@opensaas/stack-core 0.35.0 → 0.37.0

package/src/context/index.ts

@@ -7,11 +7,14 @@ import {
   buildIncludeWithAccessControl,
   mergeIncludeWithAccessControl,
   stripVirtualFieldsFromInclude,
+  foldDeclaredDependencies,
 } from '../access/index.js'
+import type { DeclaredOnlyTree } from '../access/index.js'
 import { ValidationError, DatabaseError } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
 import type { PrismaClientLike } from '../access/types.js'
 import { buildInclude, pickFields, isFragment } from '../query/index.js'
+import type { FieldSelection } from '../query/index.js'
 import { getRelationshipOptions } from '../query/relationship-options.js'
 import {
   runWritePipeline,
@@ -910,6 +913,62 @@ export function buildDbDelegate<TPrisma extends PrismaClientLike>(
   return db as AccessControlledDB<TPrisma>
 }
 
+/**
+ * Resolve the `include` (and declared-dependency provenance) a read should
+ * use, preserving each existing path's exact shape — fragment / sudo /
+ * caller include / bare (ADR-0024) — while folding declared dependencies
+ * (`needs`, ADR-0025) into whichever of those the read is already using.
+ *
+ * A fragment's own `include` and a sudo caller's `include` are folded and
+ * used as-is, matching their existing (unmerged) treatment. A non-sudo
+ * caller include is folded and then merged through the same
+ * access-scoping pipeline as before. A bare read stays on the exact
+ * ADR-0024 path — `include: undefined`, no related `query` access
+ * evaluated — unless folding actually added something, which only happens
+ * when a field on this list declares `needs`.
+ */
+async function resolveReadInclude(
+  callerInclude: Record<string, unknown> | undefined,
+  fragmentFields: FieldSelection<unknown> | undefined,
+  listName: string,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  context: AccessContext & { _isSudo?: boolean },
+  config: OpenSaasConfig,
+): Promise<{ include: Record<string, unknown> | undefined; declaredOnly: DeclaredOnlyTree }> {
+  if (fragmentFields !== undefined) {
+    const fragmentInclude = buildInclude(fragmentFields) ?? undefined
+    return foldDeclaredDependencies(fragmentInclude, listConfig.fields, config)
+  }
+
+  if (context._isSudo) {
+    return foldDeclaredDependencies(callerInclude, listConfig.fields, config)
+  }
+
+  const folded = foldDeclaredDependencies(callerInclude, listConfig.fields, config)
+  if (!folded.include) {
+    return folded
+  }
+
+  const accessControlledInclude = await buildIncludeWithAccessControl(
+    listConfig.fields,
+    { session: context.session, context },
+    config,
+    0,
+    // Seed the cycle guard with the root list so a relationship cycle back
+    // to it (self-referential or longer) stops re-descending.
+    [listName],
+  )
+  const include = mergeIncludeWithAccessControl(
+    folded.include,
+    accessControlledInclude,
+    listConfig.fields,
+    config,
+    listName,
+  )
+  return { include, declaredOnly: folded.declaredOnly }
+}
+
 /**
  * Create findUnique operation with access control
  */
@@ -969,47 +1028,18 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
     // instead of the access-controlled include. Access control still runs via
     // filterReadableFields; the fragment then narrows to only the requested fields.
     const fragment = isFragment(args.query) ? args.query : null
-    let include: Record<string, unknown> | undefined
 
-    if (fragment) {
-      include = buildInclude(fragment._fields) ?? undefined
-    } else if (context._isSudo) {
-      // Sudo bypasses access control entirely — the caller's include is trusted
-      // and used as-is (matching the prior behaviour); no per-relation filtering.
-      include = args.include
-    } else if (args.include) {
-      // Caller named relations to fetch — build the access-controlled include
-      // and MERGE (not replace) it with the caller's: the caller selects WHICH
-      // relations to fetch, access control decides WHETHER and WITH WHAT
-      // filter (#566). A caller include naming a relation past the depth the
-      // engine can scope throws `AccessScopeDepthExceededError` (issue #830)
-      // rather than being returned unscoped.
-      const accessControlledInclude = await buildIncludeWithAccessControl(
-        listConfig.fields,
-        {
-          session: context.session,
-          context,
-        },
-        config,
-        0,
-        // Seed the cycle guard with the root list so a relationship cycle back
-        // to it (self-referential or longer) stops re-descending.
-        [listName],
-      )
-      include = mergeIncludeWithAccessControl(
-        args.include,
-        accessControlledInclude,
-        listConfig.fields,
-        config,
-        listName,
-      )
-    } else {
-      // A bare read (no caller `include`) fetches the row's own columns only,
-      // matching Prisma's semantics for the same call (ADR-0024). Relations
-      // are fetched only when a caller names them. This also means no related
-      // list's operation-level `query` access is evaluated on a bare read.
-      include = undefined
-    }
+    // Resolve `include`, folding any declared dependencies (`needs`,
+    // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
+    // already produces — see `resolveReadInclude`'s doc comment.
+    let { include, declaredOnly } = await resolveReadInclude(
+      args.include,
+      fragment ? fragment._fields : undefined,
+      listName,
+      listConfig,
+      context,
+      config,
+    )
 
     // Virtual fields have no database column. Whichever path produced
     // `include` (fragment, access-controlled merge, or sudo passthrough), a
@@ -1043,6 +1073,7 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
       config,
       0,
       listName,
+      declaredOnly,
     )
 
     // When a fragment is provided, pick only the requested fields from the result
@@ -1110,46 +1141,18 @@ function createFindMany<TPrisma extends PrismaClientLike>(
 
     // When a query fragment is provided, build include from fragment fields
     const fragment = isFragment(args?.query) ? args.query : null
-    let include: Record<string, unknown> | undefined
-    if (fragment) {
-      include = buildInclude(fragment._fields) ?? undefined
-    } else if (context._isSudo) {
-      // Sudo bypasses access control entirely — the caller's include is trusted
-      // and used as-is (matching the prior behaviour); no per-relation filtering.
-      include = args?.include
-    } else if (args?.include) {
-      // Caller named relations to fetch — build the access-controlled include
-      // and MERGE (not replace) it with the caller's: the caller selects WHICH
-      // relations to fetch, access control decides WHETHER and WITH WHAT
-      // filter (#566). A caller include naming a relation past the depth the
-      // engine can scope throws `AccessScopeDepthExceededError` (issue #830)
-      // rather than being returned unscoped.
-      const accessControlledInclude = await buildIncludeWithAccessControl(
-        listConfig.fields,
-        {
-          session: context.session,
-          context,
-        },
-        config,
-        0,
-        // Seed the cycle guard with the root list so a relationship cycle back
-        // to it (self-referential or longer) stops re-descending.
-        [listName],
-      )
-      include = mergeIncludeWithAccessControl(
-        args.include,
-        accessControlledInclude,
-        listConfig.fields,
-        config,
-        listName,
-      )
-    } else {
-      // A bare read (no caller `include`) fetches each row's own columns only,
-      // matching Prisma's semantics for the same call (ADR-0024). Relations
-      // are fetched only when a caller names them. This also means no related
-      // list's operation-level `query` access is evaluated on a bare read.
-      include = undefined
-    }
+
+    // Resolve `include`, folding any declared dependencies (`needs`,
+    // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
+    // already produces — see `resolveReadInclude`'s doc comment.
+    let { include, declaredOnly } = await resolveReadInclude(
+      args?.include,
+      fragment ? fragment._fields : undefined,
+      listName,
+      listConfig,
+      context,
+      config,
+    )
 
     // Virtual fields have no database column. Whichever path produced
     // `include` (fragment, access-controlled merge, or sudo passthrough), a
@@ -1184,6 +1187,7 @@ function createFindMany<TPrisma extends PrismaClientLike>(
           config,
           0,
           listName,
+          declaredOnly,
         ),
       ),
     )
@@ -1453,42 +1457,18 @@ function createGet<TPrisma extends PrismaClientLike>(
     // instead of the access-controlled include. Access control still runs via
     // filterReadableFields; the fragment then narrows to only the requested fields.
     const fragment = isFragment(args?.query) ? args.query : null
-    let include: Record<string, unknown> | undefined
 
-    if (fragment) {
-      include = buildInclude(fragment._fields) ?? undefined
-    } else if (context._isSudo) {
-      // Sudo bypasses access control entirely — the caller's include is trusted
-      // and used as-is; no per-relation filtering.
-      include = args?.include
-    } else if (args?.include) {
-      // Caller named relations to fetch — build the access-controlled include
-      // and MERGE (not replace) it with the caller's, exactly like the other
-      // read ops (#566/#830).
-      const accessControlledInclude = await buildIncludeWithAccessControl(
-        listConfig.fields,
-        {
-          session: context.session,
-          context,
-        },
-        config,
-        0,
-        // Seed the cycle guard with the root list so a relationship cycle back
-        // to it (self-referential or longer) stops re-descending.
-        [listName],
-      )
-      include = mergeIncludeWithAccessControl(
-        args.include,
-        accessControlledInclude,
-        listConfig.fields,
-        config,
-        listName,
-      )
-    } else {
-      // A bare read (no caller `include`) fetches the row's own columns only,
-      // matching Prisma's semantics for the same call (ADR-0024).
-      include = undefined
-    }
+    // Resolve `include`, folding any declared dependencies (`needs`,
+    // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
+    // already produces — see `resolveReadInclude`'s doc comment.
+    let { include, declaredOnly } = await resolveReadInclude(
+      args?.include,
+      fragment ? fragment._fields : undefined,
+      listName,
+      listConfig,
+      context,
+      config,
+    )
 
     // Virtual fields have no database column and must never reach Prisma (#628).
     include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
@@ -1512,6 +1492,7 @@ function createGet<TPrisma extends PrismaClientLike>(
         config,
         0,
         listName,
+        declaredOnly,
       )
       // When a fragment is provided, pick only the requested fields from the result
       if (fragment) {

package/src/fields/index.ts

@@ -144,11 +144,11 @@ export function text<
         modifiers += ` @default(${defaultLiteral})`
       }
 
-      // Unique/index modifiers
+      // Unique modifier. A non-unique index has no field-level form in Prisma,
+      // so it is requested out-of-line via `index` below and emitted by the
+      // generator as `@@index([...])` on the model.
       if (options?.isIndexed === 'unique') {
         modifiers += ' @unique'
-      } else if (options?.isIndexed === true) {
-        modifiers += ' @index'
       }
 
       // Map modifier
@@ -159,6 +159,7 @@ export function text<
       return {
         type: 'String',
         modifiers: modifiers.trimStart() || undefined,
+        index: options?.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -402,16 +403,17 @@ export function decimal<
         modifiers += ` @map("${db.map}")`
       }
 
-      // Unique/index modifiers
+      // Unique modifier. A non-unique index has no field-level form in Prisma,
+      // so it is requested out-of-line via `index` below and emitted by the
+      // generator as `@@index([...])` on the model.
       if (options?.isIndexed === 'unique') {
         modifiers += ' @unique'
-      } else if (options?.isIndexed === true) {
-        modifiers += ' @index'
       }
 
       return {
         type: 'Decimal',
         modifiers: modifiers.trimStart() || undefined,
+        index: options?.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -747,16 +749,17 @@ export function calendarDay<
         modifiers += ` @map("${db.map}")`
       }
 
-      // Unique/index modifiers
+      // Unique modifier. A non-unique index has no field-level form in Prisma,
+      // so it is requested out-of-line via `index` below and emitted by the
+      // generator as `@@index([...])` on the model.
       if (options?.isIndexed === 'unique') {
         modifiers += ' @unique'
-      } else if (options?.isIndexed === true) {
-        modifiers += ' @index'
       }
 
       return {
         type: 'DateTime',
         modifiers: modifiers.trimStart() || undefined,
+        index: options?.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -1384,10 +1387,16 @@ function getPrismaRelation(
         ? ` @map("${field.db.foreignKey.map}")`
         : ` @map("${fieldName}")`
 
-    let fkLine = `  ${fkPaddedName} String?${uniqueModifier}${mapModifier}`
+    // Nullability: explicit db.isNullable overrides the default (nullable),
+    // matching the scalar fields' `db.isNullable` convention. It moves the FK
+    // column and its relation field together — they can never disagree.
+    const isNullable = field.db?.isNullable ?? true
+    const nullModifier = isNullable ? '?' : ''
+
+    let fkLine = `  ${fkPaddedName} String${nullModifier}${uniqueModifier}${mapModifier}`
     let relationLine = targetField
-      ? `  ${paddedName} ${targetList}?  @relation(fields: [${foreignKeyField}], references: [id])`
-      : `  ${paddedName} ${targetList}?  @relation("${listKey}_${fieldName}", fields: [${foreignKeyField}], references: [id])`
+      ? `  ${paddedName} ${targetList}${nullModifier}  @relation(fields: [${foreignKeyField}], references: [id])`
+      : `  ${paddedName} ${targetList}${nullModifier}  @relation("${listKey}_${fieldName}", fields: [${foreignKeyField}], references: [id])`
 
     if (field.db?.extendPrismaSchema) {
       const extended = field.db.extendPrismaSchema({ fkLine, relationLine })
@@ -1399,10 +1408,24 @@ function getPrismaRelation(
     const indexType = field.isIndexed ?? true
     const foreignKeyIndex = indexType !== false ? { foreignKeyField, indexType } : undefined
 
-    return { modelLines: [fkLine, relationLine], foreignKeyIndex, backRelation }
+    return { modelLines: [fkLine, relationLine], foreignKeyField, foreignKeyIndex, backRelation }
+  }
+
+  // Non-FK side of a one-to-one relationship: just the relation field. This
+  // side has no foreign key column, so `db.isNullable` (which only makes
+  // sense paired with a column) cannot be honoured here — reject rather than
+  // silently ignore a developer's stated intent (the FK-owning side is
+  // determined by `db.foreignKey`/alphabetical ordering, not by which field
+  // declares `isNullable`).
+  if (field.db?.isNullable === false) {
+    throw new Error(
+      `db.isNullable can only be used on the foreign-key-owning side of a relationship. ` +
+        `"${listKey}.${fieldName}" does not own the foreign key for this one-to-one relationship — ` +
+        `set db.isNullable on "${targetList}.${targetField}" instead, or make this side own the ` +
+        `foreign key via db.foreignKey.`,
+    )
   }
 
-  // Non-FK side of a one-to-one relationship: just the relation field
   let relationLine = `  ${paddedName} ${targetList}?`
   if (field.db?.extendPrismaSchema) {
     relationLine = field.db.extendPrismaSchema({ relationLine }).relationLine
@@ -1448,6 +1471,16 @@ export function relationship<
     }
   }
 
+  // Validate db.isNullable usage: only the FK-owning (single) side of a
+  // relationship has a column to make non-nullable — the many side always
+  // generates an array field with no nullability of its own.
+  if (options.db?.isNullable !== undefined && options.many) {
+    throw new Error(
+      'db.isNullable can only be used on single relationships (many: false or undefined). ' +
+        'Many-side of a relationship has no foreign key column to make non-nullable.',
+    )
+  }
+
   const field: RelationshipField<TTypeInfo> = {
     type: 'relationship',
     ...options,

package/src/index.ts

@@ -19,6 +19,8 @@ export type {
   OutputConfig,
   ListConfig,
   DatabaseConfig,
+  ListIndex,
+  ListIndexFieldRef,
   FieldConfig,
   OperationAccess,
   // Custom Bulk actions (issue #736) — declared per list in
@@ -80,6 +82,14 @@ export { ResolveOutputCycleError } from './access/index.js'
 export { validateFieldConfig, validateConfigFields } from './validation/field-config.js'
 export type { FieldConfigValidationError } from './validation/field-config.js'
 
+// Declared-dependency validation (`needs`, ADR-0025) — checks every `needs`
+// entry names an immediate relationship field on the same list, and that no
+// field's declaration closure (the recursive fold of its dependencies, and
+// theirs) exceeds the read-include depth cap from any starting point. A
+// config that fails either must not generate.
+export { validateNeedsDeclarations, validateNeedsClosureDepth } from './validation/needs-closure.js'
+export type { NeedsClosureError } from './validation/needs-closure.js'
+
 // Fragment-based query API — composable, type-safe reads that mirror
 // Keystone's GraphQL fragments without a GraphQL runtime. The migration
 // guide, CHANGELOG, and migrate-context-calls skill all advertise importing

package/src/validation/needs-closure.ts

@@ -0,0 +1,188 @@
+import type { FieldConfig, OpenSaasConfig } from '../config/types.js'
+import { getRelatedListConfig } from '../access/engine.js'
+import { READ_INCLUDE_MAX_DEPTH } from '../access/depth-limits.js'
+
+/**
+ * A field's `needs` declaration (ADR-0025) whose closure — the recursive
+ * fold of its own dependencies, and THEIR dependencies, and so on — cannot
+ * be satisfied by the read pipeline, independent of where any caller starts
+ * a read.
+ *
+ * Two distinct refusals, both fail-closed rather than silently truncated
+ * (ADR-0022): `'cycle'` means the chain never terminates (e.g. `Order.total`
+ * needs `lineItems`, `LineItem.orderRef` needs `order`); `'depth'` means it
+ * terminates but reaches deeper than `READ_INCLUDE_MAX_DEPTH` even when
+ * evaluated starting AT the declaring field's own list — the most
+ * favourable starting point available, so no caller could ever do better.
+ */
+export interface NeedsClosureError {
+  /** The list whose field declares the (transitively) unsatisfiable `needs`. */
+  listKey: string
+  /** The field key within that list. */
+  fieldKey: string
+  /** The list keys on the offending chain, starting at `listKey`. */
+  chain: string[]
+  reason: 'cycle' | 'depth' | 'invalid-relation'
+  message: string
+}
+
+function isRelationshipFieldConfig(
+  fieldConfig: FieldConfig | undefined,
+): fieldConfig is FieldConfig & { type: 'relationship'; ref: string } {
+  return (
+    !!fieldConfig &&
+    fieldConfig.type === 'relationship' &&
+    'ref' in fieldConfig &&
+    !!fieldConfig.ref
+  )
+}
+
+type ListClosureResult = { depth: number; chain: string[] } | { cycle: string[] }
+
+/**
+ * The deepest needs-chain reachable from `listKey`, considering EVERY field
+ * on every list along the way that declares `needs` — not only the field
+ * that triggered the walk. A computed field runs wherever its list's rows
+ * are fetched, so once a list is reached, ALL of its own declared
+ * dependencies must be satisfiable too (ADR-0025's "at every level a field
+ * is computed").
+ *
+ * `path` is the list keys already on this DFS branch, root-first, used to
+ * detect a cycle (a chain that can never terminate).
+ */
+function listClosureDepth(
+  listKey: string,
+  config: OpenSaasConfig,
+  path: readonly string[],
+): ListClosureResult {
+  const listConfig = config.lists[listKey]
+  if (!listConfig?.fields) return { depth: 0, chain: [listKey] }
+
+  let maxDepth = 0
+  let maxChain = [listKey]
+
+  for (const fieldConfig of Object.values(listConfig.fields)) {
+    if (!fieldConfig?.hooks?.resolveOutput) continue
+
+    for (const relationName of fieldConfig.needs ?? []) {
+      const relatedField = listConfig.fields[relationName]
+      if (!isRelationshipFieldConfig(relatedField)) continue
+
+      const relatedConfig = getRelatedListConfig(relatedField.ref, config)
+      if (!relatedConfig) continue
+      const relatedListKey = relatedConfig.listName
+
+      if (path.includes(relatedListKey)) {
+        return { cycle: [...path, relatedListKey] }
+      }
+
+      const sub = listClosureDepth(relatedListKey, config, [...path, relatedListKey])
+      if ('cycle' in sub) return sub
+
+      if (1 + sub.depth > maxDepth) {
+        maxDepth = 1 + sub.depth
+        maxChain = [listKey, ...sub.chain]
+      }
+    }
+  }
+
+  return { depth: maxDepth, chain: maxChain }
+}
+
+/**
+ * Validate that every `needs` entry names an immediate relationship field
+ * declared on the SAME list. The generated `Lists.<List>.TypeInfo` already
+ * makes a misspelled or non-relation entry a compile error for a config
+ * annotated with it (`list<Lists.X.TypeInfo>({...})`, the documented
+ * pattern) — this is the runtime backstop for configs that aren't, or that
+ * are authored in plain JS.
+ *
+ * @param config - The fully resolved OpenSaas config.
+ * @returns All invalid `needs` entries, flattened across lists and fields.
+ */
+export function validateNeedsDeclarations(config: OpenSaasConfig): NeedsClosureError[] {
+  const errors: NeedsClosureError[] = []
+
+  for (const [listKey, listConfig] of Object.entries(config.lists)) {
+    if (!listConfig?.fields) continue
+
+    for (const [fieldKey, fieldConfig] of Object.entries(listConfig.fields)) {
+      for (const relationName of fieldConfig?.needs ?? []) {
+        if (isRelationshipFieldConfig(listConfig.fields[relationName])) continue
+
+        const exists = relationName in listConfig.fields
+        errors.push({
+          listKey,
+          fieldKey,
+          chain: [listKey],
+          reason: 'invalid-relation',
+          message: exists
+            ? `"${listKey}.${fieldKey}" declares needs: ['${relationName}'], but "${relationName}" ` +
+              `is not a relationship field on "${listKey}". \`needs\` may only name immediate ` +
+              `relationship fields declared on the same list.`
+            : `"${listKey}.${fieldKey}" declares needs: ['${relationName}'], but "${listKey}" has ` +
+              `no field named "${relationName}".`,
+        })
+      }
+    }
+  }
+
+  return errors
+}
+
+/**
+ * Validate that every field's `needs` closure fits within
+ * `READ_INCLUDE_MAX_DEPTH` when evaluated starting at the declaring field's
+ * own list — the most favourable starting point a caller could ever give it.
+ * Intended to run once, before generation, exactly like
+ * {@link validateConfigFields} — a config whose closure cannot fit must not
+ * generate, per ADR-0025's "Depth" section.
+ *
+ * @param config - The fully resolved OpenSaas config.
+ * @returns All unsatisfiable-closure violations, flattened across lists and fields.
+ */
+export function validateNeedsClosureDepth(config: OpenSaasConfig): NeedsClosureError[] {
+  const errors: NeedsClosureError[] = []
+
+  for (const [listKey, listConfig] of Object.entries(config.lists)) {
+    if (!listConfig?.fields) continue
+
+    for (const [fieldKey, fieldConfig] of Object.entries(listConfig.fields)) {
+      if (!fieldConfig?.hooks?.resolveOutput || !fieldConfig.needs?.length) continue
+
+      const result = listClosureDepth(listKey, config, [listKey])
+
+      if ('cycle' in result) {
+        errors.push({
+          listKey,
+          fieldKey,
+          chain: result.cycle,
+          reason: 'cycle',
+          message:
+            `"${listKey}.${fieldKey}"'s needs declaration never terminates: ` +
+            `${result.cycle.join(' → ')} → … . A chain of \`needs\` across these lists cycles back ` +
+            `on itself, so no read could ever satisfy it. Break the cycle by removing one of the ` +
+            `\`needs\` entries on this chain, or compute the value without it.`,
+        })
+        continue
+      }
+
+      if (result.depth >= READ_INCLUDE_MAX_DEPTH) {
+        errors.push({
+          listKey,
+          fieldKey,
+          chain: result.chain,
+          reason: 'depth',
+          message:
+            `"${listKey}.${fieldKey}"'s needs declaration requires a closure ${result.depth} ` +
+            `relations deep even starting at "${listKey}" itself: ${result.chain.join(' → ')}. ` +
+            `This exceeds the Access Filter's maximum read-include depth ` +
+            `(${READ_INCLUDE_MAX_DEPTH}), so no caller — however they start the read — could ever ` +
+            `have this closure satisfied. Shorten the \`needs\` chain across these lists.`,
+        })
+      }
+    }
+  }
+
+  return errors
+}

package/tests/field-types.test.ts

@@ -103,12 +103,16 @@ describe('Field Types', () => {
         expect(prismaType.modifiers).toContain('@unique')
       })
 
-      test('includes @index modifier', () => {
+      test('requests a block-level index rather than an inline modifier', () => {
         const field = text({ isIndexed: true })
         const prismaType = field.getPrismaType('slug')
 
         expect(prismaType.type).toBe('String')
-        expect(prismaType.modifiers).toContain('@index')
+        // Prisma has no field-level `@index` attribute — emitting one produces a
+        // schema Prisma refuses to parse. A non-unique index is requested
+        // out-of-line and lands as `@@index([slug])` on the model.
+        expect(prismaType.index).toBe(true)
+        expect(prismaType.modifiers ?? '').not.toContain('@index')
       })
 
       test('db.isNullable: true makes optional field explicitly nullable', () => {
@@ -757,6 +761,18 @@ describe('Field Types', () => {
         expect(field.ref).toBe('Post.author')
         expect(field.many).toBe(true)
       })
+
+      test('accepts db.isNullable on a single relationship', () => {
+        const field = relationship({ ref: 'User.posts', db: { isNullable: false } })
+
+        expect(field.db?.isNullable).toBe(false)
+      })
+
+      test('throws error when db.isNullable is used with many: true', () => {
+        expect(() => {
+          relationship({ ref: 'Post.author', many: true, db: { isNullable: false } })
+        }).toThrow('db.isNullable can only be used on single relationships')
+      })
     })
   })