@avytrix/nestjs-drizzle-crud 3.5.1 → 3.7.0

package/AGENT.md

@@ -11,7 +11,7 @@
 > # Gemini CLI reads ./GEMINI.md, Aider reads ./CONVENTIONS.md
 > ```
 >
-> Or let the agent read these docs on demand: `npx nestjs-drizzle-crud-mcp` is an
+> Or let the agent read these docs on demand: `npx -p @avytrix/nestjs-drizzle-crud nestjs-drizzle-crud-mcp` is an
 > MCP server shipped with the package. See
 > [crud.avytrix.dev/docs/ai-agents](https://crud.avytrix.dev/docs/ai-agents).
 >
@@ -56,15 +56,20 @@ service, stop and check the API reference first.
 # Installation
 
 ```bash
-pnpm add nestjs-drizzle-crud
+pnpm add @avytrix/nestjs-drizzle-crud
 pnpm add @nestjs/common @nestjs/core drizzle-orm reflect-metadata   # peers, always
 pnpm add postgres                                                   # PostgreSQL
 pnpm add mysql2                                                     # MySQL
+pnpm add @libsql/client                                             # SQLite / libSQL
 ```
 
-`postgres` is an optional peer. You only need it when you let the module build
-the connection from a `connectionString` on PostgreSQL. If you pass your own
-`db`, no driver peer is required.
+`postgres` and `mysql2` are optional peers. You only need them when you let the
+module build the connection from a `connectionString` (PostgreSQL or MySQL;
+`connection: { poolSize, idleTimeout, ssl }` tunes it). If you pass your own
+`db`, no driver peer is required. SQLite (`dialect: 'sqlite'`, also libSQL and
+Cloudflare D1) always takes your own `db`. On D1 and synchronous SQLite drivers
+the mass writes, nested creates and attach / detach / sync throw a
+`TransactionException`; use libSQL when you need them.
 
 Requires Node >= 20 and `emitDecoratorMetadata` / `experimentalDecorators` in
 `tsconfig.json`, which the Nest CLI already sets.
@@ -87,7 +92,8 @@ DrizzleCrudModule.forRootAsync({
 ```
 
 Use `forRoot` for a static config and `forRootAsync` when the value comes from
-`ConfigService` or the environment. Provide exactly one of `connectionString`
+`ConfigService` or the environment (`useFactory`, or `useClass` / `useExisting`
+with a class that implements `DrizzleCrudOptionsFactory`). Provide exactly one of `connectionString`
 or `db`. The module is global, so feature modules do not import it again for
 the connection.
 
@@ -138,7 +144,7 @@ Those are legacy manual patterns and they break registration.
 | OpenAPI | `@ApiCrudList(source)`, `@ApiCrudQuery(source)` (needs `@nestjs/swagger`) |
 | Bulk | `massCreate`, `massUpdate`, `massUpsert`, `massSoftDelete`, `massRestore`, `massDelete`, `massForceDelete` |
 | Query string | `parseQuery(query, options)`, or the standalone `parseCrudQuery(query, table, options)` |
-| Search | `fullTextSearch(term, columns, pagination)`, PostgreSQL only |
+| Search | `fullTextSearch(term, columns, pagination, { filters, relations, select, language, queryMode })`, PostgreSQL only |
 | Transaction | `executeSqlTransaction(cb)` |
 
 `findAll` returns `{ data, total, page, limit }`, not a bare array; with
@@ -246,7 +252,7 @@ ignores the primary key and `createdAt`.
 
 # Sorting and cursor pagination
 
-`sortBy` takes one column (with `sortOrder`, default `'desc'`) or a list:
+`sortBy` takes one column (with `sortOrder`, default `'asc'`) or a list:
 `['team.name', '-created_at']` or `[{ column, order }]`. A dotted entry sorts by a
 top-level belongs-to column. The primary key is always the last sort column.
 
@@ -427,7 +433,8 @@ Driver error codes are translated at the service boundary, so bad client input
 never reaches the caller as a 500: a unique violation is a 409, a value that is
 too long, fails a check, has the wrong type or is not a valid date is a 400 (on
 reads too), a foreign key pointing at a row that does not exist is a 400, and a
-delete blocked by dependent rows is a 409.
+delete blocked by dependent rows is a 409. The same holds on MySQL (strict mode
+errors included) and SQLite (constraint errors).
 
 ---
 
@@ -452,9 +459,10 @@ To insert or update by a unique key, use
 than a find followed by a create.
 
 Take a row lock with `options.lock: 'update' | 'share'` only inside a
-transaction, and prefer `forNoKeyUpdate` when the key is not changing. The lock
-covers the service's own table only (`FOR UPDATE OF <table>`), so it works with
-an eager belongs-to.
+transaction, and prefer `forNoKeyUpdate` when the key is not changing. On
+PostgreSQL the lock covers the service's own table only (`FOR UPDATE OF
+<table>`), so it works with an eager belongs-to. MySQL gets `FOR UPDATE` or
+`FOR SHARE`; on SQLite a lock is a 400.
 
 ---
 

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-All notable changes to `@avytrix/nestjs-drizzle-crud` (published as `nestjs-drizzle-crud` up to 3.5.0) are documented here.
+All notable changes to `@avytrix/nestjs-drizzle-crud` (published as `nestjs-drizzle-crud` up to 3.3.0) are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
@@ -8,6 +8,105 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Scope note: the 3.0.x line is PostgreSQL-first. MySQL-specific paths (non-`RETURNING`
 restore, `ER_DUP_ENTRY` mapping, dialect locking) are tracked separately and unchanged here.
 
+3.3.1, 3.4.0, 3.5.0 and 3.5.2 were tagged but never published to npm. Their changes reached npm
+in 3.5.1 (3.3.1 to 3.5.0) and 3.6.0 (3.5.2). The unscoped `nestjs-drizzle-crud` stops at 3.3.0.
+
+## [3.7.0] - 2026-11-02
+
+SQLite support, MySQL connections built for you, and full-text search that works like `findAll`.
+
+### Added
+
+- `dialect: "sqlite"` for SQLite, libSQL (Turso) and Cloudflare D1. Pass the Drizzle instance as
+  `db`. Writes use `RETURNING`, `upsert` uses `ON CONFLICT DO UPDATE` with the tenant guard, and
+  keyset pages follow SQLite's NULL order. `LIKE` gets `ESCAPE '\'`, so `%`, `_` and `\` in a
+  search term match literally. Constraint errors map like the other dialects: `UNIQUE` 409,
+  `FOREIGN KEY` 400 on a write and 409 on a delete, `NOT NULL` and `CHECK` 400. Full-text search,
+  row locks and the array and JSON operators are a 400.
+- On Cloudflare D1 and synchronous SQLite drivers (better-sqlite3, bun:sqlite, sql.js), the calls
+  that need an interactive transaction (mass writes, nested creates, `attach`, `detach`, `sync`)
+  throw a `TransactionException` that says why, before any statement runs. `TransactionException`
+  is no longer deprecated.
+- `connectionString` works with `dialect: "mysql"`: the module builds a `mysql2` pool, wraps it
+  with `drizzle-orm/mysql2` and ends it on shutdown. `mysql2` is a new optional peer, loaded only
+  on that path.
+- `connection: { poolSize, idleTimeout, ssl }` for the connection the module builds from
+  `connectionString`, on PostgreSQL (postgres-js) and MySQL (mysql2).
+- `forRootAsync` takes `useClass` and `useExisting`, with a class that implements
+  `DrizzleCrudOptionsFactory` (`createDrizzleCrudOptions()`), next to `useFactory`.
+- `fullTextSearch()` takes `options.filters`, and honours `options.relations`, `options.select`
+  and `options.counts`, the same as `findAll`. Before, they were ignored.
+- `language` (the text search configuration, default `"english"`) and `queryMode` (`"plain"`, the
+  default, or `"websearch"` for `websearch_to_tsquery`) on `fullTextSearch()` options and on
+  `search` with `mode: "fullText"`. A language that is not a plain identifier is a 400.
+- New types: `DrizzleConnectionOptions`, `DrizzleCrudAsyncOptions`, `DrizzleCrudOptionsFactory`,
+  `FullTextOptions`, `FullTextQueryMode` and `FullTextSearchOptions`.
+
+### Fixed
+
+- MySQL: `lock` and `forNoKeyUpdate` add `FOR UPDATE` or `FOR SHARE` (`forNoKeyUpdate` becomes
+  `FOR UPDATE`). They used to be accepted and silently ignored.
+- MySQL strict mode data errors (a missing required value, a value too long, out of range, of
+  the wrong type, a bad date, a failed check) are a 400 that names the column, instead of a 500.
+
+### Changed
+
+- The default `sql.useReturning` is `true` for every dialect except MySQL, so SQLite gets it.
+  PostgreSQL and MySQL keep the values they had.
+
+## [3.6.0] - 2026-11-02
+
+Fixes from the second audit. The first one is a security fix: upgrade if you use `scope`.
+
+### Security
+
+- Related tables now follow the tenant scope. Loaded relations, the joins behind relation columns,
+  relation filters (`some`, `none`, `every` and nested columns) and `counts` only see related rows
+  of the caller's tenant when the related table has the scope columns. Before, a row pointing at
+  another tenant's row (a plain foreign key allows it) loaded that row, and a filter on it
+  answered questions about it.
+
+### Added
+
+- `createCrudController` takes `validation`, the validator options for the bulk bodies. Pass the
+  same options as your global `ValidationPipe`.
+
+### Fixed
+
+- `PATCH /bulk` validates `data` against `dto.update`, the check a single `PATCH` already had.
+- Route decorators that wrap the handler now run. Before, the factory dropped the wrapped handler.
+- Bulk ids are parsed like `:id`, so a bad id is a 400 before any statement runs.
+- A filter nested deeper than 32 objects is a 400. A thousand nested `not` groups used to
+  overflow the stack and answer with a 500.
+- A batch past the bound-parameter limit (60,000 values: rows times columns for `massCreate` and
+  `massUpsert`, ids for the id based methods, values in an `IN` filter) is a 400 that names the
+  limit, instead of a driver protocol error and a 500.
+- A missing required value (`23502`) is a 400 that names the column.
+- MySQL `ER_DUP_ENTRY` is a 409, and foreign key errors are a 400 on a write and a 409 on a delete.
+- `upsert` no longer updates a row in the trash: the conflict writes nothing and is a 404.
+- With `useReturning: false`, a scoped `upsert` no longer reads back another tenant's row.
+- `restore` on a live row is a 404 before any hook or event runs. It used to succeed and bump
+  `updated_at` and the version.
+- `?relation[some]=` and `[none]=` with no column need the relation, or one of its columns, in
+  `filterableColumns`.
+- A nested child row cannot set its own generated primary key.
+
+## [3.5.2] - 2026-11-02
+
+### Fixed
+
+- `softDelete`, `restore`, `massSoftDelete` and `massRestore` on an entity without soft delete,
+  and full-text search on MySQL (`fullTextSearch()` or `search.mode: "fullText"`), now throw a
+  `BadRequestException`. They were a plain `Error`, which reached the client as a 500.
+- `options.counts` now applies the tenant scope to the related rows it counts, when the related
+  table has the scope column. Before, a parent's count included rows of other tenants.
+
+### Changed
+
+- `sortOrder` now defaults to `"asc"` in `findAll` and `findByCursor`, so a bare
+  `sortBy: "name"` sorts the same way as `?sortBy=name` over HTTP. Pass `sortOrder: "desc"` to
+  keep the old order.
+
 ## [3.5.1] - 2026-11-02
 
 ### Changed

package/README.md

@@ -1,11 +1,38 @@
 # nestjs-drizzle-crud
 
 [![docs](https://img.shields.io/badge/docs-crud.avytrix.dev-E0234E)](https://crud.avytrix.dev)
-[![npm](https://img.shields.io/npm/v/nestjs-drizzle-crud?color=E0234E)](https://www.npmjs.com/package/nestjs-drizzle-crud)
-[![license](https://img.shields.io/npm/l/nestjs-drizzle-crud)](./LICENSE)
+[![npm](https://img.shields.io/npm/v/@avytrix/nestjs-drizzle-crud?color=E0234E)](https://www.npmjs.com/package/@avytrix/nestjs-drizzle-crud)
+[![license](https://img.shields.io/npm/l/@avytrix/nestjs-drizzle-crud)](./LICENSE)
 [![Sponsor @avytrix](https://img.shields.io/badge/Sponsor-%40avytrix-db61a2?style=for-the-badge&logo=githubsponsors&logoColor=white)](https://github.com/sponsors/avytrix)
 
-Built and maintained by **[Avytrix Technologies](https://avytrix.dev)**.
+**nestjs-drizzle-crud is a NestJS + Drizzle ORM CRUD library: extend one base class and every table gets type-safe find, create, update, delete, filtering, pagination, relations and soft delete, on PostgreSQL, MySQL or SQLite.**
+
+```bash
+pnpm add @avytrix/nestjs-drizzle-crud drizzle-orm
+```
+
+> **Renamed.** From 3.5.1 the package is `@avytrix/nestjs-drizzle-crud`; the unscoped `nestjs-drizzle-crud` is deprecated. Change the dependency and the imports, nothing else changes.
+
+```typescript
+// app.module.ts: configure the connection once
+DrizzleCrudModule.forRoot({
+  dialect: 'postgresql',
+  connectionString: process.env.DATABASE_URL,
+  schema,
+});
+
+// users.service.ts: a full CRUD service is an empty subclass
+export class UsersService extends SqlBaseCrudService<
+  User, CreateUserDto, UpdateUserDto, CrudFilter
+> {}
+
+// users.module.ts: bind it to a table
+DrizzleCrudModule.forFeature([{ service: UsersService, table: users }]);
+```
+
+**[Read the docs at crud.avytrix.dev](https://crud.avytrix.dev)**, starting with the [quick start](https://crud.avytrix.dev/docs/quick-start/). Also on [npm](https://www.npmjs.com/package/@avytrix/nestjs-drizzle-crud) and [GitHub](https://github.com/avytrix/nestjs-drizzle-crud).
+
+Built and maintained by **[Avytrix Technologies](https://avytrix.dev/?utm_source=nestjs-drizzle-crud&utm_medium=docs&utm_campaign=readme)**. Need help shipping? [Hire the team behind the library](https://crud.avytrix.dev/docs/commercial-support/).
 
 ## ❤️ Sponsoring is what keeps this package free
 
@@ -19,36 +46,13 @@ sponsors are what make keeping it free sustainable.
 
 **Even $1 a month helps.** It funds bug fixes, new guides, and the next release.
 
-> Sponsors get a spot on the [sponsor page](https://crud.avytrix.dev/docs/sponsor)
+> Sponsors get a spot on the [sponsor page](https://crud.avytrix.dev/docs/sponsor/)
 > and our thanks.
 
 ### 👉 [Sponsor on GitHub →](https://github.com/sponsors/avytrix) &nbsp;·&nbsp; thank you 🙏
 
 ---
 
-A type-safe CRUD layer for [Drizzle ORM](https://orm.drizzle.team/) in [NestJS](https://nestjs.com/) applications.
-
-**[Documentation](https://crud.avytrix.dev)** · **[npm](https://www.npmjs.com/package/nestjs-drizzle-crud)** · **[GitHub](https://github.com/avytrix/nestjs-drizzle-crud)** · **[Sponsor](https://github.com/sponsors/avytrix)**
-
-Configure the database connection **once**, then every entity gets full CRUD (find / create / update / delete / soft-delete / bulk / pagination / filtering / full-text search) by extending one base class. No per-service connection wiring.
-
-```typescript
-// 1. configure once (app.module.ts)
-DrizzleCrudModule.forRoot({
-  dialect: 'postgresql',
-  connectionString: process.env.DATABASE_URL,
-  schema,
-});
-
-// 2. a fully-featured CRUD service is just:
-export class UsersService extends SqlBaseCrudService<User> {}
-
-// 3. bind it to a table (users.module.ts)
-DrizzleCrudModule.forFeature([{ service: UsersService, table: users }]);
-```
-
----
-
 ## Table of contents
 
 - [Features](#features)
@@ -90,7 +94,7 @@ DrizzleCrudModule.forFeature([{ service: UsersService, table: users }]);
 - 🚀 **CRUD**: `find`, `findOne`, `findAll`, `create`, `update`, `delete`, and more
 - 🧩 **Configure once**: `forRoot()` owns the connection; services only declare a table
 - ⚡ **Type-safe**: generics over your entity, create/update DTOs and filter types
-- 🗃️ **PostgreSQL & MySQL**: dialect-aware (`RETURNING` vs `insertId`)
+- 🗃️ **PostgreSQL, MySQL & SQLite**: dialect-aware (`RETURNING` vs `insertId`), libSQL and Cloudflare D1 included
 - 🔄 **Soft delete**: opt-in, with `restore`, a trash view (`onlyDeleted`) and `forceDelete`
 - 📦 **Bulk operations**: one statement per mass create/update/delete, inside a transaction, plus `upsert`
 - 🔍 **Filtering**: comparison, `in`/`notIn`, `between`, escaped `contains`/`startsWith`, array and JSON operators, `or`/`not` groups
@@ -116,11 +120,11 @@ DrizzleCrudModule.forFeature([{ service: UsersService, table: users }]);
 ## Installation
 
 ```bash
-pnpm add nestjs-drizzle-crud
+pnpm add @avytrix/nestjs-drizzle-crud
 # or
-npm install nestjs-drizzle-crud
+npm install @avytrix/nestjs-drizzle-crud
 # or
-yarn add nestjs-drizzle-crud
+yarn add @avytrix/nestjs-drizzle-crud
 ```
 
 Peer dependencies (install the ones you use):
@@ -132,22 +136,23 @@ pnpm add @nestjs/common @nestjs/core drizzle-orm reflect-metadata
 # PostgreSQL (also required if you use `connectionString` with dialect 'postgresql')
 pnpm add postgres
 
-# MySQL
+# MySQL (also required if you use `connectionString` with dialect 'mysql')
 pnpm add mysql2
 
+# SQLite / libSQL (you build the Drizzle instance and pass it as `db`)
+pnpm add @libsql/client
+
 # Only for ApiCrudQuery / ApiCrudList (OpenAPI docs)
 pnpm add @nestjs/swagger
 ```
 
 > Using npm or yarn? Swap `pnpm add` for `npm install` / `yarn add`.
 
-> **pnpm note:** `postgres`/`mysql2` are optional peer dependencies. pnpm enforces
-> peer deps strictly, so if you build the connection from a `connectionString`
-> make sure the matching driver is installed in your app.
-
-> `postgres` is an **optional** peer dependency. It's only needed when you let the
-> module build the connection from a `connectionString` for the `postgresql` dialect.
-> If you pass a pre-built `db` instead, you don't need it.
+> **pnpm note:** `postgres` and `mysql2` are optional peer dependencies. pnpm
+> enforces peer deps strictly, so if you build the connection from a
+> `connectionString` make sure the driver for your dialect is installed in your app.
+> If you pass a pre-built `db` instead, you don't need either. SQLite always takes a
+> `db` you build.
 
 ---
 
@@ -174,7 +179,7 @@ export type User = typeof users.$inferSelect;
 ```typescript
 // app.module.ts
 import { Module } from '@nestjs/common';
-import { DrizzleCrudModule } from 'nestjs-drizzle-crud';
+import { DrizzleCrudModule } from '@avytrix/nestjs-drizzle-crud';
 import { schema } from './db/schema';
 import { UsersModule } from './users/users.module';
 
@@ -198,7 +203,7 @@ application shutdown (when the module built it from a `connectionString`).
 
 ```typescript
 // users/users.service.ts
-import { SqlBaseCrudService } from 'nestjs-drizzle-crud';
+import { SqlBaseCrudService } from '@avytrix/nestjs-drizzle-crud';
 import type { User } from '../db/schema';
 
 export interface CreateUserDto { name: string; email: string }
@@ -218,7 +223,7 @@ export class UsersService extends SqlBaseCrudService<
 ```typescript
 // users/users.module.ts
 import { Module } from '@nestjs/common';
-import { DrizzleCrudModule } from 'nestjs-drizzle-crud';
+import { DrizzleCrudModule } from '@avytrix/nestjs-drizzle-crud';
 import { users } from '../db/schema';
 import { UsersController } from './users.controller';
 import { UsersService } from './users.service';
@@ -280,15 +285,16 @@ export class UsersController {
 
 | Field | Type | Description |
 |---|---|---|
-| `dialect` | `'postgresql' \| 'mysql'` | **Required.** Database dialect. |
-| `connectionString` | `string` | Connection string. The module builds the connection (PostgreSQL only). |
+| `dialect` | `'postgresql' \| 'mysql' \| 'sqlite'` | **Required.** Database dialect. `'sqlite'` covers SQLite, libSQL and Cloudflare D1. |
+| `connectionString` | `string` | Connection string. The module builds the connection (PostgreSQL with `postgres`, MySQL with `mysql2`). |
+| `connection` | `{ poolSize?, idleTimeout?, ssl? }` | Pool size, idle timeout (seconds) and TLS for the connection built from `connectionString`. |
 | `db` | `Drizzle instance` | Alternatively, pass a Drizzle instance you built yourself (any dialect). |
 | `schema` | `Record<string, unknown>` | Drizzle schema, used when building from `connectionString`. |
 | `defaults.softDelete` | `boolean` | Enable soft delete for all entities (default `true`). |
 | `defaults.timestamps` | `boolean` | Auto-manage `created_at`/`updated_at` for all entities (default `true`). |
 | `defaults.pagination` | `{ defaultLimit?, maxLimit? }` | Pagination defaults (default `{ 20, 100 }`). Either key alone keeps the other's default. |
 | `defaults.sortOrder` | `'asc' \| 'desc'` | Opt-in default sort: entities **without** an explicit `defaultSort` fall back to ordering by their `created_at` column in this direction. Omit it and `findAll` orders by the primary key only. |
-| `sql` | `{ caseSensitive?, useReturning? }` | Dialect tuning. `useReturning` defaults to `true` for PostgreSQL, `false` for MySQL. `jsonSupport` and `enableFullTextSearch` are deprecated and do nothing. |
+| `sql` | `{ caseSensitive?, useReturning? }` | Dialect tuning. `useReturning` defaults to `true` for PostgreSQL and SQLite, `false` for MySQL. `jsonSupport` and `enableFullTextSearch` are deprecated and do nothing. |
 | `hooks` | `{ enableGlobalHooks?, subscribers? }` | Module-level write events on the `CrudEventBus`. See [Events](#events-and-global-hooks). |
 
 > **Provide exactly one of `connectionString` or `db`.** If your tables have no
@@ -301,7 +307,7 @@ export class UsersController {
 > table does not have stops the app at startup, and the message names the key
 > to use.
 
-**Build the connection yourself (any dialect, recommended for MySQL):**
+**Build the connection yourself (any dialect, required for SQLite):**
 
 ```typescript
 import { drizzle } from 'drizzle-orm/postgres-js';
@@ -327,6 +333,27 @@ DrizzleCrudModule.forRootAsync({
 });
 ```
 
+`forRootAsync` also takes `useClass` or `useExisting` with a class that
+implements `DrizzleCrudOptionsFactory`:
+
+```typescript
+@Injectable()
+class CrudConfig implements DrizzleCrudOptionsFactory {
+  constructor(private readonly cfg: ConfigService) {}
+  createDrizzleCrudOptions(): DrizzleCrudConfig {
+    return { dialect: 'mysql', connectionString: this.cfg.get('DATABASE_URL') };
+  }
+}
+
+DrizzleCrudModule.forRootAsync({ useClass: CrudConfig });
+```
+
+On SQLite (`dialect: 'sqlite'`), mass writes, nested creates and attach / detach
+/ sync need an async transaction: they work on libSQL and throw a
+`TransactionException` on Cloudflare D1 and synchronous drivers such as
+better-sqlite3. Full-text search, row locks and the array and JSON operators
+are a 400 there.
+
 ### `DrizzleCrudModule.forFeature(entities)`
 
 Registers one or more services and binds each to its table. Per-entity overrides
@@ -362,7 +389,9 @@ The minimal service is an empty class. Connection, dialect and defaults are
 injected by the module:
 
 ```typescript
-export class UsersService extends SqlBaseCrudService<User> {}
+export class UsersService extends SqlBaseCrudService<
+  User, CreateUserDto, UpdateUserDto, CrudFilter
+> {}
 ```
 
 Add custom behaviour by overriding hooks (see [Lifecycle hooks](#lifecycle-hooks--validation))
@@ -590,7 +619,7 @@ await service.findAll(
 // → { data: [...], total: 240, page: 2, limit: 25 }
 ```
 
-`limit` is capped at `pagination.maxLimit`. `sortOrder` defaults to `'desc'`.
+`limit` is capped at `pagination.maxLimit`. `sortOrder` defaults to `'asc'`.
 The primary key is always the last `ORDER BY` column, so rows that tie on the
 sort column never repeat or go missing between pages.
 
@@ -1104,7 +1133,19 @@ const { data, total } = await service.fullTextSearch(
 ```
 
 Builds `to_tsvector(...) @@ plainto_tsquery(...)` across the given columns and
-orders by `ts_rank`. Throws if the dialect is not `postgresql`.
+orders by `ts_rank`. Throws a 400 if the dialect is not `postgresql`. The options
+take `filters`, `relations`, `select` and `counts` as on `findAll`, plus
+`language` (default `'english'`) and `queryMode: 'websearch'` for
+`websearch_to_tsquery`:
+
+```typescript
+await service.fullTextSearch('"zero downtime" -kubernetes', ['title', 'body'], {}, {
+  filters: { status: 'published' },
+  relations: ['author'],
+  language: 'english',
+  queryMode: 'websearch',
+});
+```
 
 For paginated list endpoints, prefer `findAll(..., ..., { search })` so search is
 combined with filters and the count query. Use `fullTextSearch` directly when
@@ -1144,7 +1185,7 @@ service stamps `created_at`/`updated_at` automatically.
 ## Testing
 
 ```typescript
-import { TestCrudFactory } from 'nestjs-drizzle-crud';
+import { TestCrudFactory } from '@avytrix/nestjs-drizzle-crud';
 
 const mockDb = TestCrudFactory.createMockDb();
 const mockTable = TestCrudFactory.createMockTable();
@@ -1164,18 +1205,18 @@ const service = TestCrudFactory.createTestService(UsersService, mockDb, mockTabl
 when they use it. Copy the pointer template to the filename your tool reads:
 
 ```bash
-cp node_modules/nestjs-drizzle-crud/AGENTS.template.md ./AGENTS.md   # Codex, Cursor, Copilot, Zed, Cline, Windsurf
-cp node_modules/nestjs-drizzle-crud/CLAUDE.template.md ./CLAUDE.md   # Claude Code
+cp node_modules/@avytrix/nestjs-drizzle-crud/AGENTS.template.md ./AGENTS.md   # Codex, Cursor, Copilot, Zed, Cline, Windsurf
+cp node_modules/@avytrix/nestjs-drizzle-crud/CLAUDE.template.md ./CLAUDE.md   # Claude Code
 # Gemini CLI reads ./GEMINI.md, Aider reads ./CONVENTIONS.md
 ```
 
-Each template is one `@node_modules/nestjs-drizzle-crud/AGENT.md` line, so an
+Each template is one `@node_modules/@avytrix/nestjs-drizzle-crud/AGENT.md` line, so an
 upgrade updates the rules with it and you never hold a stale copy.
 
 ### Or run the MCP server
 
 ```bash
-npx nestjs-drizzle-crud-mcp
+npx -p @avytrix/nestjs-drizzle-crud nestjs-drizzle-crud-mcp
 ```
 
 A stdio MCP server, zero dependencies, that serves this package's docs to any MCP
@@ -1187,7 +1228,7 @@ client through three tools: `list_docs`, `get_doc` (`agent-guide` / `readme` /
   "mcpServers": {
     "nestjs-drizzle-crud": {
       "command": "npx",
-      "args": ["-y", "nestjs-drizzle-crud-mcp"]
+      "args": ["-y", "-p", "@avytrix/nestjs-drizzle-crud", "nestjs-drizzle-crud-mcp"]
     }
   }
 }
@@ -1204,7 +1245,7 @@ read-only and never touches your database. Full setup:
 
 Use these facts instead of guessing.
 
-**Package:** `nestjs-drizzle-crud` · **Peers:** `@nestjs/common`, `@nestjs/core`, `drizzle-orm`, `reflect-metadata`; optional `postgres` (PG) / `mysql2` (MySQL) / `@nestjs/swagger` (for `ApiCrudList`).
+**Package:** `nestjs-drizzle-crud` · **Peers:** `@nestjs/common`, `@nestjs/core`, `drizzle-orm`, `reflect-metadata`; optional `postgres` (PG `connectionString`) / `mysql2` (MySQL `connectionString`) / `@nestjs/swagger` (for `ApiCrudList`). SQLite drivers are yours, passed as `db`.
 
 **Setup is two steps and no per-service connection wiring:**
 1. `DrizzleCrudModule.forRoot({ dialect, connectionString | db, schema, defaults })` once in `AppModule`.
@@ -1235,15 +1276,17 @@ export class XService extends SqlBaseCrudService<X, CreateXDto, UpdateXDto, XFil
 - Relations: declare in forFeature `config.relations` and eager-load via `options.relations: ['relName']`, where a dotted path nests (`['states', 'states.cities']`, `['state.country']`; the parent path is pulled in automatically). Belongs-to is `{ table, localKey, references? }`, LEFT JOINed into the main query, resolving to an object or `null`. Has-many is `{ table, type: 'hasMany', foreignKey, parentKey?, orderBy? }`. Many-to-many is `{ table, type: 'manyToMany', through, throughLocalKey, throughForeignKey, references?, parentKey?, orderBy? }`. Nested relations live in a `relations` map on the relation. Every collection and every nested level costs exactly one extra query for the whole result set, never one per row. Filter via `findAll({ relName: { col: value } })` with the same operators; collection filters compile to `parentKey IN (SELECT ... WHERE ...)`, so `total` stays correct. Filters go through relation paths at any depth (`{ state: { country: { code: 'IN' } } }`), and collections take `some` / `none` / `every` (`{ posts: { none: { status: 'draft' } } }`), compiled to subqueries.
 - `options.select` narrows the projection and takes dotted relation paths at any depth: `['id', 'name', 'region.code', 'states.cities.name']`. Unknown names are ignored; an all-dotted list leaves the base row complete; the parent key, the child foreign key and any nested key are re-added automatically.
 - Primary keys: `primaryKey` (default `'id'`) per entity in forFeature config (`primaryKeyType` is deprecated and does nothing). UUID works on Postgres via RETURNING; with uuid keys, route params are strings, so don't use `ParseIntPipe`.
-- Full-text search is PostgreSQL-only.
+- Full-text search is PostgreSQL-only; it takes `filters`, `relations`, `select`, `language` and `queryMode` in its options.
+- SQLite (`dialect: 'sqlite'`): pass `db`. Bulk writes need libSQL; D1 and sync drivers throw `TransactionException`. Locks, full-text and array/JSON operators are a 400.
+- Exports (3.7): `DrizzleConnectionOptions`, `DrizzleCrudAsyncOptions`, `DrizzleCrudOptionsFactory`, `FullTextOptions`, `FullTextQueryMode`, `FullTextSearchOptions`.
 - Exports (3.5): `createCrudController`, `CrudContext`, `CrudEventBus`, `ApiCrudQuery`, `ApiCrudList`, `MissingScopeException`, `StaleVersionException`, and the types `CrudControllerOptions`, `CrudEvent`, `CrudSubscriber`, `CrudScope`, `CollectionFilter`, `CountByRow`, `CrudPage`, `UncountedCrudPage`, `RelationCounts`.
-- Exports: `SqlBaseCrudService`, `DrizzleCrudModule`, `DRIZZLE_DB`, `DRIZZLE_CRUD_CONFIG`, `TestCrudFactory`, exceptions (`EntityNotFoundException`, `DuplicateEntityException`, `ForeignKeyViolationException`, `EntityInUseException`, `ValidationFailedException`, `BulkOperationException`, plus the deprecated `DatabaseConnectionException` and `TransactionException`), and types (`SqlCrudConfig`, `SqlOperationOptions`, `DrizzleCrudConfig`, `CrudFeature`, `CrudFeatureConfig`, `PaginationOptions`, `OperationOptions`, `SqlSearchOptions`, `SqlSearchMode`, `BulkOperationResult`, `BulkOperationItemError`, `SqlDialect`, `PrimaryKeyType`, `CrudFilter`, `FilterOperators`, `SortInput`, `CursorPaginationOptions`, `CursorPage`, `CrudAllowlists`, `UpsertOptions`, `BulkMode`, `ParsedCrudQuery`), and `parseCrudQuery`.
+- Exports: `SqlBaseCrudService`, `DrizzleCrudModule`, `DRIZZLE_DB`, `DRIZZLE_CRUD_CONFIG`, `TestCrudFactory`, exceptions (`EntityNotFoundException`, `DuplicateEntityException`, `ForeignKeyViolationException`, `EntityInUseException`, `ValidationFailedException`, `BulkOperationException`, `TransactionException`, plus the deprecated `DatabaseConnectionException`), and types (`SqlCrudConfig`, `SqlOperationOptions`, `DrizzleCrudConfig`, `CrudFeature`, `CrudFeatureConfig`, `PaginationOptions`, `OperationOptions`, `SqlSearchOptions`, `SqlSearchMode`, `BulkOperationResult`, `BulkOperationItemError`, `SqlDialect`, `PrimaryKeyType`, `CrudFilter`, `FilterOperators`, `SortInput`, `CursorPaginationOptions`, `CursorPage`, `CrudAllowlists`, `UpsertOptions`, `BulkMode`, `ParsedCrudQuery`), and `parseCrudQuery`.
 
 ### `SqlCrudConfig`
 
 ```typescript
 interface SqlCrudConfig {
-  dialect: 'postgresql' | 'mysql';
+  dialect: 'postgresql' | 'mysql' | 'sqlite';
   db: any;                         // Drizzle instance (injected by forFeature)
   table: any;                      // Drizzle table (set by forFeature)
   primaryKey: string;              // default 'id'

package/dist/controller/crud-controller.factory.d.ts

@@ -1,4 +1,4 @@
-import { type Type } from "@nestjs/common";
+import { type Type, type ValidationPipeOptions } from "@nestjs/common";
 import type { SqlBaseCrudService } from "../core/abstract/sql-base-crud.service";
 import type { ParseCrudQueryOptions } from "../core/interfaces/query.interface";
 import { type ApiCrudSource } from "../openapi/api-crud.decorators";
@@ -14,6 +14,7 @@ export interface CrudControllerOptions {
         create?: Type<unknown>;
         update?: Type<unknown>;
     };
+    validation?: ValidationPipeOptions;
     query?: ParseCrudQueryOptions;
     routes?: Partial<Record<CrudRouteName, boolean | CrudRouteOptions>>;
     decorators?: MethodDecorator[];

package/dist/controller/crud-controller.factory.js

@@ -10,12 +10,29 @@ const BULK_ROUTES = new Set([
     "bulkDelete",
     "bulkRestore",
 ]);
-function idsOf(body) {
+class BulkUpdateBodyPipe {
+    dto;
+    pipe;
+    constructor(dto, options) {
+        this.dto = dto;
+        this.pipe = new common_1.ValidationPipe(options);
+    }
+    async transform(body) {
+        if (!body?.data || typeof body.data !== "object")
+            return body;
+        const data = await this.pipe.transform(body.data, {
+            type: "body",
+            metatype: this.dto,
+        });
+        return { ...body, data };
+    }
+}
+async function idsOf(service, body) {
     const ids = body?.ids;
     if (!Array.isArray(ids) || ids.length === 0) {
         throw new common_1.BadRequestException("ids must be a non-empty array");
     }
-    return ids;
+    return Promise.all(ids.map((id) => service.parseId(id)));
 }
 function createCrudController(service, options = {}) {
     const routeOptions = (name) => {
@@ -78,21 +95,21 @@ function createCrudController(service, options = {}) {
             }
             return this.service.massCreate(body, readOptions(this.service, query));
         }
-        bulkUpdate(body, query) {
+        async bulkUpdate(body, query) {
             if (!body?.data || typeof body.data !== "object") {
                 throw new common_1.BadRequestException("data must be an object");
             }
-            return this.service.massUpdate(idsOf(body), body.data, readOptions(this.service, query));
+            return this.service.massUpdate(await idsOf(this.service, body), body.data, readOptions(this.service, query));
         }
-        bulkDelete(body) {
-            const ids = idsOf(body);
+        async bulkDelete(body) {
+            const ids = await idsOf(this.service, body);
             return options.deleteMode === "soft"
                 ? this.service.massSoftDelete(ids)
                 : this.service.massDelete(ids);
         }
-        bulkRestore(body, query) {
+        async bulkRestore(body, query) {
             softDeleteOn(this.service);
-            return this.service.massRestore(idsOf(body), readOptions(this.service, query));
+            return this.service.massRestore(await idsOf(this.service, body), readOptions(this.service, query));
         }
         async get(rawId, query) {
             const id = await this.id(rawId);
@@ -148,7 +165,10 @@ function createCrudController(service, options = {}) {
             http: (0, common_1.Post)("bulk"),
             params: [
                 options.dto?.create
-                    ? (0, common_1.Body)(new common_1.ParseArrayPipe({ items: options.dto.create }))
+                    ? (0, common_1.Body)(new common_1.ParseArrayPipe({
+                        ...options.validation,
+                        items: options.dto.create,
+                    }))
                     : (0, common_1.Body)(),
                 (0, common_1.Query)(),
             ],
@@ -157,7 +177,12 @@ function createCrudController(service, options = {}) {
         {
             name: "bulkUpdate",
             http: (0, common_1.Patch)("bulk"),
-            params: [(0, common_1.Body)(), (0, common_1.Query)()],
+            params: [
+                options.dto?.update
+                    ? (0, common_1.Body)(new BulkUpdateBodyPipe(options.dto.update, options.validation))
+                    : (0, common_1.Body)(),
+                (0, common_1.Query)(),
+            ],
             types: [Object, Object],
             extra: [(0, common_1.HttpCode)(200)],
         },
@@ -227,19 +252,22 @@ function createCrudController(service, options = {}) {
             configurable: true,
             enumerable: false,
         });
-        const descriptor = Object.getOwnPropertyDescriptor(proto, route.name);
+        let descriptor = Object.getOwnPropertyDescriptor(proto, route.name);
         route.params.forEach((decorate, index) => {
             decorate(proto, route.name, index);
         });
         Reflect.defineMetadata("design:paramtypes", route.types, proto, route.name);
-        for (const decorate of [
+        const decorators = [
             route.http,
             ...(route.extra ?? []),
-            ...(options.decorators ?? []),
             ...(settings.decorators ?? []),
-        ]) {
-            decorate(proto, route.name, descriptor);
+            ...(options.decorators ?? []),
+        ];
+        for (const decorate of decorators.reverse()) {
+            descriptor =
+                decorate(proto, route.name, descriptor) ?? descriptor;
         }
+        Object.defineProperty(proto, route.name, descriptor);
     }
     for (const decorate of options.classDecorators ?? []) {
         decorate(CrudController);