@datafn/core 0.0.1 → 0.0.2

package/dist/index.cjs

@@ -1,5 +1,98 @@
 'use strict';
 
+// src/types.ts
+function defineSchema(schema) {
+  return schema;
+}
+
+// src/capabilities.ts
+var CAPABILITY_FIELD_DEFS = {
+  timestamps: [
+    { name: "createdAt", type: "date", required: false, nullable: true, readonly: true, default: null },
+    { name: "updatedAt", type: "date", required: false, nullable: true, readonly: true, default: null }
+  ],
+  audit: [
+    { name: "createdBy", type: "string", required: false, nullable: true, readonly: true, default: null },
+    { name: "updatedBy", type: "string", required: false, nullable: true, readonly: true, default: null }
+  ],
+  trash: [
+    { name: "trashedAt", type: "date", required: false, nullable: true, readonly: true, default: null },
+    { name: "trashedBy", type: "string", required: false, nullable: true, readonly: true, default: null }
+  ],
+  archivable: [{ name: "isArchived", type: "boolean", required: false, nullable: false, readonly: false, default: false }],
+  shareable: [{ name: "visibility", type: "string", required: false, nullable: true, readonly: true, default: null }]
+};
+var RELATION_CAPABILITY_FIELD_DEFS = {
+  timestamps: [
+    { name: "createdAt", type: "date", required: false, nullable: true, readonly: true, default: null },
+    { name: "updatedAt", type: "date", required: false, nullable: true, readonly: true, default: null }
+  ],
+  audit: [
+    { name: "createdBy", type: "string", required: false, nullable: true, readonly: true, default: null },
+    { name: "updatedBy", type: "string", required: false, nullable: true, readonly: true, default: null }
+  ]
+};
+function getRelationCapabilityFieldNames(caps) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const cap of caps) {
+    const defs = RELATION_CAPABILITY_FIELD_DEFS[cap] ?? [];
+    for (const def of defs) {
+      if (!seen.has(def.name)) {
+        seen.add(def.name);
+        names.push(def.name);
+      }
+    }
+  }
+  return names;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toCapabilityKey(entry) {
+  return typeof entry === "string" ? entry : "shareable";
+}
+function dedupeCapabilities(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const entry of entries) {
+    const key = toCapabilityKey(entry);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    deduped.push(entry);
+  }
+  return deduped;
+}
+function resolveCapabilities(globalCaps, resourceCaps) {
+  const base = Array.isArray(globalCaps) ? globalCaps : [];
+  if (resourceCaps === void 0) {
+    return dedupeCapabilities(base);
+  }
+  if (Array.isArray(resourceCaps)) {
+    return dedupeCapabilities([...base, ...resourceCaps]);
+  }
+  if (isObject(resourceCaps) && Array.isArray(resourceCaps.exclude)) {
+    const excluded = new Set(resourceCaps.exclude);
+    return dedupeCapabilities(
+      base.filter((entry) => typeof entry === "string" ? !excluded.has(entry) : true)
+    );
+  }
+  return dedupeCapabilities(base);
+}
+function getCapabilityFields(resolvedCaps) {
+  const fields = [];
+  const seenFields = /* @__PURE__ */ new Set();
+  for (const capability of dedupeCapabilities(resolvedCaps)) {
+    const key = toCapabilityKey(capability);
+    for (const fieldDef of CAPABILITY_FIELD_DEFS[key]) {
+      if (seenFields.has(fieldDef.name)) continue;
+      seenFields.add(fieldDef.name);
+      fields.push({ ...fieldDef });
+    }
+  }
+  return fields;
+}
+
 // src/errors.ts
 function ok(result) {
   return { ok: true, result };
@@ -16,6 +109,51 @@ function err(code, message, details) {
 }
 
 // src/schema.ts
+var SIMPLE_CAPABILITIES = /* @__PURE__ */ new Set([
+  "timestamps",
+  "audit",
+  "trash",
+  "archivable"
+]);
+var SHAREABLE_LEVELS = /* @__PURE__ */ new Set(["viewer", "editor", "owner"]);
+var SHAREABLE_DEFAULTS = /* @__PURE__ */ new Set(["private", "shared"]);
+var SHAREABLE_VISIBILITY_DEFAULTS = /* @__PURE__ */ new Set(["ns", "private", "shared"]);
+var SHAREABLE_PRINCIPAL_MODES = /* @__PURE__ */ new Set(["opaque-id"]);
+var RELATION_SIMPLE_CAPABILITIES = /* @__PURE__ */ new Set([
+  "timestamps",
+  "audit"
+]);
+var RELATION_CAPABILITY_CANONICAL_ORDER = ["timestamps", "audit"];
+function resolveRelationCapabilities(capabilities) {
+  if (capabilities === void 0) return ok([]);
+  if (!Array.isArray(capabilities)) {
+    return err("SCHEMA_INVALID", "Relation capabilities must be an array", {
+      path: "capabilities"
+    });
+  }
+  for (const entry of capabilities) {
+    if (typeof entry !== "string") {
+      return err("SCHEMA_INVALID", "Relation capability values must be strings", {
+        path: "capabilities"
+      });
+    }
+    if (!RELATION_SIMPLE_CAPABILITIES.has(entry)) {
+      return err("INVALID_CAPABILITY", `Unknown relation capability "${entry}"`, {
+        path: "capabilities"
+      });
+    }
+  }
+  const declared = new Set(capabilities);
+  return ok(RELATION_CAPABILITY_CANONICAL_ORDER.filter((cap) => declared.has(cap)));
+}
+function resolveNamespaced(s) {
+  if (typeof s.namespaced === "boolean") return s.namespaced;
+  return true;
+}
+function isNamespaced(schema) {
+  if (typeof schema.namespaced === "boolean") return schema.namespaced;
+  return true;
+}
 function validateSchema(schema) {
   if (typeof schema !== "object" || schema === null || Array.isArray(schema)) {
     return err("SCHEMA_INVALID", "Invalid schema: expected object", {
@@ -23,11 +161,20 @@ function validateSchema(schema) {
     });
   }
   const s = schema;
+  const globalCapsResult = parseSchemaCapabilities(s.capabilities);
+  if (!globalCapsResult.ok) return globalCapsResult;
+  const globalCapabilities = globalCapsResult.result;
   if (!s.resources || !Array.isArray(s.resources)) {
     return err("SCHEMA_INVALID", "Invalid schema: missing resources", {
       path: "resources"
     });
   }
+  const MAX_RESOURCES = 100;
+  if (s.resources.length > MAX_RESOURCES) {
+    return err("SCHEMA_INVALID", `Invalid schema: too many resources (max ${MAX_RESOURCES})`, {
+      path: "resources"
+    });
+  }
   const resourceNames = /* @__PURE__ */ new Set();
   const normalizedResources = [];
   for (const resource of s.resources) {
@@ -66,6 +213,14 @@ function validateSchema(schema) {
         { path: "resources" }
       );
     }
+    const MAX_FIELDS_PER_RESOURCE = 200;
+    if (r.fields.length > MAX_FIELDS_PER_RESOURCE) {
+      return err(
+        "SCHEMA_INVALID",
+        `Invalid schema: resource "${r.name}" has too many fields (max ${MAX_FIELDS_PER_RESOURCE})`,
+        { path: `resources.${r.name}.fields` }
+      );
+    }
     const fieldNames = /* @__PURE__ */ new Set();
     for (const field of r.fields) {
       if (typeof field !== "object" || field === null || Array.isArray(field)) {
@@ -90,6 +245,31 @@ function validateSchema(schema) {
       }
       fieldNames.add(f.name);
     }
+    const resourceCapsResult = parseResourceCapabilities(r.capabilities);
+    if (!resourceCapsResult.ok) return resourceCapsResult;
+    const resolvedCapabilities = resolveCapabilities(
+      globalCapabilities,
+      resourceCapsResult.result
+    );
+    if (hasShareable(resolvedCapabilities) && !hasCapability(resolvedCapabilities, "audit")) {
+      return err(
+        "CAPABILITY_DEPENDENCY",
+        `"shareable" capability requires "audit" capability`,
+        { path: `resources.${r.name}.capabilities` }
+      );
+    }
+    const collision = findCapabilityFieldCollision(fieldNames, resolvedCapabilities);
+    if (collision) {
+      return err(
+        "CAPABILITY_FIELD_COLLISION",
+        `Field "${collision.field}" on resource "${r.name}" collides with capability-injected field from "${collision.capability}"`,
+        { path: `resources.${r.name}.fields.${collision.field}` }
+      );
+    }
+    const injectedFields = getCapabilityFields(resolvedCapabilities);
+    for (const injectedField of injectedFields) {
+      fieldNames.add(injectedField.name);
+    }
     let normalizedIndices;
     if (Array.isArray(r.indices)) {
       normalizedIndices = {
@@ -107,17 +287,318 @@ function validateSchema(schema) {
     } else {
       normalizedIndices = { base: [], search: [], vector: [] };
     }
+    for (const [category, idxFields] of Object.entries(normalizedIndices)) {
+      for (const idxField of idxFields) {
+        if (!fieldNames.has(idxField)) {
+          return err(
+            "SCHEMA_INVALID",
+            `Invalid schema: index field "${idxField}" in indices.${category} does not match any field in resource "${r.name}". Available fields: ${[...fieldNames].join(", ")}`,
+            { path: `resources.${r.name}.indices.${category}` }
+          );
+        }
+      }
+    }
     normalizedResources.push({
       ...r,
+      capabilities: resourceCapsResult.result,
+      fields: [...r.fields, ...injectedFields],
       indices: normalizedIndices
     });
   }
   const relations = Array.isArray(s.relations) ? s.relations : [];
+  for (const rel of relations) {
+    if (typeof rel !== "object" || rel === null || Array.isArray(rel)) {
+      return err("SCHEMA_INVALID", "Invalid schema: relation must be object", {
+        path: "relations"
+      });
+    }
+    const r = rel;
+    const validateRelationRef = (ref, side) => {
+      const refs = Array.isArray(ref) ? ref : typeof ref === "string" ? [ref] : [];
+      for (const name of refs) {
+        if (typeof name === "string" && !resourceNames.has(name)) {
+          return err(
+            "SCHEMA_INVALID",
+            `Invalid schema: relation.${side} references unknown resource "${name}". Available: ${[...resourceNames].join(", ")}`,
+            { path: `relations.${side}` }
+          );
+        }
+      }
+      return null;
+    };
+    if (r.from !== void 0) {
+      const e = validateRelationRef(r.from, "from");
+      if (e) return e;
+    }
+    if (r.to !== void 0) {
+      const e = validateRelationRef(r.to, "to");
+      if (e) return e;
+    }
+    if (r.joinTable !== void 0 && typeof r.joinTable !== "string") {
+      return err("SCHEMA_INVALID", "Invalid schema: relation.joinTable must be string", {
+        path: "relations"
+      });
+    }
+    if (r.joinColumns !== void 0) {
+      if (typeof r.joinColumns !== "object" || r.joinColumns === null || Array.isArray(r.joinColumns)) {
+        return err("SCHEMA_INVALID", "Invalid schema: relation.joinColumns must be object with from/to strings", {
+          path: "relations"
+        });
+      }
+      const jc = r.joinColumns;
+      if (typeof jc.from !== "string" || typeof jc.to !== "string") {
+        return err("SCHEMA_INVALID", "Invalid schema: relation.joinColumns.from and .to must be strings", {
+          path: "relations"
+        });
+      }
+    }
+    if (r.capabilities !== void 0) {
+      if (r.type !== "many-many") {
+        return err(
+          "SCHEMA_INVALID",
+          `Relation capabilities are only supported on many-many relations, got "${r.type}"`,
+          { path: "relations" }
+        );
+      }
+      const capResult = resolveRelationCapabilities(r.capabilities);
+      if (!capResult.ok) return capResult;
+      if (Array.isArray(r.metadata) && capResult.result.length > 0) {
+        const injectedNames = new Set(getRelationCapabilityFieldNames(capResult.result));
+        const relationName = typeof r.relation === "string" ? r.relation : "unknown";
+        for (const metaField of r.metadata) {
+          if (typeof metaField?.name === "string" && injectedNames.has(metaField.name)) {
+            return err(
+              "CAPABILITY_FIELD_COLLISION",
+              `Relation metadata field "${metaField.name}" on relation "${relationName}" collides with relation capability-injected field`,
+              { path: `relations.${relationName}.metadata.${metaField.name}` }
+            );
+          }
+        }
+      }
+    }
+  }
+  const namespaced = resolveNamespaced(s);
   return ok({
+    capabilities: globalCapabilities,
     resources: normalizedResources,
-    relations
+    relations,
+    namespaced
   });
 }
+function parseSchemaCapabilities(value) {
+  if (value === void 0) return ok(void 0);
+  if (!Array.isArray(value)) {
+    return err("INVALID_CAPABILITY_CONFIG", "Schema capabilities must be an array", {
+      path: "capabilities"
+    });
+  }
+  return parseCapabilityArray(value, "capabilities");
+}
+function parseResourceCapabilities(value) {
+  if (value === void 0) return ok(void 0);
+  if (Array.isArray(value)) {
+    return parseCapabilityArray(value, "resources.capabilities");
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      "Resource capabilities must be an array or { exclude: [...] }",
+      { path: "resources.capabilities" }
+    );
+  }
+  const obj = value;
+  if (!Array.isArray(obj.exclude)) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      "Resource capability exclusion must be { exclude: SimpleCapability[] }",
+      { path: "resources.capabilities.exclude" }
+    );
+  }
+  const excluded = [];
+  for (const cap of obj.exclude) {
+    if (typeof cap !== "string") {
+      return err("INVALID_CAPABILITY", "Capability name must be a string", {
+        path: "resources.capabilities.exclude"
+      });
+    }
+    if (!SIMPLE_CAPABILITIES.has(cap)) {
+      return err("INVALID_CAPABILITY", `Unknown capability "${cap}"`, {
+        path: "resources.capabilities.exclude"
+      });
+    }
+    excluded.push(cap);
+  }
+  return ok({ exclude: excluded });
+}
+function parseCapabilityArray(input, path) {
+  const parsed = [];
+  for (const entry of input) {
+    if (typeof entry === "string") {
+      if (entry === "shareable") {
+        return err(
+          "INVALID_CAPABILITY_CONFIG",
+          `"shareable" capability requires object config`,
+          { path }
+        );
+      }
+      if (!SIMPLE_CAPABILITIES.has(entry)) {
+        return err("INVALID_CAPABILITY", `Unknown capability "${entry}"`, { path });
+      }
+      parsed.push(entry);
+      continue;
+    }
+    const shareableResult = parseShareableCapability(entry, path);
+    if (shareableResult.ok) {
+      parsed.push(shareableResult.result);
+      continue;
+    }
+    return shareableResult;
+  }
+  return ok(resolveCapabilities(parsed, void 0));
+}
+function parseShareableCapability(entry, path) {
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+    return err("INVALID_CAPABILITY_CONFIG", "Invalid capability configuration", { path });
+  }
+  const obj = entry;
+  if (!obj.shareable || typeof obj.shareable !== "object" || Array.isArray(obj.shareable)) {
+    return err("INVALID_CAPABILITY_CONFIG", "Invalid capability configuration", { path });
+  }
+  const shareable = obj.shareable;
+  if (!Array.isArray(shareable.levels)) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.levels" must be an array`,
+      { path: `${path}.shareable.levels` }
+    );
+  }
+  if (shareable.levels.length === 0 || !shareable.levels.every((level) => typeof level === "string" && SHAREABLE_LEVELS.has(level))) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.levels" must include one or more of [viewer, editor, owner]`,
+      { path: `${path}.shareable.levels` }
+    );
+  }
+  if (shareable.default !== void 0 && (typeof shareable.default !== "string" || !SHAREABLE_DEFAULTS.has(shareable.default))) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.default" must be one of [private, shared]`,
+      { path: `${path}.shareable.default` }
+    );
+  }
+  if (shareable.visibilityDefault !== void 0 && (typeof shareable.visibilityDefault !== "string" || !SHAREABLE_VISIBILITY_DEFAULTS.has(shareable.visibilityDefault))) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.visibilityDefault" must be one of [ns, private, shared]`,
+      { path: `${path}.shareable.visibilityDefault` }
+    );
+  }
+  if (shareable.default === void 0 && shareable.visibilityDefault === void 0) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.default" or "shareable.visibilityDefault" must be provided`,
+      { path: `${path}.shareable` }
+    );
+  }
+  if (shareable.supportsScopeGrants !== void 0 && typeof shareable.supportsScopeGrants !== "boolean") {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.supportsScopeGrants" must be boolean`,
+      { path: `${path}.shareable.supportsScopeGrants` }
+    );
+  }
+  if (shareable.crossNsShareable !== void 0 && typeof shareable.crossNsShareable !== "boolean") {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.crossNsShareable" must be boolean`,
+      { path: `${path}.shareable.crossNsShareable` }
+    );
+  }
+  if (shareable.principalMode !== void 0 && (typeof shareable.principalMode !== "string" || !SHAREABLE_PRINCIPAL_MODES.has(shareable.principalMode))) {
+    return err(
+      "INVALID_CAPABILITY_CONFIG",
+      `"shareable.principalMode" must be one of [opaque-id]`,
+      { path: `${path}.shareable.principalMode` }
+    );
+  }
+  let relationInheritance;
+  if (shareable.relationInheritance !== void 0) {
+    const rel = shareable.relationInheritance;
+    if (typeof rel !== "object" || rel === null || Array.isArray(rel)) {
+      return err(
+        "INVALID_CAPABILITY_CONFIG",
+        `"shareable.relationInheritance" must be an object`,
+        { path: `${path}.shareable.relationInheritance` }
+      );
+    }
+    const relObj = rel;
+    if (typeof relObj.enabled !== "boolean") {
+      return err(
+        "INVALID_CAPABILITY_CONFIG",
+        `"shareable.relationInheritance.enabled" must be boolean`,
+        { path: `${path}.shareable.relationInheritance.enabled` }
+      );
+    }
+    if (relObj.relations !== void 0 && (!Array.isArray(relObj.relations) || !relObj.relations.every((value) => typeof value === "string"))) {
+      return err(
+        "INVALID_CAPABILITY_CONFIG",
+        `"shareable.relationInheritance.relations" must be string[]`,
+        { path: `${path}.shareable.relationInheritance.relations` }
+      );
+    }
+    if (relObj.requireRelateConsent !== void 0 && typeof relObj.requireRelateConsent !== "boolean") {
+      return err(
+        "INVALID_CAPABILITY_CONFIG",
+        `"shareable.relationInheritance.requireRelateConsent" must be boolean`,
+        { path: `${path}.shareable.relationInheritance.requireRelateConsent` }
+      );
+    }
+    relationInheritance = {
+      enabled: relObj.enabled,
+      relations: relObj.relations,
+      requireRelateConsent: relObj.requireRelateConsent ?? true
+    };
+  }
+  const normalized = {
+    shareable: {
+      levels: shareable.levels,
+      default: shareable.default ?? (shareable.visibilityDefault === "private" ? "private" : "shared"),
+      visibilityDefault: shareable.visibilityDefault ?? shareable.default,
+      supportsScopeGrants: shareable.supportsScopeGrants ?? true,
+      crossNsShareable: shareable.crossNsShareable ?? true,
+      principalMode: shareable.principalMode ?? "opaque-id",
+      relationInheritance
+    }
+  };
+  return ok(normalized);
+}
+function hasCapability(caps, capability) {
+  return caps.some((cap) => cap === capability);
+}
+function hasShareable(caps) {
+  return caps.some((cap) => typeof cap === "object" && cap !== null && "shareable" in cap);
+}
+function findCapabilityFieldCollision(userFieldNames, resolvedCapabilities) {
+  for (const cap of resolvedCapabilities) {
+    const key = typeof cap === "string" ? cap : "shareable";
+    const injectedDefs = CAPABILITY_FIELD_DEFS[key];
+    for (const field of injectedDefs) {
+      if (userFieldNames.has(field.name)) {
+        return { field: field.name, capability: key };
+      }
+    }
+  }
+  return null;
+}
+
+// src/ns.ts
+function ns(...segments) {
+  const filtered = segments.filter((s) => s != null && s !== "");
+  if (filtered.length === 0) {
+    throw new Error("ns() requires at least one non-empty segment");
+  }
+  return filtered.join(":");
+}
 
 // src/normalize.ts
 function normalizeDfql(value) {
@@ -152,11 +633,707 @@ function unwrapEnvelope(env) {
   throw env.error;
 }
 
+// src/kv.ts
+var KV_RESOURCE_NAME = "kv";
+function kvId(key) {
+  if (typeof key !== "string") {
+    throw new Error("Invalid KV key: must be string");
+  }
+  return `${KV_RESOURCE_NAME}:${key}`;
+}
+function ensureBuiltinKv(schema) {
+  const existingKv = schema.resources.find((r) => r.name === KV_RESOURCE_NAME);
+  if (existingKv) {
+    if (existingKv.version !== 1) {
+      throw new Error(
+        `KV resource version mismatch: expected 1, got ${existingKv.version}`
+      );
+    }
+    return schema;
+  }
+  const kvResource = {
+    name: KV_RESOURCE_NAME,
+    version: 1,
+    idPrefix: KV_RESOURCE_NAME,
+    fields: [
+      {
+        name: "id",
+        type: "string",
+        required: true
+      },
+      {
+        name: "value",
+        type: "json",
+        required: false
+      }
+    ],
+    indices: ["id"],
+    permissions: {
+      read: { fields: ["id", "value"] },
+      write: { fields: ["id", "value"] }
+    }
+  };
+  return {
+    ...schema,
+    resources: [...schema.resources, kvResource]
+  };
+}
+
+// src/joins.ts
+function getJoinStoreKey(from, relation, to) {
+  return `join_${from}_${relation}_${to}`;
+}
+function getJoinTableName(from, relation, joinTable) {
+  return joinTable || `__datafn_join_${from}_${relation}`;
+}
+function enumerateJoinStoreKeys(relations, resourceFilter) {
+  const keys = [];
+  for (const rel of relations) {
+    if (rel.type !== "many-many") continue;
+    const froms = Array.isArray(rel.from) ? rel.from : [rel.from];
+    const tos = Array.isArray(rel.to) ? rel.to : [rel.to];
+    const relName = rel.relation ?? "rel";
+    for (const f of froms) {
+      if (resourceFilter && !resourceFilter.has(f)) continue;
+      for (const t of tos) {
+        keys.push(getJoinStoreKey(f, relName, t));
+      }
+    }
+  }
+  return keys;
+}
+
+// src/schema-index.ts
+function buildSchemaIndex(schema) {
+  const resourcesByName = /* @__PURE__ */ new Map();
+  const fieldsByResource = /* @__PURE__ */ new Map();
+  const relationsByResource = /* @__PURE__ */ new Map();
+  const relationsFromResource = /* @__PURE__ */ new Map();
+  for (const resource of schema.resources) {
+    resourcesByName.set(resource.name, resource);
+    const fieldMap = /* @__PURE__ */ new Map();
+    for (const field of resource.fields) {
+      fieldMap.set(field.name, field);
+    }
+    fieldsByResource.set(resource.name, fieldMap);
+    relationsByResource.set(resource.name, []);
+    relationsFromResource.set(resource.name, []);
+  }
+  if (schema.relations) {
+    for (const rel of schema.relations) {
+      const fromResources = Array.isArray(rel.from) ? rel.from : [rel.from];
+      const toResources = Array.isArray(rel.to) ? rel.to : [rel.to];
+      for (const fromRes of fromResources) {
+        const fromRelations = relationsFromResource.get(fromRes) ?? [];
+        fromRelations.push(rel);
+        relationsFromResource.set(fromRes, fromRelations);
+        const allRelations = relationsByResource.get(fromRes) ?? [];
+        allRelations.push(rel);
+        relationsByResource.set(fromRes, allRelations);
+      }
+      for (const toRes of toResources) {
+        if (rel.inverse) {
+          const allRelations = relationsByResource.get(toRes) ?? [];
+          if (!allRelations.includes(rel)) {
+            allRelations.push(rel);
+            relationsByResource.set(toRes, allRelations);
+          }
+        }
+      }
+    }
+  }
+  return { resourcesByName, fieldsByResource, relationsByResource, relationsFromResource };
+}
+function getResource(index, name) {
+  return index.resourcesByName.get(name);
+}
+function getField(index, resource, field) {
+  return index.fieldsByResource.get(resource)?.get(field);
+}
+function getRelationsFrom(index, resource) {
+  return index.relationsFromResource.get(resource) ?? [];
+}
+function getRelation(index, fromResource, relationName) {
+  const relations = index.relationsFromResource.get(fromResource) ?? [];
+  return relations.find((r) => r.relation === relationName);
+}
+function getRelationTarget(relation) {
+  return Array.isArray(relation.to) ? relation.to[0] : relation.to;
+}
+function findRelationBidirectional(schema, resource, relationName) {
+  return schema.relations?.find(
+    (r) => r.from === resource && r.relation === relationName || r.to === resource && r.inverse === relationName
+  );
+}
+
+// src/filters.ts
+var OP_REMAP = {
+  eq: "$eq",
+  ne: "$ne",
+  gt: "$gt",
+  gte: "$gte",
+  lt: "$lt",
+  lte: "$lte",
+  in: "$in",
+  not_in: "$nin",
+  like: "$like",
+  ilike: "$ilike",
+  not_like: "$not_like",
+  not_ilike: "$not_ilike",
+  is_null: "$is_null",
+  is_not_null: "$is_not_null",
+  is_empty: "$is_empty",
+  is_not_empty: "$is_not_empty",
+  before: "$before",
+  after: "$after",
+  between: "$between",
+  not_between: "$not_between"
+};
+function normalizeFilterOps(filters) {
+  const out = {};
+  for (const [key, value] of Object.entries(filters)) {
+    if ((key === "$and" || key === "$or") && Array.isArray(value)) {
+      out[key] = value.map(normalizeFilterOps);
+    } else if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      const ops = value;
+      const normalized = {};
+      for (const [op, opVal] of Object.entries(ops)) {
+        normalized[OP_REMAP[op] ?? op] = opVal;
+      }
+      out[key] = normalized;
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+function dfqlError(code, message) {
+  const err2 = { code, message };
+  throw err2;
+}
+function likeToRegExp(pattern, caseInsensitive) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".");
+  return new RegExp(`^${escaped}$`, caseInsensitive ? "i" : "");
+}
+function resolvePath(record, parts) {
+  let current = record;
+  for (const part of parts) {
+    if (current === null || current === void 0 || typeof current !== "object") return void 0;
+    current = current[part];
+  }
+  return current;
+}
+function evaluateOperators(fieldValue, ops) {
+  for (const [op, opVal] of Object.entries(ops)) {
+    switch (op) {
+      case "$eq":
+        if (fieldValue !== opVal) return false;
+        break;
+      case "$ne":
+        if (fieldValue === opVal) return false;
+        break;
+      case "$gt":
+        if (!(fieldValue > opVal)) return false;
+        break;
+      case "$gte":
+        if (!(fieldValue >= opVal)) return false;
+        break;
+      case "$lt":
+        if (!(fieldValue < opVal)) return false;
+        break;
+      case "$lte":
+        if (!(fieldValue <= opVal)) return false;
+        break;
+      case "$in":
+        if (!Array.isArray(opVal)) dfqlError("DFQL_INVALID", `$in requires array`);
+        if (!opVal.includes(fieldValue)) return false;
+        break;
+      case "$nin":
+        if (!Array.isArray(opVal)) dfqlError("DFQL_INVALID", `$nin requires array`);
+        if (opVal.includes(fieldValue)) return false;
+        break;
+      case "$contains":
+        if (typeof fieldValue === "string") {
+          if (!fieldValue.includes(opVal)) return false;
+        } else if (Array.isArray(fieldValue)) {
+          if (!fieldValue.includes(opVal)) return false;
+        } else {
+          return false;
+        }
+        break;
+      case "$startsWith":
+        if (typeof fieldValue !== "string") return false;
+        if (!fieldValue.startsWith(opVal)) return false;
+        break;
+      case "$endsWith":
+        if (typeof fieldValue !== "string") return false;
+        if (!fieldValue.endsWith(opVal)) return false;
+        break;
+      case "$like":
+        if (typeof fieldValue !== "string" || typeof opVal !== "string") return false;
+        if (!likeToRegExp(opVal, false).test(fieldValue)) return false;
+        break;
+      case "$ilike":
+        if (typeof fieldValue !== "string" || typeof opVal !== "string") return false;
+        if (!likeToRegExp(opVal, true).test(fieldValue)) return false;
+        break;
+      case "$not_like":
+        if (typeof fieldValue !== "string" || typeof opVal !== "string") return false;
+        if (likeToRegExp(opVal, false).test(fieldValue)) return false;
+        break;
+      case "$not_ilike":
+        if (typeof fieldValue !== "string" || typeof opVal !== "string") return false;
+        if (likeToRegExp(opVal, true).test(fieldValue)) return false;
+        break;
+      case "$is_null":
+        if (opVal === true && fieldValue !== null && fieldValue !== void 0) return false;
+        if (opVal === false && (fieldValue === null || fieldValue === void 0)) return false;
+        break;
+      case "$is_not_null":
+        if (opVal === true && (fieldValue === null || fieldValue === void 0)) return false;
+        if (opVal === false && fieldValue !== null && fieldValue !== void 0) return false;
+        break;
+      case "$is_empty": {
+        const isEmpty = fieldValue === null || fieldValue === void 0 || fieldValue === "" || Array.isArray(fieldValue) && fieldValue.length === 0;
+        if (opVal === true && !isEmpty) return false;
+        if (opVal === false && isEmpty) return false;
+        break;
+      }
+      case "$is_not_empty": {
+        const isEmpty = fieldValue === null || fieldValue === void 0 || fieldValue === "" || Array.isArray(fieldValue) && fieldValue.length === 0;
+        if (opVal === true && isEmpty) return false;
+        if (opVal === false && !isEmpty) return false;
+        break;
+      }
+      case "$before":
+        if (!(fieldValue < opVal)) return false;
+        break;
+      case "$after":
+        if (!(fieldValue > opVal)) return false;
+        break;
+      case "$between": {
+        if (!Array.isArray(opVal) || opVal.length !== 2)
+          dfqlError("DFQL_INVALID", `$between requires [low, high] array`);
+        const [low, high] = opVal;
+        const fv = fieldValue;
+        if (!(fv >= low && fv <= high)) return false;
+        break;
+      }
+      case "$not_between": {
+        if (!Array.isArray(opVal) || opVal.length !== 2)
+          dfqlError("DFQL_INVALID", `$not_between requires [low, high] array`);
+        const [low, high] = opVal;
+        const fv = fieldValue;
+        if (!(fv < low || fv > high)) return false;
+        break;
+      }
+      default:
+        dfqlError("DFQL_UNSUPPORTED", `Unsupported DFQL operator: ${op}`);
+    }
+  }
+  return true;
+}
+var MAX_FILTER_DEPTH = 10;
+function evaluateFilter(record, filters, opts, _depth = 0) {
+  if (_depth > MAX_FILTER_DEPTH) {
+    dfqlError("DFQL_INVALID", `Filter nesting depth exceeds maximum of ${MAX_FILTER_DEPTH}`);
+  }
+  for (const [key, value] of Object.entries(filters)) {
+    if (key === "$and") {
+      if (!Array.isArray(value)) dfqlError("DFQL_INVALID", "$and must be array");
+      for (const sub of value) {
+        if (!evaluateFilter(record, sub, opts, _depth + 1)) return false;
+      }
+      continue;
+    }
+    if (key === "$or") {
+      if (!Array.isArray(value)) dfqlError("DFQL_INVALID", "$or must be array");
+      let matched = false;
+      for (const sub of value) {
+        if (evaluateFilter(record, sub, opts, _depth + 1)) {
+          matched = true;
+          break;
+        }
+      }
+      if (!matched) return false;
+      continue;
+    }
+    if (key.includes(".")) {
+      const parts = key.split(".");
+      const firstSeg = parts[0];
+      const firstVal = record[firstSeg];
+      if (firstVal !== void 0 && firstVal !== null) {
+        const resolved = resolvePath(record, parts);
+        if (!evaluateFieldValue(resolved, value)) return false;
+      } else if (opts?.resolveRelation) {
+        const resource = opts.resource ?? "";
+        const recordId = record.id;
+        const related = opts.resolveRelation(resource, recordId, firstSeg);
+        if (related.length === 0) return false;
+        const subFilter = { [parts.slice(1).join(".")]: value };
+        const anyMatch = related.some(
+          (r) => evaluateFilter(r, subFilter, opts)
+        );
+        if (!anyMatch) return false;
+      } else {
+        return false;
+      }
+      continue;
+    }
+    const fieldValue = record[key];
+    if (!evaluateFieldValue(fieldValue, value)) return false;
+  }
+  return true;
+}
+function evaluateFieldValue(fieldValue, value) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return evaluateOperators(fieldValue, value);
+  }
+  return fieldValue === value;
+}
+
+// src/relations.ts
+function normalizeRelationPayload(payload) {
+  if (typeof payload === "string") {
+    return [{ toId: payload, metadata: {} }];
+  }
+  if (Array.isArray(payload)) {
+    return payload.map((item) => {
+      if (typeof item === "string") {
+        return { toId: item, metadata: {} };
+      }
+      if (typeof item === "object" && item !== null) {
+        const { $ref, ...meta } = item;
+        if (!$ref || typeof $ref !== "string") {
+          throw new Error("Invalid relation payload item: missing or invalid $ref");
+        }
+        return { toId: $ref, metadata: meta };
+      }
+      throw new Error("Invalid relation payload item type");
+    });
+  }
+  if (typeof payload === "object" && payload !== null) {
+    const { $ref, ...meta } = payload;
+    if (!$ref || typeof $ref !== "string") {
+      throw new Error("Invalid relation payload: missing or invalid $ref");
+    }
+    return [{ toId: $ref, metadata: meta }];
+  }
+  throw new Error("Invalid relation payload: must be string, object with $ref, or array");
+}
+
+// src/aggregate.ts
+function calculateAggregation(op, field, records) {
+  if (op === "count") {
+    return records.length;
+  }
+  const values = records.map((r) => r[field]).filter((v) => v !== null && v !== void 0);
+  if (values.length === 0) return null;
+  if (op === "sum") {
+    return values.reduce((a, b) => (Number(a) || 0) + (Number(b) || 0), 0);
+  }
+  if (op === "min") {
+    let min = values[0];
+    for (const v of values) {
+      if (v < min) min = v;
+    }
+    return min;
+  }
+  if (op === "max") {
+    let max = values[0];
+    for (const v of values) {
+      if (v > max) max = v;
+    }
+    return max;
+  }
+  if (op === "avg") {
+    const sum = values.reduce((a, b) => (Number(a) || 0) + (Number(b) || 0), 0);
+    return sum / values.length;
+  }
+  return null;
+}
+
+// src/sort.ts
+function parseSortTerms(sort) {
+  if (!sort || sort.length === 0) return [];
+  return sort.map((term) => {
+    if (term.startsWith("-")) {
+      return { field: term.slice(1), direction: "desc" };
+    }
+    const colonIdx = term.indexOf(":");
+    if (colonIdx !== -1) {
+      const field = term.slice(0, colonIdx);
+      const direction = term.slice(colonIdx + 1);
+      return { field, direction };
+    }
+    return { field: term, direction: "asc" };
+  });
+}
+function sortRecords(records, terms) {
+  return [...records].sort((a, b) => {
+    for (const term of terms) {
+      const aVal = a[term.field];
+      const bVal = b[term.field];
+      if (aVal === bVal) continue;
+      let cmp;
+      if (aVal === null || aVal === void 0) {
+        cmp = 1;
+      } else if (bVal === null || bVal === void 0) {
+        cmp = -1;
+      } else if (typeof aVal === "string" && typeof bVal === "string") {
+        cmp = aVal.localeCompare(bVal);
+      } else if (typeof aVal === "number" && typeof bVal === "number") {
+        cmp = aVal - bVal;
+      } else {
+        cmp = String(aVal).localeCompare(String(bVal));
+      }
+      if (cmp !== 0) return term.direction === "asc" ? cmp : -cmp;
+    }
+    return String(a.id ?? "").localeCompare(String(b.id ?? ""));
+  });
+}
+
+// src/select.ts
+function parseSelectToken(token) {
+  const parts = token.split(".");
+  const baseName = parts[0];
+  const directive = parts.length > 1 ? parts.slice(1).join(".") : void 0;
+  return { path: parts, baseName, directive };
+}
+
+// src/date.ts
+function dfqlInvalid(msg) {
+  throw { code: "DFQL_INVALID", message: msg };
+}
+function toEpochMs(value) {
+  if (typeof value === "number") return value;
+  if (value instanceof Date) {
+    const ms = value.getTime();
+    if (isNaN(ms)) dfqlInvalid(`Invalid Date object`);
+    return ms;
+  }
+  if (typeof value === "string") {
+    const ms = new Date(value).getTime();
+    if (isNaN(ms)) dfqlInvalid(`Invalid date string: ${value}`);
+    return ms;
+  }
+  dfqlInvalid(`Cannot convert to epoch ms: ${String(value)}`);
+}
+function fromEpochMs(value) {
+  if (value instanceof Date) {
+    if (isNaN(value.getTime())) dfqlInvalid(`Invalid Date object`);
+    return value;
+  }
+  if (typeof value === "number") return new Date(value);
+  if (typeof value === "string") {
+    const d = new Date(value);
+    if (isNaN(d.getTime())) dfqlInvalid(`Invalid date string: ${value}`);
+    return d;
+  }
+  dfqlInvalid(`Cannot convert to Date: ${String(value)}`);
+}
+function coerceDateFieldsToEpoch(record, fields) {
+  for (const field of fields) {
+    if (field.type !== "date") continue;
+    const val = record[field.name];
+    if (val === null || val === void 0) continue;
+    record[field.name] = toEpochMs(val);
+  }
+  return record;
+}
+function parseDateFieldsToDate(record, fields) {
+  for (const field of fields) {
+    if (field.type !== "date") continue;
+    const val = record[field.name];
+    if (val === null || val === void 0) continue;
+    record[field.name] = fromEpochMs(val);
+  }
+  return record;
+}
+
+// src/validate.ts
+var DISALLOWED_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
+function checkPrototypePollution(obj) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  const check = (value) => {
+    if (typeof value !== "object" || value === null) {
+      return { ok: true };
+    }
+    const objectValue = value;
+    if (visited.has(objectValue)) {
+      return { ok: true };
+    }
+    visited.add(objectValue);
+    if (Array.isArray(value)) {
+      for (const element of value) {
+        const nestedResult = check(element);
+        if (!nestedResult.ok) return nestedResult;
+      }
+      return { ok: true };
+    }
+    for (const key of Object.keys(value)) {
+      if (DISALLOWED_KEYS.has(key)) {
+        return { ok: false, key };
+      }
+      const nestedResult = check(value[key]);
+      if (!nestedResult.ok) {
+        return nestedResult;
+      }
+    }
+    return { ok: true };
+  };
+  return check(obj);
+}
+function validateFieldValue(schemaType, value, nullable) {
+  if (value === null) {
+    if (nullable) return { ok: true };
+    return { ok: false, error: `expected ${schemaType}, got null` };
+  }
+  switch (schemaType) {
+    case "string":
+      if (typeof value !== "string") {
+        return { ok: false, error: `expected string, got ${typeof value}` };
+      }
+      return { ok: true };
+    case "number":
+      if (typeof value !== "number" || Number.isNaN(value)) {
+        const actual = typeof value === "number" ? "NaN" : typeof value;
+        return { ok: false, error: `expected number, got ${actual}` };
+      }
+      return { ok: true };
+    case "boolean":
+      if (typeof value !== "boolean") {
+        return { ok: false, error: `expected boolean, got ${typeof value}` };
+      }
+      return { ok: true };
+    case "date":
+      if (typeof value === "string") {
+        if (!ISO_DATE_RE.test(value) || Number.isNaN(Date.parse(value))) {
+          return { ok: false, error: `expected date (ISO 8601 string or epoch number), got invalid date string` };
+        }
+        return { ok: true };
+      }
+      if (typeof value === "number") {
+        return { ok: true };
+      }
+      return { ok: false, error: `expected date (ISO 8601 string or epoch number), got ${typeof value}` };
+    case "object":
+      if (typeof value !== "object" || Array.isArray(value)) {
+        const actual = Array.isArray(value) ? "array" : typeof value;
+        return { ok: false, error: `expected object, got ${actual}` };
+      }
+      return { ok: true };
+    case "array":
+      if (!Array.isArray(value)) {
+        return { ok: false, error: `expected array, got ${typeof value}` };
+      }
+      return { ok: true };
+    case "file":
+      if (typeof value !== "string") {
+        return { ok: false, error: `expected file (string), got ${typeof value}` };
+      }
+      return { ok: true };
+    case "json":
+      if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        return { ok: true };
+      }
+      if (typeof value === "object") {
+        return { ok: true };
+      }
+      return { ok: false, error: `expected json, got ${typeof value}` };
+    default:
+      return { ok: false, error: `unknown schema type: ${schemaType}` };
+  }
+}
+
+// src/hooks.ts
+function wrapError(err2, pluginName, hookName) {
+  if (err2 && typeof err2 === "object") {
+    const e = err2;
+    return {
+      code: e.code || "INTERNAL",
+      message: e.message || "Plugin error",
+      details: { path: `plugins.${pluginName}.${hookName}`, ...e.details ?? {} }
+    };
+  }
+  return {
+    code: "INTERNAL",
+    message: String(err2),
+    details: { path: `plugins.${pluginName}.${hookName}` }
+  };
+}
+async function runBeforeHook(plugins, env, hookName, ctx, payload, preArgs = []) {
+  let current = payload;
+  const filtered = plugins.filter((p) => p.runsOn.includes(env));
+  for (const plugin of filtered) {
+    const hook = plugin[hookName];
+    if (!hook) continue;
+    try {
+      const result = await hook(ctx, ...preArgs, current);
+      if (result !== void 0) current = result;
+    } catch (err2) {
+      return { ok: false, error: wrapError(err2, plugin.name, String(hookName)) };
+    }
+  }
+  return { ok: true, value: current };
+}
+async function runAfterHook(plugins, env, hookName, ctx, payload, result, preArgs = []) {
+  const filtered = plugins.filter((p) => p.runsOn.includes(env));
+  for (const plugin of filtered) {
+    const hook = plugin[hookName];
+    if (!hook) continue;
+    try {
+      await hook(ctx, ...preArgs, payload, result);
+    } catch (err2) {
+      console.error(`Plugin ${plugin.name}.${String(hookName)} error:`, err2);
+    }
+  }
+}
+
+exports.CAPABILITY_FIELD_DEFS = CAPABILITY_FIELD_DEFS;
+exports.KV_RESOURCE_NAME = KV_RESOURCE_NAME;
+exports.OP_REMAP = OP_REMAP;
+exports.RELATION_CAPABILITY_FIELD_DEFS = RELATION_CAPABILITY_FIELD_DEFS;
+exports.buildSchemaIndex = buildSchemaIndex;
+exports.calculateAggregation = calculateAggregation;
+exports.checkPrototypePollution = checkPrototypePollution;
+exports.coerceDateFieldsToEpoch = coerceDateFieldsToEpoch;
+exports.defineSchema = defineSchema;
 exports.dfqlKey = dfqlKey;
+exports.ensureBuiltinKv = ensureBuiltinKv;
+exports.enumerateJoinStoreKeys = enumerateJoinStoreKeys;
 exports.err = err;
+exports.evaluateFilter = evaluateFilter;
+exports.findRelationBidirectional = findRelationBidirectional;
+exports.fromEpochMs = fromEpochMs;
+exports.getCapabilityFields = getCapabilityFields;
+exports.getField = getField;
+exports.getJoinStoreKey = getJoinStoreKey;
+exports.getJoinTableName = getJoinTableName;
+exports.getRelation = getRelation;
+exports.getRelationCapabilityFieldNames = getRelationCapabilityFieldNames;
+exports.getRelationTarget = getRelationTarget;
+exports.getRelationsFrom = getRelationsFrom;
+exports.getResource = getResource;
+exports.isNamespaced = isNamespaced;
+exports.kvId = kvId;
 exports.normalizeDfql = normalizeDfql;
+exports.normalizeFilterOps = normalizeFilterOps;
+exports.normalizeRelationPayload = normalizeRelationPayload;
+exports.ns = ns;
 exports.ok = ok;
+exports.parseDateFieldsToDate = parseDateFieldsToDate;
+exports.parseSelectToken = parseSelectToken;
+exports.parseSortTerms = parseSortTerms;
+exports.resolveCapabilities = resolveCapabilities;
+exports.resolveRelationCapabilities = resolveRelationCapabilities;
+exports.runAfterHook = runAfterHook;
+exports.runBeforeHook = runBeforeHook;
+exports.sortRecords = sortRecords;
+exports.toEpochMs = toEpochMs;
 exports.unwrapEnvelope = unwrapEnvelope;
+exports.validateFieldValue = validateFieldValue;
 exports.validateSchema = validateSchema;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map