Type-safe CRUD for Drizzle ORM in NestJS.

The tenant key check lets the database compare keys, so citext, SQLite NOCASE and MySQL _bin columns get the answer their collation gives. A malformed key and an ISO date string in a write body are a 400 and a stored date instead of a 500, and a massUpdate with one shared sql value is one UPDATE.

Each service resolves its own tenant scope, even when another service hands it its options. Text keys compare exactly, so a key that differs from another tenant's only in case is refused, and nested children get the same key check as their parent. massCreate rolls back when its relations fail to load, and massUpdate takes sql values.

Cursor pages seek to the cursor in an index, so page 9,000 of 200,000 rows takes 0.6 ms instead of 24. Single writes are one statement, mass writes drop their savepoints, a per-id SET groups into one UPDATE per value, big nested loads are chunked, and a stored tsvector column serves full-text search. A new page lists the index each query needs.

The bound parameter limit is checked on the real statement, against each database's own limit: 65,535 on PostgreSQL and MySQL, 32,766 on SQLite, 100 on D1. A belongs-to key must point inside the caller's tenant, SQLite type errors are 400s, full-text search over several columns keeps rows with a NULL column, caseSensitive works on SQLite, and idleTimeout works on MySQL.

A scoped upsert on MySQL is refused with an error that names both dialects that support it: PostgreSQL and SQLite.

dialect: "sqlite" runs on SQLite, libSQL and Cloudflare D1. connectionString builds a mysql2 pool on MySQL, with pool size, SSL and idle timeout options on both drivers, and forRootAsync takes useClass and useExisting. fullTextSearch takes filters, relations and select like findAll, plus a language and websearch queries. MySQL row locks now lock.

Loaded relations, joins, relation filters and counts only see rows of the caller's tenant. Bulk routes validate their bodies against the DTOs, route decorators that wrap the handler run, and deep filters, huge batches, missing values and MySQL duplicates are 400s and 409s instead of 500s.

A bare sortBy now sorts ascending in findAll, the same as ?sortBy= over HTTP. Soft delete calls on an entity without soft delete, and full-text search on MySQL, are 400s instead of 500s. Relation counts only count rows in the caller's tenant.

The package moves to the @avytrix scope with the same code as 3.5.0. Swap the dependency and the imports for @avytrix/nestjs-drizzle-crud; the MCP server runs with npx -p @avytrix/nestjs-drizzle-crud nestjs-drizzle-crud-mcp. The unscoped name is deprecated.

createCrudController wires every CRUD route with the right id pipe, and ApiCrudList documents list queries in Swagger. A scope keeps every read and write inside one tenant, global events cover bulk writes, a version column turns stale writes into 409s, and filters reach through relation paths with some, none and every. Writes return their relations, lists can count relations or skip COUNT(*).

parseQuery turns a query string into typed filters, allowlists keep clients to the columns you choose, and findByCursor pages without OFFSET. Filters gain or / not groups and new operators, sortBy takes several columns or a relation column, soft-deleted rows can be listed and purged, and bulk writes are one statement for the whole set.

String and date filters work on every column type, a soft-deleted parent no longer comes back through a join, and bulk calls report only the items that failed in the 400 body. Unknown filter keys, an empty findOne and bad input on reads are now 400s, and every list ends with a primary key sort.

Declare a hasMany relation and findAll loads the whole page's children in one extra query, never one per row. options.select now takes dotted paths like region.code, and the package ships an MCP server so any AI agent can read its docs.

ForeignKeyViolationException and EntityInUseException are exported again. A create or update pointing at a missing parent row returns 400, and a delete blocked by dependent rows returns 409, instead of a raw 500.

The package homepage now points at this docs site, and the READMEs link the docs, npm, and GitHub. No runtime change, and the foreign-key regression it carried is fixed in 3.2.2.