resolver for one model.
  *
@@ -68,24 +88,31 @@ function CoreGraphqlResolver(bundle) {
         }
         async find(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            return this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select }));
         }
         async get(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            return this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select }));
         }
         async count(where) {
-            return this.prisma.getModelDelegate(modelName).count({ where });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).count({ where }));
         }
     };
     __decorate([
-        (0, graphql_1.Query)(() => ModelQueries, { name: rootName }),
+        (0, graphql_1.Query)(() => ModelQueries, {
+            name: rootName,
+            description: `Read queries for ${modelName} — find / get / count. All results are ABAC-filtered.`,
+        }),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", []),
         __metadata("design:returntype", ModelQueries)
     ], ModelQueriesResolver.prototype, "namespace", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => [model], { name: 'find' }),
+        (0, graphql_1.ResolveField)(() => [model], {
+            name: 'find',
+            description: `List ${modelName} records the caller may read. Paginate with take / skip / cursor; ` +
+                `filter with where; sort with orderBy. You can only filter/sort by fields your role can read.`,
+        }),
         __param(0, (0, graphql_1.Args)({ type: () => findManyArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
@@ -93,7 +120,11 @@ function CoreGraphqlResolver(bundle) {
         __metadata("design:returntype", Promise)
     ], ModelQueriesResolver.prototype, "find", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => model, { name: 'get', nullable: true }),
+        (0, graphql_1.ResolveField)(() => model, {
+            name: 'get',
+            nullable: true,
+            description: `The first ${modelName} matching the arguments, or null.`,
+        }),
         __param(0, (0, graphql_1.Args)({ type: () => findFirstArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
@@ -101,8 +132,15 @@ function CoreGraphqlResolver(bundle) {
         __metadata("design:returntype", Promise)
     ], ModelQueriesResolver.prototype, "get", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => graphql_1.Int, { name: 'count' }),
-        __param(0, (0, graphql_1.Args)('where', { type: () => whereInput, nullable: true })),
+        (0, graphql_1.ResolveField)(() => graphql_1.Int, {
+            name: 'count',
+            description: `Number of ${modelName} records matching where that the caller may read.`,
+        }),
+        __param(0, (0, graphql_1.Args)('where', {
+            type: () => whereInput,
+            nullable: true,
+            description: 'Filter. You can only filter by fields your role can read.',
+        })),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", [Object]),
         __metadata("design:returntype", Promise)

package/dist/prisma/prisma.service.d.ts

@@ -102,6 +102,26 @@ export declare class PrismaService {
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    private assertFilterFieldsReadable;
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    private assertClauseFieldsReadable;
+    /**
+     * True when a `where` predicate on a field checks only presence/nullness —
+     * `field: null`, `{ equals: null }`, `{ not: null }` — and therefore reveals
+     * whether the value is set but never the value itself. Anything with a
+     * non-null literal (`equals: "x"`, `contains`, `gt`, `in`, …) is not
+     * presence-only.
+     */
+    private isPresenceOnlyPredicate;
+    private throwUnreadableFilterField;
     private applyWhereConditions;
     /**
      * Enforces permission `conditions` on `create` / `createMany`.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAkFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -136,6 +136,11 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                             await this.enforceNestedWrites(String(propKey), params.data, user, userRole);
                                         }
                                         else {
+                                            // Reject a client where/orderBy/distinct that references a
+                                            // field this role can't read (input counterpart to output
+                                            // field omission). Runs on the client input, BEFORE the
+                                            // trusted ABAC conditions are injected below.
+                                            this.assertFilterFieldsReadable(String(propKey), userRole, params);
                                             params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
                                             // An update can re-point a foreign key (scalar column);
                                             // authorize those changes with the same connect rules as create.
@@ -342,6 +347,94 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    assertFilterFieldsReadable(modelName, userRole, args) {
+        if (!args || typeof args !== 'object')
+            return;
+        if (args.where)
+            this.assertClauseFieldsReadable(modelName, userRole, args.where, 'where');
+        if (args.orderBy)
+            this.assertClauseFieldsReadable(modelName, userRole, args.orderBy, 'orderBy');
+        if (args.distinct) {
+            const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+            for (const field of [].concat(args.distinct)) {
+                if (omit.has(field))
+                    this.throwUnreadableFilterField(modelName, field, userRole, 'distinct');
+            }
+        }
+    }
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    assertClauseFieldsReadable(modelName, userRole, clause, kind) {
+        if (Array.isArray(clause)) {
+            for (const c of clause)
+                this.assertClauseFieldsReadable(modelName, userRole, c, kind);
+            return;
+        }
+        if (!clause || typeof clause !== 'object')
+            return;
+        const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+        for (const key of Object.keys(clause)) {
+            const value = clause[key];
+            // Logical grouping — recurse on the same model.
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                this.assertClauseFieldsReadable(modelName, userRole, value, kind);
+                continue;
+            }
+            // Direct reference to a field the role can't read.
+            if (omit.has(key)) {
+                // A presence/nullness check (`field: null`, `{ equals: null }`,
+                // `{ not: null }`) reveals only whether the value is set — not the
+                // value — so it stays allowed on a `where` (the `hasX` / `isDeleted`
+                // pattern, without needing BYPASS_OMISSION). Any value-bearing
+                // operator, and every `orderBy`/`distinct`, still leaks and is rejected.
+                if (kind === 'where' && this.isPresenceOnlyPredicate(value))
+                    continue;
+                this.throwUnreadableFilterField(modelName, key, userRole, kind);
+            }
+            // Relation — recurse into the related model (unwrapping list/one filters).
+            const relation = this.getRelation(modelName, key);
+            if (relation) {
+                const wrappers = ['some', 'every', 'none', 'is', 'isNot'];
+                const wrapped = value && typeof value === 'object' ? wrappers.filter((w) => w in value) : [];
+                if (wrapped.length) {
+                    for (const w of wrapped)
+                        this.assertClauseFieldsReadable(relation.model, userRole, value[w], kind);
+                }
+                else {
+                    this.assertClauseFieldsReadable(relation.model, userRole, value, kind);
+                }
+            }
+            // Otherwise: a readable scalar field. Its value is an operator object
+            // (where) or 'asc'/'desc' (orderBy) — not a field map, so no recursion.
+        }
+    }
+    /**
+     * True when a `where` predicate on a field checks only presence/nullness —
+     * `field: null`, `{ equals: null }`, `{ not: null }` — and therefore reveals
+     * whether the value is set but never the value itself. Anything with a
+     * non-null literal (`equals: "x"`, `contains`, `gt`, `in`, …) is not
+     * presence-only.
+     */
+    isPresenceOnlyPredicate(value) {
+        if (value === null)
+            return true; // `field: null`
+        if (typeof value !== 'object' || Array.isArray(value))
+            return false; // a literal value
+        const keys = Object.keys(value);
+        if (keys.length === 0)
+            return false;
+        return keys.every((k) => (k === 'equals' || k === 'not') && value[k] === null);
+    }
+    throwUnreadableFilterField(modelName, field, userRole, kind) {
+        throw new common_1.HttpException(`Cannot ${kind === 'orderBy' ? 'order by' : 'filter by'} '${modelName}.${field}' — not readable by role ${userRole}.`, common_1.HttpStatus.FORBIDDEN);
+    }
     applyWhereConditions(modelName, userRole, args, user, action) {
         if (!args) {
             args = {};

package/docs/graphql.md

@@ -4,6 +4,8 @@ AppX Core exposes a **read-only GraphQL API** generated from your Prisma schema.
 
 > **Scope:** **read only** — `find`, `get`, `count`. Writes (create/update/delete) are **not** exposed; use the REST CRUD endpoints. See [limitations.md](./limitations.md).
 
+> **Recommended for reads.** For querying, filtering, and **pagination** (native `take` / `skip` / `cursor`) prefer GraphQL over the generated CRUD list endpoint — one request can select several models, alias repeated queries, and pull nested relations in a single round-trip. Enable it on your main queryable models (one line per module, below); keep REST for writes.
+
 ---
 
 ## The endpoint
@@ -30,21 +32,20 @@ import { Module } from '@nestjs/common';
 import { PrismaModule } from '../../prisma/prisma.module';
 import { AlbumController } from './album.controller';
 import { AlbumService } from './album.service';
-import { CoreGraphqlResolver } from '@appxdigital/appx-core';
-import { AlbumGraphql } from '../../generated/album/graphql';   // generated by `appx-core generate`
+import { AlbumResolver } from '../../generated/album/graphql';   // generated by `appx-core generate`
 
 @Module({
   imports: [PrismaModule],
   controllers: [AlbumController],
   providers: [
     AlbumService,
-    CoreGraphqlResolver(AlbumGraphql),   // ← add = exposed; remove = not exposed
+    AlbumResolver,   // ← add = exposed; remove = not exposed
   ],
 })
 export class AlbumModule {}
 ```
 
-`AlbumGraphql` is a small bundle of generated types emitted by the deploy-safe pass (`appx-core generate`) at `src/generated/album/graphql.ts` — regenerated from the schema, never hand-edited.
+`AlbumResolver` is a ready-to-register resolver class emitted by the deploy-safe pass (`appx-core generate`) at `src/generated/album/graphql.ts` — regenerated from the schema, never hand-edited. (The same file exports the underlying `AlbumGraphql` bundle if you'd rather build the resolver yourself via the exported `CoreGraphqlResolver`.)
 
 ---
 
@@ -87,22 +88,62 @@ query {
 
 Each selected field resolves independently through the proxy (its own authorized query), so multiplexing never weakens enforcement. `count` is filtered too — it counts only the rows the caller may read, never the table total.
 
-### Nested relations & children
+### Nested relations
 
-Select related models inline, to any depth. The GraphQL selection is compiled into a single Prisma `select`, so relations come back in the same authorized query (no N+1):
+Select **to-one** relations inline — they return a single record, and the selection compiles into one Prisma `select` (no N+1):
 
 ```graphql
 query {
   album {
-    find {
+    get(where: { id: { equals: 1 } }) {
       title
-      tracks { title }              # to-many child
-      artist { name }               # to-one relation
+      artist { name }          # to-one relation — OK
     }
   }
 }
 ```
 
+**To-many relations are not nested-selectable** (`album.tracks`, `project.tasks`). Nested lists have no pagination, so an inline list could return unbounded rows. Query the list at the **top level** instead, where pagination applies:
+
+```graphql
+query {
+  album  { get(where: { id: { equals: 1 } }) { title } }
+  tracks: track { find(where: { albumId: { equals: 1 } }, take: 20, orderBy: { id: asc }) { id title } }
+}
+```
+
+You can still get a bounded **count** of a to-many relation via `_count` (`album { get { _count { tracks } } }`), and you can **filter** by a to-many relation in `where` (`some` / `every` / `none`) — that returns the parent rows, not the list.
+
+---
+
+## Filtering, sorting & pagination
+
+`find` / `get` take the generated Prisma-style arguments; `count` takes `where`.
+
+- **Pagination** (`find`): `take`, `skip`, `cursor: { <uniqueField>: … }`, `distinct: [field]`.
+- **Sorting** (`find`): `orderBy: { field: asc | desc }` — including nested to-one, `orderBy: { artist: { name: asc } }`.
+
+**`where` operators**, by field type:
+
+| Field type | Operators |
+|---|---|
+| `String` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte`, `contains`, `startsWith`, `endsWith`, `mode: insensitive` |
+| `Int` / `Float` / `Decimal` / `BigInt` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte` |
+| `Boolean` | `equals`, `not` |
+| `DateTime` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte` |
+| enum | `equals`, `not`, `in`, `notIn` |
+| nullable field | any of the above, plus `null` / `{ equals: null }` / `{ not: null }` |
+| to-one relation | `is: { … }`, `isNot: { … }` (a nested `where`) |
+| to-many relation | `some: { … }`, `every: { … }`, `none: { … }` |
+| logical | `AND`, `OR`, `NOT` |
+
+The **generated GraphQL input type is the authoritative allowlist** — an operator that isn't on a field's filter type is a GraphQL error, so unknown operators are rejected before they run. Browse the exact set per field in the Apollo Sandbox (`GET /graphql`).
+
+Two framework rules on top of that:
+
+- **You can only filter/sort by fields your role can read.** A `where`/`orderBy` on a `@Role`-hidden column is rejected with `403` — except a presence check (`{ field: null }` / `{ NOT: { field: null } }`), which reveals only whether a value is set.
+- **A malformed value returns a clean `400`.** `createdAt: { gt: 2024 }` (a number where a date is expected) is a `400`, never a `500` or a leaked Prisma error.
+
 ---
 
 ## What the caller can and cannot see (ABAC)
@@ -112,6 +153,7 @@ All three operations route through `PrismaService.getModelDelegate`, so the rule
 - **Unauthorized rows are not returned.** `find` returns only rows the role may read; `get` returns `null` for a row the caller can't access even if asked for by unique field; `count` counts only accessible rows.
 - **Restricted fields are omitted.** A column the role can't read (`/// @Role(...)`) comes back **`null`** even though the GraphQL type exposes it — at the top level *and* nested. (`prisma-nestjs-graphql` types every scalar; the proxy is what strips the values.)
 - **Inaccessible nested records are filtered.** If a nested relation points at a record the caller can't read, that relation is filtered out — a to-many yields only the visible rows; an inaccessible to-one drops the parent row. You can hold access to a record while a record it links to is withheld.
+- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either. The one exception is a **presence/nullness** check in `where`: `{ field: null }` / `{ NOT: { field: null } }` is allowed (it reveals only whether a value is set, not the value), so `hasX` / `isDeleted` patterns work without a bypass.
 - **Anonymous callers are `GUEST`.** With no valid `Authorization: Bearer <jwt>` (or session), the request is a GUEST; a model with no GUEST rule is denied.
 
 > Because relation records and fields are filtered by ABAC, "empty / null" means "not visible to you", not "does not exist". Design queries and UI accordingly.
@@ -125,8 +167,6 @@ Always let the generated resolver serve the data — a custom resolver that reac
 - **Mutations** (create/update/delete) — use REST.
 - **Full `aggregate`** (sum/avg/min/max/groupBy) — only `count` is exposed today.
 
-> **Security note (before exposing sensitive models widely).** `prisma-nestjs-graphql` generates `where` / `orderBy` inputs that include *every* scalar, ignoring `/// @Role` / `/// @NoWrite`. Field **values** are omitted on output, but a `where`/`orderBy` over a restricted column (e.g. filtering by a password hash prefix) can still act as an oracle. Scrubbing restricted columns from the generated inputs is tracked as a follow-up; until then, avoid exposing models with sensitive filterable columns to untrusted roles.
-
 ---
 
 ## After changing the schema

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.0",
+    "version": "0.1.128-beta.2",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -59,6 +59,7 @@
         "@adminjs/nestjs": "~7.0.0",
         "@adminjs/passwords": "~4.0.0",
         "@adminjs/prisma": "~5.0.4",
+        "@apollo/server": "^4.11.3",
         "@as-integrations/express5": "~1.1.2",
         "@aws-sdk/client-s3": "~3.850.0",
         "@aws-sdk/s3-request-presigner": "~3.850.0",