@appxdigital/appx-core 0.1.128-beta.3 → 0.1.128-beta.5

package/CHANGELOG.md

@@ -29,6 +29,8 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 - **Nested selection is to-one only.** Generated GraphQL model types expose scalars, **to-one** relations, and `_count`; **to-many relations are not nested-selectable** (nested lists have no pagination, so they could return unbounded rows). Fetch a list at the top level with pagination — `track { find(where: { albumId … }, take, skip) }`. Filtering by a to-many relation in `where` (`some`/`every`/`none`) and `_count { … }` still work.
 - **Self-documenting operations.** `find` / `get` / `count` and their `where` arg carry GraphQL descriptions (visible in the Apollo Sandbox); model-field descriptions come from Prisma `///` doc comments as before. See [docs/graphql.md](./docs/graphql.md) for the full `where`/`orderBy`/pagination reference.
 - **Malformed filter values return `400`, not `500`.** A `where`/`orderBy` value Prisma can't parse (e.g. `createdAt: { gt: 2024 }` — a number where a date is expected) now surfaces a clean `400`, instead of an internal error that leaked the raw Prisma invocation.
+- **Output shaping via native field resolvers.** Transform a field on the way out (sign a stored key into a URL, mask, format) or add a computed field with a `@Resolver(() => Model)` + `@ResolveField`, registered in the module. A field resolver reads its source columns from `@Parent()`; ABAC field omission still runs at query time, so a transform never sees a `@Role`-restricted column. New **`@FieldRequires('col')`** (one column, several, or an array) declares which columns a field reads so the generated `find`/`get` fetches exactly those — for a computed field, an in-place override, **and a field on a nested relation** (the source columns are resolved from a bootstrap registry, so declarations apply at every level). Undeclared field resolvers fall back to fetching the model's scalar columns; relations always stay selection-driven. See [docs/graphql.md](./docs/graphql.md) → *Shaping read output*.
+- **GraphQL introspection on in development.** The Apollo Sandbox (`GET /graphql`) needs introspection, which Apollo Server v4 disables under `NODE_ENV=production` (`INTROSPECTION_DISABLED`). It is now enabled in development and disabled in production by default (defense-in-depth — introspection exposes schema shape, not data, which ABAC still governs). Opt in for a production deployment with `APPX_GRAPHQL_INTROSPECTION=true`.
 
 ### Fixed
 

package/dist/common/decorators/field-requires.decorator.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Reflect metadata key under which {@link FieldRequires} records a field
+ * resolver's source columns. Read at bootstrap by the GraphQL field-requires
+ * scanner (see `field-requires.registry.ts`) to build the model→field→columns
+ * registry the read resolver consults.
+ */
+export declare const FIELD_REQUIRES_METADATA = "appx:field_requires";
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them — at the top level and on nested relations.
+ *
+ * Use it on a computed field or an in-place transform whose value derives from a
+ * column, e.g. a signed `coverUrl` built from a stored `coverKey`. Without it,
+ * only the columns the client selected are fetched and `@Parent().coverKey` would
+ * be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+export declare const FieldRequires: (...columns: (string | string[])[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=field-requires.decorator.d.ts.map

package/dist/common/decorators/field-requires.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-requires.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/field-requires.decorator.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,aAAa,eAAgB,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,qDACP,CAAC"}

package/dist/common/decorators/field-requires.decorator.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRequires = exports.FIELD_REQUIRES_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Reflect metadata key under which {@link FieldRequires} records a field
+ * resolver's source columns. Read at bootstrap by the GraphQL field-requires
+ * scanner (see `field-requires.registry.ts`) to build the model→field→columns
+ * registry the read resolver consults.
+ */
+exports.FIELD_REQUIRES_METADATA = 'appx:field_requires';
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them — at the top level and on nested relations.
+ *
+ * Use it on a computed field or an in-place transform whose value derives from a
+ * column, e.g. a signed `coverUrl` built from a stored `coverKey`. Without it,
+ * only the columns the client selected are fetched and `@Parent().coverKey` would
+ * be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+const FieldRequires = (...columns) => (0, common_1.SetMetadata)(exports.FIELD_REQUIRES_METADATA, columns.flat());
+exports.FieldRequires = FieldRequires;

package/dist/graphql/field-requires.registry.d.ts

@@ -0,0 +1,27 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, MetadataScanner } from '@nestjs/core';
+/**
+ * Look up a field resolver on a model. Returns `undefined` if the field is not a
+ * custom `@ResolveField` (i.e. a plain column), otherwise `{ requires }` where
+ * `requires` is the declared columns or `null` if none were declared.
+ */
+export declare function getFieldRequires(model: string, field: string): {
+    requires: string[] | null;
+} | undefined;
+/**
+ * Scans every resolver provider once at startup and records each `@ResolveField`
+ * as `Model.field` → its `@FieldRequires` columns. Runs after all providers are
+ * instantiated, so field resolvers registered in any feature module are included.
+ *
+ * This scan (not a per-request read) is required because the code that builds the
+ * Prisma query — the generated `find`/`get` — must know the source columns of
+ * field resolvers on OTHER classes and nested relation models, not just the
+ * executing handler.
+ */
+export declare class FieldRequiresScanner implements OnModuleInit {
+    private readonly discovery;
+    private readonly scanner;
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner);
+    onModuleInit(): void;
+}
+//# sourceMappingURL=field-requires.registry.d.ts.map

package/dist/graphql/field-requires.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-requires.registry.d.ts","sourceRoot":"","sources":["../../src/graphql/field-requires.registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAC,gBAAgB,EAAE,eAAe,EAAC,MAAM,cAAc,CAAC;AAqB/D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAC,GAAG,SAAS,CAMtG;AAED;;;;;;;;;GASG;AACH,qBACa,oBAAqB,YAAW,YAAY;IAEjD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe;IAG7C,YAAY,IAAI,IAAI;CA+BvB"}

package/dist/graphql/field-requires.registry.js

@@ -0,0 +1,96 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRequiresScanner = exports.getFieldRequires = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const field_requires_decorator_1 = require("../common/decorators/field-requires.decorator");
+// NestJS GraphQL reflect keys (set by @Resolver / @ResolveField). Reading them is
+// how we recover, for each field resolver, the model it belongs to and the field
+// it resolves — including in-place overrides, whose declared columns never reach
+// the built schema field.
+const RESOLVER_NAME_METADATA = 'graphql:resolver_name';
+const RESOLVER_PROPERTY_METADATA = 'graphql:resolve_property';
+/**
+ * `Model.field` → the columns the field resolver reads, or `null` when the field
+ * is a custom resolver that declared nothing (an undeclared resolver means "fetch
+ * this model's scalars, we can't know what it reads"). Absence of a key means the
+ * field is not a custom resolver at all (a plain column).
+ *
+ * Populated once at bootstrap by {@link FieldRequiresScanner}; read by the
+ * generated read resolver when building the Prisma `select`.
+ */
+const registry = new Map();
+/**
+ * Look up a field resolver on a model. Returns `undefined` if the field is not a
+ * custom `@ResolveField` (i.e. a plain column), otherwise `{ requires }` where
+ * `requires` is the declared columns or `null` if none were declared.
+ */
+function getFieldRequires(model, field) {
+    const key = `${model}.${field}`;
+    if (!registry.has(key)) {
+        return undefined;
+    }
+    return { requires: registry.get(key) ?? null };
+}
+exports.getFieldRequires = getFieldRequires;
+/**
+ * Scans every resolver provider once at startup and records each `@ResolveField`
+ * as `Model.field` → its `@FieldRequires` columns. Runs after all providers are
+ * instantiated, so field resolvers registered in any feature module are included.
+ *
+ * This scan (not a per-request read) is required because the code that builds the
+ * Prisma query — the generated `find`/`get` — must know the source columns of
+ * field resolvers on OTHER classes and nested relation models, not just the
+ * executing handler.
+ */
+let FieldRequiresScanner = exports.FieldRequiresScanner = class FieldRequiresScanner {
+    constructor(discovery, scanner) {
+        this.discovery = discovery;
+        this.scanner = scanner;
+    }
+    onModuleInit() {
+        registry.clear();
+        for (const wrapper of this.discovery.getProviders()) {
+            const instance = wrapper.instance;
+            if (!instance || typeof instance !== 'object') {
+                continue;
+            }
+            // The model a resolver is bound to: @Resolver(() => Model) records the
+            // model name on the class under RESOLVER_NAME_METADATA.
+            const model = Reflect.getMetadata(RESOLVER_NAME_METADATA, instance.constructor);
+            if (!model || typeof model !== 'string') {
+                continue; // not a model-bound resolver (root resolvers, other providers)
+            }
+            const prototype = Object.getPrototypeOf(instance);
+            if (!prototype) {
+                continue;
+            }
+            for (const methodName of this.scanner.getAllMethodNames(prototype)) {
+                const handler = prototype[methodName];
+                if (typeof handler !== 'function') {
+                    continue;
+                }
+                if (Reflect.getMetadata(RESOLVER_PROPERTY_METADATA, handler) !== true) {
+                    continue; // not a @ResolveField
+                }
+                const field = Reflect.getMetadata(RESOLVER_NAME_METADATA, handler) || methodName;
+                const requires = Reflect.getMetadata(field_requires_decorator_1.FIELD_REQUIRES_METADATA, handler);
+                registry.set(`${model}.${field}`, Array.isArray(requires) ? requires : null);
+            }
+        }
+    }
+};
+exports.FieldRequiresScanner = FieldRequiresScanner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner])
+], FieldRequiresScanner);

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAwBrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAoIrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}

package/dist/graphql/generic.resolver.js

@@ -16,7 +16,9 @@ exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
 const common_1 = require("@nestjs/common");
 const plugins_1 = require("@paljs/plugins");
+const graphql_2 = require("graphql");
 const prisma_service_1 = require("../prisma/prisma.service");
+const field_requires_registry_1 = require("./field-requires.registry");
 /**
  * Run a read and translate a Prisma **validation** error into a `400`. A
  * malformed `where`/`orderBy` value (e.g. `createdAt: { gt: 2024 }` — a number
@@ -36,6 +38,101 @@ async function readOrBadRequest(op) {
         throw e;
     }
 }
+/**
+ * Build the Prisma `select` for a read so that every custom `@ResolveField` — at
+ * the top level and on nested relations — receives its source columns in
+ * `@Parent()`.
+ *
+ * `PrismaSelect` narrows each query to the columns the GraphQL request selected,
+ * which breaks the standard NestJS contract that a `@ResolveField` receives the
+ * full entity: a transform or computed field can't read a column the client
+ * didn't also select, and on a nested relation not even its own key is
+ * guaranteed. Using the `@FieldRequires` registry (populated at bootstrap), each
+ * selected field that is a custom resolver contributes its declared source
+ * columns; a resolver that declared nothing falls back to the model's scalar
+ * columns. Plain columns are fetched as-is, so a query with no custom fields is
+ * exactly what was asked for. Relations stay selection-driven — only selected
+ * relations are fetched, and each is recursed into so its own resolvers get their
+ * columns too. ABAC field omission runs afterward in the proxy and strips
+ * `@Role`-restricted columns at select-time, so a caller — and a transform — only
+ * ever sees readable columns.
+ *
+ * Custom field names with no backing column are dropped: `PrismaSelect` puts every
+ * requested GraphQL field into the `select`, and passing a name Prisma doesn't
+ * recognise throws a validation error. They resolve from the parent afterward.
+ */
+function selectReadColumns(select, info, prisma, modelName) {
+    const named = (0, graphql_2.getNamedType)(info.returnType);
+    const type = named instanceof graphql_2.GraphQLObjectType ? named : null;
+    const requested = select?.select && typeof select.select === 'object' ? select.select : {};
+    const resolved = resolveLevelColumns(requested, type, prisma, modelName);
+    return { ...(select && typeof select === 'object' ? select : {}), select: resolved };
+}
+/**
+ * Per-level worker for {@link selectReadColumns}: resolve the columns fetched for
+ * one model, recursing into each selected relation against its own model type.
+ */
+function resolveLevelColumns(requested, type, prisma, modelName) {
+    const scalars = prisma.getScalarFields(modelName);
+    const scalarSet = new Set(scalars);
+    const fields = type ? type.getFields() : undefined;
+    const out = {};
+    const needed = new Set();
+    let fetchAllScalars = false;
+    for (const [key, value] of Object.entries(requested)) {
+        if (value && typeof value === 'object') {
+            // A relation or `_count`. Recurse into a known relation model so its
+            // own field resolvers get their source columns (a relation's GraphQL
+            // type name is its Prisma model name); keep `_count`/opaque verbatim.
+            const relField = fields?.[key];
+            if (relField && value.select && typeof value.select === 'object') {
+                const relType = (0, graphql_2.getNamedType)(relField.type);
+                if (relType instanceof graphql_2.GraphQLObjectType && prisma.getScalarFields(relType.name).length) {
+                    out[key] = {
+                        ...value,
+                        select: resolveLevelColumns(value.select, relType, prisma, relType.name),
+                    };
+                    continue;
+                }
+            }
+            out[key] = value;
+            continue;
+        }
+        if (scalarSet.has(key)) {
+            out[key] = value; // a real scalar column — keep even if also overridden by a resolver
+        }
+        // Is this field a custom @ResolveField on this model (new field OR in-place
+        // override)? The registry knows, and knows its declared source columns.
+        const entry = (0, field_requires_registry_1.getFieldRequires)(modelName, key);
+        if (entry) {
+            if (entry.requires) {
+                for (const col of entry.requires) {
+                    if (scalarSet.has(col))
+                        needed.add(col);
+                }
+            }
+            else {
+                fetchAllScalars = true; // a resolver that declared nothing — fetch all scalars
+            }
+        }
+        // else: a plain column (already added above) or an unknown non-column
+        // field name — dropped; it resolves from @Parent() afterward.
+    }
+    if (fetchAllScalars) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    else {
+        for (const col of needed)
+            out[col] = true;
+    }
+    // An empty select is invalid Prisma; fall back to the model's scalar columns.
+    if (Object.keys(out).length === 0) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    return out;
+}
 /**
  * Build a **namespaced, read-only** GraphQL resolver for one model.
  *
@@ -87,11 +184,11 @@ function CoreGraphqlResolver(bundle) {
             return {};
         }
         async find(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select }));
         }
         async get(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select }));
         }
         async count(where) {

package/dist/graphql/graphql.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAca,aAAa;CAAG"}
+{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBA0Ba,aAAa;CAAG"}

package/dist/graphql/graphql.module.js

@@ -11,8 +11,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GraphqlModule = exports.AppxCoreRootResolver = void 0;
 const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
 const graphql_1 = require("@nestjs/graphql");
 const apollo_1 = require("@nestjs/apollo");
+const field_requires_registry_1 = require("./field-requires.registry");
 /**
  * Always-present root query. GraphQL requires a non-empty `Query` type, but a
  * project may register `GraphqlModule` before any model has opted in (models
@@ -41,6 +43,8 @@ let GraphqlModule = exports.GraphqlModule = class GraphqlModule {
 exports.GraphqlModule = GraphqlModule = __decorate([
     (0, common_1.Module)({
         imports: [
+            // DiscoveryService/MetadataScanner power the @FieldRequires bootstrap scan.
+            core_1.DiscoveryModule,
             graphql_1.GraphQLModule.forRoot({
                 driver: apollo_1.ApolloDriver,
                 context: ({ req, res }) => ({ req, res }),
@@ -49,8 +53,17 @@ exports.GraphqlModule = GraphqlModule = __decorate([
                 // `src/generated/` path at boot (CI, read-only deploys, tests).
                 autoSchemaFile: true,
                 sortSchema: true,
+                // Introspection powers the Apollo Sandbox (GET /graphql). It exposes
+                // the schema shape (not data — ABAC still governs every field), so we
+                // keep it ON in development for the Sandbox, and OFF in production as
+                // defense-in-depth (less recon surface). Opt back in for a production
+                // deployment with APPX_GRAPHQL_INTROSPECTION=true. Without this, Apollo
+                // Server v4 disables introspection under NODE_ENV=production and the
+                // Sandbox fails with `INTROSPECTION_DISABLED`.
+                introspection: process.env.NODE_ENV !== 'production' ||
+                    process.env.APPX_GRAPHQL_INTROSPECTION === 'true',
             }),
         ],
-        providers: [AppxCoreRootResolver],
+        providers: [AppxCoreRootResolver, field_requires_registry_1.FieldRequiresScanner],
     })
 ], GraphqlModule);

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/decorators/field-requires.decorator';
 export * from './common/setup/setup-core-security';
 export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -56,6 +56,7 @@ __exportStar(require("./common/interfaces/storage-service.interface"), exports);
 __exportStar(require("./modules/file/file-upload.controller"), exports);
 __exportStar(require("./modules/file/file-upload.service"), exports);
 __exportStar(require("./common/decorators/permission.decorator"), exports);
+__exportStar(require("./common/decorators/field-requires.decorator"), exports);
 __exportStar(require("./common/setup/setup-core-security"), exports);
 __exportStar(require("./common/setup/core-config"), exports);
 __exportStar(require("./common/interceptors/file.interceptor"), exports);

package/dist/prisma/prisma.service.d.ts

@@ -229,6 +229,21 @@ export declare class PrismaService {
      * @returns The condition with placeholders replaced by actual values.
      */
     private static replacePlaceholders;
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName: string): string[];
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI5C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -981,6 +981,23 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         }
         return condition;
     }
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName) {
+        return this.fieldConfigs[modelName.toLowerCase()]?.scalarFields ?? [];
+    }
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/docs/graphql.md

@@ -162,6 +162,68 @@ Always let the generated resolver serve the data — a custom resolver that reac
 
 ---
 
+## Shaping read output (transforms & computed fields)
+
+To transform a field on the way out (sign a stored S3 key into a URL, mask a value, format a date) or to add a computed field (`slug`, `fullName`), attach a field resolver to the generated model type in the model's module:
+
+```ts
+// src/modules/project/project.fields.ts
+import { Parent, ResolveField, Resolver } from '@nestjs/graphql';
+import { FieldRequires } from '@appxdigital/appx-core';
+import { Project } from '../../generated/project/project.model';
+import { UrlSigner } from '../../shared/url-signer.service';
+
+@Resolver(() => Project)
+export class ProjectFields {
+  constructor(private readonly urls: UrlSigner) {}
+
+  // transform an existing field in place — same name, same type
+  @ResolveField(() => String, { name: 'coverKey', nullable: true })
+  coverKey(@Parent() p: Project) {
+    return p.coverKey ? this.urls.sign(p.coverKey) : null;   // stored key → signed URL
+  }
+
+  // add a computed field — declare the column(s) it reads
+  @ResolveField(() => String, { nullable: true })
+  @FieldRequires('name')
+  slug(@Parent() p: Project) {
+    return p.name ? p.name.toLowerCase().replace(/\s+/g, '-') : null;
+  }
+}
+```
+```ts
+// project.module.ts
+providers: [ProjectService, ProjectResolver, ProjectFields]
+```
+
+The resolver runs wherever the model appears, including nested — `project { find { coverKey } }` and `projectMember { find { project { coverKey } } }` both return the transformed value.
+
+It reads from the already-filtered parent row, so it only ever sees columns the caller's role may read. A field computed from a `@Role`-restricted column receives that column as absent, so a transform cannot surface a value the role can't read.
+
+### `@FieldRequires` — declare a computed field's source columns
+
+A computed field reads columns from its parent, but the query fetches only the columns the client selected. Declare the columns the field reads so they are fetched even when the client didn't select them:
+
+```ts
+@ResolveField(() => String, { nullable: true })
+@FieldRequires('coverKey')                  // one column
+coverUrl(@Parent() p: Project) { … }
+
+@ResolveField(() => String, { nullable: true })
+@FieldRequires(['firstName', 'lastName'])   // a list, or @FieldRequires('firstName', 'lastName')
+fullName(@Parent() p: Project) { … }
+```
+
+- **Declared** → only those columns are fetched for the field. Works the same for a computed field, an in-place override, and a field on a nested relation.
+- **Not declared** → all of the model's scalar columns are fetched, so the field can read any of them from its parent.
+- **In-place transform reading only its own column** → needs no declaration; that column is fetched whenever the client selects the field. Declare `@FieldRequires` for any *other* columns it reads.
+
+Read from `@Parent()`, not the raw Prisma client — re-querying bypasses ABAC. For key-to-URL transforms, reuse the existing field's name so the raw stored value never leaves the server.
+
+> The REST CRUD endpoints return rows as stored; output shaping applies to the GraphQL read API.
+
+---
+
 ## Not available yet
 
 - **Mutations** (create/update/delete) — use REST.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.3",
+    "version": "0.1.128-beta.5",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",