@appxdigital/appx-core 0.1.128-beta.1 → 0.1.128-beta.2

package/CHANGELOG.md

@@ -24,7 +24,11 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 - **Opt-in per module — one line, no resolver file.** Expose a model by importing its generated resolver and adding it to `providers`: `import { <Model>Resolver } from '../../generated/<model>/graphql'; providers: [<Model>Service, <Model>Resolver]`. The generated module ships this commented, copy-paste-ready. `<Model>Resolver` (and the underlying `<Model>Graphql` bundle) live at `src/generated/<model>/graphql.ts`, emitted by the deploy-safe pass. Remove the line to un-expose.
 - **`/graphql` mounted by default** in new projects (Apollo; Sandbox on `GET /graphql`). The schema stays valid before any model opts in.
 - **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (`count` included — it's filtered to accessible rows), restricted fields (`@Role`) come back null at the top level and nested, and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
-- **Filter/sort limited to readable fields.** A client `where` / `orderBy` / `distinct` that references a field the caller's role can't read is **rejected** (`403`), recursing through relations and `AND`/`OR`/`NOT` — the input-side counterpart to output field omission, applied in `PrismaService` for every transport.
+- **Filter/sort limited to readable fields.** A client `where` / `orderBy` / `distinct` that references a field the caller's role can't read is **rejected** (`403`), recursing through relations and `AND`/`OR`/`NOT` — the input-side counterpart to output field omission, applied in `PrismaService` for **every transport (REST and GraphQL)**. Exception: a **presence/nullness** check on a hidden field — `{ field: null }`, `{ not: null }`, `{ NOT: { field: null } }` — is **allowed**, since it reveals only whether a value is set, not the value (the `hasX` / `isDeleted` pattern, without `BYPASS_OMISSION`). Value-bearing operators (`equals: "x"`, `not: "x"`, `contains`, `gt`, …) stay rejected.
+- **Slimmer generated output.** The deploy-safe pass now prunes the `prisma-nestjs-graphql` types the read-only API never imports (create/update/upsert/delete/aggregate/groupBy inputs), keeping only the model + `find`/`where`/`orderBy` read types reachable from the generated resolvers — roughly **80% fewer files** under `src/generated/`, so `tsc` and your editor do far less work. The DTO tree (`src/generated/dto/`) is untouched.
+- **Nested selection is to-one only.** Generated GraphQL model types expose scalars, **to-one** relations, and `_count`; **to-many relations are not nested-selectable** (nested lists have no pagination, so they could return unbounded rows). Fetch a list at the top level with pagination — `track { find(where: { albumId … }, take, skip) }`. Filtering by a to-many relation in `where` (`some`/`every`/`none`) and `_count { … }` still work.
+- **Self-documenting operations.** `find` / `get` / `count` and their `where` arg carry GraphQL descriptions (visible in the Apollo Sandbox); model-field descriptions come from Prisma `///` doc comments as before. See [docs/graphql.md](./docs/graphql.md) for the full `where`/`orderBy`/pagination reference.
+- **Malformed filter values return `400`, not `500`.** A `where`/`orderBy` value Prisma can't parse (e.g. `createdAt: { gt: 2024 }` — a number where a date is expected) now surfaces a clean `400`, instead of an internal error that leaked the raw Prisma invocation.
 
 ### Changed / Removed
 
@@ -41,7 +45,11 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 3. Add **`GraphqlModule`** to your `app.module` imports (new projects already have it): `import { GraphqlModule } from '@appxdigital/appx-core';`.
 4. **Expose each model** you want in GraphQL by adding one provider line to its module: import `<Model>Resolver` from `../../generated/<model>/graphql` and add it to `providers`. See [docs/graphql.md](./docs/graphql.md).
 5. **Update clients:** `findAllProjects(...)` → `project { find(...) }`, `findFirstProject` / `findOneProject` → `project { get(...) }`. Mutations remain REST-only.
-6. **If a client filtered or ordered by a field a role can't read, that now returns `403`** — move such queries to a role that may read the field, or don't reference it.
+6. **Filtering/ordering by a `@Role`-restricted column now returns `403` — on EVERY transport, REST included** (the proxy is the enforcement point, so this is not GraphQL-only). An existing `where`/`orderBy` that touches a hidden column will 403.
+   - **Presence checks still work:** `{ field: null }` / `{ NOT: { field: null } }` (e.g. `hasPassword`, `isDeleted`) are allowed — they don't reveal the value.
+   - **If you need the actual value**, read it via `BYPASS_OMISSION` and filter in JS, or move the query to a role permitted to read the column.
+7. **If your own code imported a generated write/aggregate GraphQL input** (e.g. `<Model>CreateInput`, `<Model>AggregateArgs`), it's no longer emitted (the read-only API doesn't use it). Use the REST DTOs under `src/modules/<model>/dto/` for writes.
+8. **Nested to-many relations are no longer selectable in GraphQL** (`project { tasks { … } }` errors). Move a nested list to a top-level query — `task { find(where: { projectId: { equals: … } }, take, skip) }` — or use `_count` for a count. To-one relations (`project { owner { … } }`) are unaffected.
 
 ---
 

package/dist/config/generate-all.d.ts

@@ -1,3 +1,9 @@
 #!/usr/bin/env node
-export {};
+/**
+ * The deploy-safe pass, as a single reusable unit. `generate models` (the
+ * wizard) runs it too before scaffolding, so keeping it here — rather than
+ * duplicating the steps — stops the two paths from drifting (e.g. one pruning
+ * the GraphQL types and the other regenerating them unpruned).
+ */
+export declare function runDeploySafePass(): void;
 //# sourceMappingURL=generate-all.d.ts.map

package/dist/config/generate-all.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-all.d.ts","sourceRoot":"","sources":["../../src/config/generate-all.ts"],"names":[],"mappings":""}
+{"version":3,"file":"generate-all.d.ts","sourceRoot":"","sources":["../../src/config/generate-all.ts"],"names":[],"mappings":";AAoBA;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAoBxC"}

package/dist/config/generate-all.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDeploySafePass = void 0;
 /**
  * `appx generate` — the DEPLOY-SAFE pass.
  *
@@ -18,12 +19,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const utils_1 = require("./utils");
 const generate_dtos_1 = require("./generate-dtos");
 const generate_graphql_1 = require("./generate-graphql");
-console.log('Running Prisma Generate (client + GraphQL artifacts)...');
-// Project-local prisma: the CLI is usually global, so PATH has no project .bin.
-(0, utils_1.runProjectBin)('prisma', 'generate');
-const allModels = (0, utils_1.loadAllModels)();
-console.log('Generating DTO base classes...');
-(0, generate_dtos_1.generateDtoBases)(allModels);
-console.log('Generating GraphQL bundles...');
-(0, generate_graphql_1.generateGraphqlBundles)(allModels);
-console.log('Deploy-safe generation complete — src/generated only, no code changes.');
+/**
+ * The deploy-safe pass, as a single reusable unit. `generate models` (the
+ * wizard) runs it too before scaffolding, so keeping it here — rather than
+ * duplicating the steps — stops the two paths from drifting (e.g. one pruning
+ * the GraphQL types and the other regenerating them unpruned).
+ */
+function runDeploySafePass() {
+    console.log('Running Prisma Generate (client + GraphQL artifacts)...');
+    // Project-local prisma: the CLI is usually global, so PATH has no project .bin.
+    (0, utils_1.runProjectBin)('prisma', 'generate');
+    const allModels = (0, utils_1.loadAllModels)();
+    console.log('Generating DTO base classes...');
+    (0, generate_dtos_1.generateDtoBases)(allModels);
+    console.log('Generating GraphQL bundles...');
+    (0, generate_graphql_1.generateGraphqlBundles)(allModels);
+    console.log('Hiding to-many relations from GraphQL models (nested lists have no pagination)...');
+    (0, generate_graphql_1.hideListRelationsFromModels)(allModels);
+    console.log('Pruning unused GraphQL types (read-only API)...');
+    (0, generate_graphql_1.pruneGeneratedGraphql)();
+    console.log('Deploy-safe generation complete — src/generated only, no code changes.');
+}
+exports.runDeploySafePass = runDeploySafePass;
+// Only run when invoked directly (`node generate-all.js`), not when imported by
+// the wizard (which calls runDeploySafePass() itself).
+if (require.main === module) {
+    runDeploySafePass();
+}

package/dist/config/generate-graphql.d.ts

@@ -7,4 +7,37 @@
 export declare function generateGraphqlBundles(allModels: {
     name: string;
 }[]): void;
+/**
+ * `prisma-nestjs-graphql` emits the full CRUD surface per model
+ * (create/update/upsert/delete/aggregate/groupBy inputs), but the read-only
+ * GraphQL API only ever imports the model + find/where/orderBy read types. Prune
+ * the rest so `src/generated/` stays small and `tsc` doesn't compile dozens of
+ * unused files per model.
+ *
+ * Method: keep the transitive relative-import closure of the generated
+ * `graphql.ts` bundles (the read entrypoints), delete every other `.ts` under
+ * the model folders + shared `prisma/` folder. The DTO tree (`dto/`, generated
+ * by this framework and independent of these types) is preserved untouched.
+ */
+/**
+ * Hide **to-many (list) relations** from the generated GraphQL model types.
+ *
+ * Nested selection has no pagination, so selecting a to-many relation
+ * (`project { tasks { … } }`) could pull an unbounded number of rows. To-one
+ * relations (`project { owner { … } }`) return a single record and stay
+ * exposed; `_count` (relation counts, bounded) stays too. Fetch a list at the
+ * top level instead — `task { find(where: { projectId … }, take, skip) }` —
+ * where pagination + ABAC apply.
+ *
+ * Implementation: for each model, use the DMMF to find its `kind === 'object'
+ * && isList` fields and remove those `@Field(...) name?: Array<…>;` blocks from
+ * `<model>.model.ts`, then drop any import left unused. Only the OUTPUT model is
+ * touched — `where`/`orderBy` relation filters are unchanged (filtering by a
+ * relation returns the parent rows, not the list).
+ */
+export declare function hideListRelationsFromModels(allModels: {
+    name: string;
+    fields: any[];
+}[]): void;
+export declare function pruneGeneratedGraphql(): void;
 //# sourceMappingURL=generate-graphql.d.ts.map

package/dist/config/generate-graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE"}
+{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAC,EAAE,GAAG,IAAI,CAoC5F;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CA4D5C"}

package/dist/config/generate-graphql.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateGraphqlBundles = void 0;
+exports.pruneGeneratedGraphql = exports.hideListRelationsFromModels = exports.generateGraphqlBundles = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
@@ -84,3 +84,139 @@ function generateGraphqlBundles(allModels) {
     }
 }
 exports.generateGraphqlBundles = generateGraphqlBundles;
+/**
+ * `prisma-nestjs-graphql` emits the full CRUD surface per model
+ * (create/update/upsert/delete/aggregate/groupBy inputs), but the read-only
+ * GraphQL API only ever imports the model + find/where/orderBy read types. Prune
+ * the rest so `src/generated/` stays small and `tsc` doesn't compile dozens of
+ * unused files per model.
+ *
+ * Method: keep the transitive relative-import closure of the generated
+ * `graphql.ts` bundles (the read entrypoints), delete every other `.ts` under
+ * the model folders + shared `prisma/` folder. The DTO tree (`dto/`, generated
+ * by this framework and independent of these types) is preserved untouched.
+ */
+/**
+ * Hide **to-many (list) relations** from the generated GraphQL model types.
+ *
+ * Nested selection has no pagination, so selecting a to-many relation
+ * (`project { tasks { … } }`) could pull an unbounded number of rows. To-one
+ * relations (`project { owner { … } }`) return a single record and stay
+ * exposed; `_count` (relation counts, bounded) stays too. Fetch a list at the
+ * top level instead — `task { find(where: { projectId … }, take, skip) }` —
+ * where pagination + ABAC apply.
+ *
+ * Implementation: for each model, use the DMMF to find its `kind === 'object'
+ * && isList` fields and remove those `@Field(...) name?: Array<…>;` blocks from
+ * `<model>.model.ts`, then drop any import left unused. Only the OUTPUT model is
+ * touched — `where`/`orderBy` relation filters are unchanged (filtering by a
+ * relation returns the parent rows, not the list).
+ */
+function hideListRelationsFromModels(allModels) {
+    for (const model of allModels) {
+        const listRelations = (model.fields || [])
+            .filter((f) => f.kind === 'object' && f.isList)
+            .map((f) => f.name);
+        if (listRelations.length === 0)
+            continue;
+        const folder = (0, utils_1.modelFolder)(model.name);
+        const modelFile = path.join(generatedRoot, folder, `${folder}.model.ts`);
+        if (!fs.existsSync(modelFile))
+            continue;
+        let lines = fs.readFileSync(modelFile, 'utf8').split('\n');
+        for (const field of listRelations) {
+            const propIdx = lines.findIndex((l) => new RegExp(`^\\s*${field}[?!]?\\s*:`).test(l));
+            if (propIdx === -1)
+                continue;
+            let start = propIdx;
+            while (start - 1 >= 0 && /^\s*@/.test(lines[start - 1]))
+                start--; // preceding decorators
+            let end = propIdx;
+            if (lines[end + 1] === '')
+                end++; // absorb the trailing blank line
+            lines.splice(start, end - start + 1);
+        }
+        // Drop imports left unused after the removals (each import is a single name).
+        let content = lines.join('\n');
+        const importRe = /^import\s*\{\s*([A-Za-z0-9_]+)\s*\}\s*from\s*['"][^'"]+['"];?\s*$/;
+        content = content
+            .split('\n')
+            .filter((line) => {
+            const m = line.match(importRe);
+            if (!m)
+                return true;
+            return new RegExp(`\\b${m[1]}\\b`).test(content.replace(line, ''));
+        })
+            .join('\n');
+        fs.writeFileSync(modelFile, content);
+    }
+}
+exports.hideListRelationsFromModels = hideListRelationsFromModels;
+function pruneGeneratedGraphql() {
+    if (!fs.existsSync(generatedRoot))
+        return;
+    const dtoDir = path.resolve(generatedRoot, 'dto');
+    // Every prunable .ts under src/generated, excluding the DTO tree.
+    const allFiles = new Set();
+    const walk = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            const p = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (path.resolve(p) === dtoDir)
+                    continue; // preserve DTOs
+                walk(p);
+            }
+            else if (entry.name.endsWith('.ts')) {
+                allFiles.add(path.resolve(p));
+            }
+        }
+    };
+    walk(generatedRoot);
+    const roots = [...allFiles].filter((f) => path.basename(f) === 'graphql.ts');
+    if (roots.length === 0)
+        return; // nothing to anchor the closure — leave as-is
+    // BFS the relative-import graph from the bundles.
+    const keep = new Set();
+    const queue = [...roots];
+    const importRe = /(?:from|import)\s+['"](\.[^'"]+)['"]/g;
+    while (queue.length) {
+        const file = queue.pop();
+        if (keep.has(file))
+            continue;
+        keep.add(file);
+        let src;
+        try {
+            src = fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        importRe.lastIndex = 0;
+        let m;
+        while ((m = importRe.exec(src)) !== null) {
+            const spec = m[1].endsWith('.ts') ? m[1] : `${m[1]}.ts`;
+            const resolved = path.resolve(path.dirname(file), spec);
+            if (allFiles.has(resolved) && !keep.has(resolved))
+                queue.push(resolved);
+        }
+    }
+    let removed = 0;
+    for (const f of allFiles) {
+        if (!keep.has(f)) {
+            fs.rmSync(f);
+            removed++;
+        }
+    }
+    // Drop now-empty model dirs (never the DTO tree).
+    for (const entry of fs.readdirSync(generatedRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const p = path.join(generatedRoot, entry.name);
+        if (path.resolve(p) === dtoDir)
+            continue;
+        if (fs.existsSync(p) && fs.readdirSync(p).length === 0)
+            fs.rmdirSync(p);
+    }
+    console.log(`Pruned ${removed} unused GraphQL type file(s) from src/generated (read-only API).`);
+}
+exports.pruneGeneratedGraphql = pruneGeneratedGraphql;

package/dist/config/generate-models.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const utils_1 = require("./utils");
 const generate_dtos_1 = require("./generate-dtos");
+const generate_all_1 = require("./generate-all");
 const generate_modules_1 = require("./generate-modules");
 const generate_services_1 = require("./generate-services");
 const generate_controllers_1 = require("./generate-controllers");
@@ -33,11 +34,10 @@ const generate_controllers_1 = require("./generate-controllers");
 // Node resolves as ESM. Only used on the interactive path.
 const dynamicImport = new Function('m', 'return import(m)');
 async function main() {
-    // 1) Deploy-safe pass first — refresh client + GraphQL artifacts + DTO bases.
-    console.log('Running Prisma Generate (client + GraphQL artifacts)...');
-    // Project-local prisma: the CLI is usually global, so PATH has no project .bin.
-    (0, utils_1.runProjectBin)('prisma', 'generate');
-    (0, generate_dtos_1.generateDtoBases)((0, utils_1.loadAllModels)());
+    // 1) Deploy-safe pass first — refresh client + GraphQL artifacts + DTO bases
+    //    (+ prune unused GraphQL types). Shared with `appx generate` so the two
+    //    paths can't drift.
+    (0, generate_all_1.runDeploySafePass)();
     // 2) Candidates = non-framework models with no module yet. "Has a module"
     //    means either the canonical folder exists OR some existing module already
     //    serves the model via CoreController/CoreService<Model> — the latter

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAKrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CA+C/F"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAwBrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}

package/dist/graphql/generic.resolver.js

@@ -14,8 +14,28 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
+const common_1 = require("@nestjs/common");
 const plugins_1 = require("@paljs/plugins");
 const prisma_service_1 = require("../prisma/prisma.service");
+/**
+ * Run a read and translate a Prisma **validation** error into a `400`. A
+ * malformed `where`/`orderBy` value (e.g. `createdAt: { gt: 2024 }` — a number
+ * where a DateTime is expected) can slip past GraphQL coercion and reach Prisma,
+ * which throws `PrismaClientValidationError`. That's bad client input, not a
+ * server fault: surface a clean `400` instead of a `500` that leaks the raw
+ * Prisma invocation. Genuine server errors are re-thrown unchanged.
+ */
+async function readOrBadRequest(op) {
+    try {
+        return await op();
+    }
+    catch (e) {
+        if ((e?.name ?? e?.constructor?.name) === 'PrismaClientValidationError') {
+            throw new common_1.BadRequestException('Invalid query arguments (check where / orderBy types).');
+        }
+        throw e;
+    }
+}
 /**
  * Build a **namespaced, read-only** GraphQL resolver for one model.
  *
@@ -68,24 +88,31 @@ function CoreGraphqlResolver(bundle) {
         }
         async find(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            return this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select }));
         }
         async get(args, info) {
             const select = new plugins_1.PrismaSelect(info).value;
-            return this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select }));
         }
         async count(where) {
-            return this.prisma.getModelDelegate(modelName).count({ where });
+            return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).count({ where }));
         }
     };
     __decorate([
-        (0, graphql_1.Query)(() => ModelQueries, { name: rootName }),
+        (0, graphql_1.Query)(() => ModelQueries, {
+            name: rootName,
+            description: `Read queries for ${modelName} — find / get / count. All results are ABAC-filtered.`,
+        }),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", []),
         __metadata("design:returntype", ModelQueries)
     ], ModelQueriesResolver.prototype, "namespace", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => [model], { name: 'find' }),
+        (0, graphql_1.ResolveField)(() => [model], {
+            name: 'find',
+            description: `List ${modelName} records the caller may read. Paginate with take / skip / cursor; ` +
+                `filter with where; sort with orderBy. You can only filter/sort by fields your role can read.`,
+        }),
         __param(0, (0, graphql_1.Args)({ type: () => findManyArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
@@ -93,7 +120,11 @@ function CoreGraphqlResolver(bundle) {
         __metadata("design:returntype", Promise)
     ], ModelQueriesResolver.prototype, "find", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => model, { name: 'get', nullable: true }),
+        (0, graphql_1.ResolveField)(() => model, {
+            name: 'get',
+            nullable: true,
+            description: `The first ${modelName} matching the arguments, or null.`,
+        }),
         __param(0, (0, graphql_1.Args)({ type: () => findFirstArgs, nullable: true })),
         __param(1, (0, graphql_1.Info)()),
         __metadata("design:type", Function),
@@ -101,8 +132,15 @@ function CoreGraphqlResolver(bundle) {
         __metadata("design:returntype", Promise)
     ], ModelQueriesResolver.prototype, "get", null);
     __decorate([
-        (0, graphql_1.ResolveField)(() => graphql_1.Int, { name: 'count' }),
-        __param(0, (0, graphql_1.Args)('where', { type: () => whereInput, nullable: true })),
+        (0, graphql_1.ResolveField)(() => graphql_1.Int, {
+            name: 'count',
+            description: `Number of ${modelName} records matching where that the caller may read.`,
+        }),
+        __param(0, (0, graphql_1.Args)('where', {
+            type: () => whereInput,
+            nullable: true,
+            description: 'Filter. You can only filter by fields your role can read.',
+        })),
         __metadata("design:type", Function),
         __metadata("design:paramtypes", [Object]),
         __metadata("design:returntype", Promise)

package/dist/prisma/prisma.service.d.ts

@@ -113,6 +113,14 @@ export declare class PrismaService {
     private assertFilterFieldsReadable;
     /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
     private assertClauseFieldsReadable;
+    /**
+     * True when a `where` predicate on a field checks only presence/nullness —
+     * `field: null`, `{ equals: null }`, `{ not: null }` — and therefore reveals
+     * whether the value is set but never the value itself. Anything with a
+     * non-null literal (`equals: "x"`, `contains`, `gt`, `in`, …) is not
+     * presence-only.
+     */
+    private isPresenceOnlyPredicate;
     private throwUnreadableFilterField;
     private applyWhereConditions;
     /**

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IA0ClC,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -389,6 +389,13 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
             }
             // Direct reference to a field the role can't read.
             if (omit.has(key)) {
+                // A presence/nullness check (`field: null`, `{ equals: null }`,
+                // `{ not: null }`) reveals only whether the value is set — not the
+                // value — so it stays allowed on a `where` (the `hasX` / `isDeleted`
+                // pattern, without needing BYPASS_OMISSION). Any value-bearing
+                // operator, and every `orderBy`/`distinct`, still leaks and is rejected.
+                if (kind === 'where' && this.isPresenceOnlyPredicate(value))
+                    continue;
                 this.throwUnreadableFilterField(modelName, key, userRole, kind);
             }
             // Relation — recurse into the related model (unwrapping list/one filters).
@@ -408,6 +415,23 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
             // (where) or 'asc'/'desc' (orderBy) — not a field map, so no recursion.
         }
     }
+    /**
+     * True when a `where` predicate on a field checks only presence/nullness —
+     * `field: null`, `{ equals: null }`, `{ not: null }` — and therefore reveals
+     * whether the value is set but never the value itself. Anything with a
+     * non-null literal (`equals: "x"`, `contains`, `gt`, `in`, …) is not
+     * presence-only.
+     */
+    isPresenceOnlyPredicate(value) {
+        if (value === null)
+            return true; // `field: null`
+        if (typeof value !== 'object' || Array.isArray(value))
+            return false; // a literal value
+        const keys = Object.keys(value);
+        if (keys.length === 0)
+            return false;
+        return keys.every((k) => (k === 'equals' || k === 'not') && value[k] === null);
+    }
     throwUnreadableFilterField(modelName, field, userRole, kind) {
         throw new common_1.HttpException(`Cannot ${kind === 'orderBy' ? 'order by' : 'filter by'} '${modelName}.${field}' — not readable by role ${userRole}.`, common_1.HttpStatus.FORBIDDEN);
     }

package/docs/graphql.md

@@ -88,22 +88,62 @@ query {
 
 Each selected field resolves independently through the proxy (its own authorized query), so multiplexing never weakens enforcement. `count` is filtered too — it counts only the rows the caller may read, never the table total.
 
-### Nested relations & children
+### Nested relations
 
-Select related models inline, to any depth. The GraphQL selection is compiled into a single Prisma `select`, so relations come back in the same authorized query (no N+1):
+Select **to-one** relations inline — they return a single record, and the selection compiles into one Prisma `select` (no N+1):
 
 ```graphql
 query {
   album {
-    find {
+    get(where: { id: { equals: 1 } }) {
       title
-      tracks { title }              # to-many child
-      artist { name }               # to-one relation
+      artist { name }          # to-one relation — OK
     }
   }
 }
 ```
 
+**To-many relations are not nested-selectable** (`album.tracks`, `project.tasks`). Nested lists have no pagination, so an inline list could return unbounded rows. Query the list at the **top level** instead, where pagination applies:
+
+```graphql
+query {
+  album  { get(where: { id: { equals: 1 } }) { title } }
+  tracks: track { find(where: { albumId: { equals: 1 } }, take: 20, orderBy: { id: asc }) { id title } }
+}
+```
+
+You can still get a bounded **count** of a to-many relation via `_count` (`album { get { _count { tracks } } }`), and you can **filter** by a to-many relation in `where` (`some` / `every` / `none`) — that returns the parent rows, not the list.
+
+---
+
+## Filtering, sorting & pagination
+
+`find` / `get` take the generated Prisma-style arguments; `count` takes `where`.
+
+- **Pagination** (`find`): `take`, `skip`, `cursor: { <uniqueField>: … }`, `distinct: [field]`.
+- **Sorting** (`find`): `orderBy: { field: asc | desc }` — including nested to-one, `orderBy: { artist: { name: asc } }`.
+
+**`where` operators**, by field type:
+
+| Field type | Operators |
+|---|---|
+| `String` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte`, `contains`, `startsWith`, `endsWith`, `mode: insensitive` |
+| `Int` / `Float` / `Decimal` / `BigInt` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte` |
+| `Boolean` | `equals`, `not` |
+| `DateTime` | `equals`, `not`, `in`, `notIn`, `lt`, `lte`, `gt`, `gte` |
+| enum | `equals`, `not`, `in`, `notIn` |
+| nullable field | any of the above, plus `null` / `{ equals: null }` / `{ not: null }` |
+| to-one relation | `is: { … }`, `isNot: { … }` (a nested `where`) |
+| to-many relation | `some: { … }`, `every: { … }`, `none: { … }` |
+| logical | `AND`, `OR`, `NOT` |
+
+The **generated GraphQL input type is the authoritative allowlist** — an operator that isn't on a field's filter type is a GraphQL error, so unknown operators are rejected before they run. Browse the exact set per field in the Apollo Sandbox (`GET /graphql`).
+
+Two framework rules on top of that:
+
+- **You can only filter/sort by fields your role can read.** A `where`/`orderBy` on a `@Role`-hidden column is rejected with `403` — except a presence check (`{ field: null }` / `{ NOT: { field: null } }`), which reveals only whether a value is set.
+- **A malformed value returns a clean `400`.** `createdAt: { gt: 2024 }` (a number where a date is expected) is a `400`, never a `500` or a leaked Prisma error.
+
 ---
 
 ## What the caller can and cannot see (ABAC)
@@ -113,7 +153,7 @@ All three operations route through `PrismaService.getModelDelegate`, so the rule
 - **Unauthorized rows are not returned.** `find` returns only rows the role may read; `get` returns `null` for a row the caller can't access even if asked for by unique field; `count` counts only accessible rows.
 - **Restricted fields are omitted.** A column the role can't read (`/// @Role(...)`) comes back **`null`** even though the GraphQL type exposes it — at the top level *and* nested. (`prisma-nestjs-graphql` types every scalar; the proxy is what strips the values.)
 - **Inaccessible nested records are filtered.** If a nested relation points at a record the caller can't read, that relation is filtered out — a to-many yields only the visible rows; an inaccessible to-one drops the parent row. You can hold access to a record while a record it links to is withheld.
-- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either.
+- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either. The one exception is a **presence/nullness** check in `where`: `{ field: null }` / `{ NOT: { field: null } }` is allowed (it reveals only whether a value is set, not the value), so `hasX` / `isDeleted` patterns work without a bypass.
 - **Anonymous callers are `GUEST`.** With no valid `Authorization: Bearer <jwt>` (or session), the request is a GUEST; a model with no GUEST rule is denied.
 
 > Because relation records and fields are filtered by ABAC, "empty / null" means "not visible to you", not "does not exist". Design queries and UI accordingly.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.1",
+    "version": "0.1.128-beta.2",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",