@nestjs-odata/core 1.0.0

package/dist/index.mjs

@@ -0,0 +1,2565 @@
+import { Catch, ConfigurableModuleBuilder, Controller, Delete, Get, Global, Header, HttpCode, HttpException, HttpStatus, Inject, Injectable, Module, Patch, Post, Put, SetMetadata, UseFilters, UseInterceptors, applyDecorators, createParamDecorator } from "@nestjs/common";
+import pluralize from "pluralize";
+import "reflect-metadata";
+import { Reflector } from "@nestjs/core";
+import { map } from "rxjs/operators";
+import { PATH_METADATA } from "@nestjs/common/constants.js";
+//#region src/query/odata-validation.error.ts
+/**
+* OData validation error types.
+* ODataValidationError is distinct from ODataParseError — it represents
+* semantic validation failures (unknown properties, type mismatches) rather
+* than syntax errors.
+*
+* Per threat model T-03-02: includes property name and entity type name
+* (user's own query input) but never stack traces or internal paths.
+*/
+/**
+* Thrown when field name validation fails against the EdmRegistry.
+*
+* The `entityTypeName` and `propertyName` fields provide diagnostic context
+* for the user's own query (not internal server data).
+*/
+var ODataValidationError = class extends Error {
+	constructor(message, entityTypeName, propertyName, availableProperties) {
+		const enrichedMessage = availableProperties && availableProperties.length > 0 ? `${message}. Available properties: ${availableProperties.join(", ")}` : message;
+		super(enrichedMessage);
+		this.entityTypeName = entityTypeName;
+		this.propertyName = propertyName;
+		this.availableProperties = availableProperties;
+		this.name = "ODataValidationError";
+		Object.setPrototypeOf(this, new.target.prototype);
+	}
+};
+//#endregion
+//#region src/batch/batch-parser.ts
+/**
+* OData v4 $batch multipart/mixed body parser.
+*
+* Custom parser with zero external dependencies per D-01.
+* Implements OData v4 Part 1 section 11 wire format.
+*
+* Security (T-05-01): validates boundary format, throws ODataValidationError
+* on malformed input — never passes invalid data through.
+*/
+/**
+* Maximum number of operations allowed in a single batch request (T-05-02).
+* Prevents unbounded transaction size and DoS via large batches.
+*/
+const MAX_BATCH_OPERATIONS = 100;
+/**
+* Extract the boundary value from a Content-Type header.
+*
+* Handles both quoted (boundary="abc") and unquoted (boundary=abc) formats.
+* Throws ODataValidationError if the boundary parameter is missing.
+*
+* @param contentType - The Content-Type header value (e.g., 'multipart/mixed; boundary=batch_abc123')
+* @returns The boundary string value
+* @throws ODataValidationError if boundary parameter is missing
+*/
+function extractBoundary(contentType) {
+	const match = /boundary=(?:"([^"]+)"|([^\s;]+))/i.exec(contentType);
+	if (!match) throw new ODataValidationError("Missing boundary parameter in Content-Type header for $batch request", "$batch", "boundary");
+	return match[1] ?? match[2] ?? "";
+}
+/**
+* Parse a multipart/mixed batch body into structured BatchPart objects.
+*
+* Handles:
+*   - Individual request parts (kind: 'request')
+*   - Changesets (kind: 'changeset') containing sub-request parts
+*   - Both CRLF (\r\n) and LF (\n) line endings
+*   - Content-ID headers for changeset sub-parts
+*   - Embedded HTTP request parsing (METHOD URL HTTP/1.1, headers, body)
+*
+* Per T-05-02: rejects batches exceeding MAX_BATCH_OPERATIONS operations.
+*
+* @param body - The raw request body string
+* @param boundary - The multipart boundary (from extractBoundary())
+* @returns ParsedBatch with all parsed parts
+* @throws ODataValidationError if body is malformed or exceeds limits
+*/
+function parseBatchBody(body, boundary) {
+	if (!body || body.trim() === "") return {
+		boundary,
+		parts: []
+	};
+	const parts = splitByBoundary(body.replace(/\r\n/g, "\n"), boundary);
+	let totalOperations = 0;
+	const batchParts = [];
+	for (const part of parts) {
+		const trimmed = part.trim();
+		if (!trimmed) continue;
+		const parsed = parsePart(trimmed);
+		if (parsed) {
+			if (parsed.kind === "request") totalOperations++;
+			else if (parsed.kind === "changeset") totalOperations += parsed.parts.length;
+			if (totalOperations > 100) throw new ODataValidationError(`Batch request exceeds maximum of 100 operations`, "$batch", "operations");
+			batchParts.push(parsed);
+		}
+	}
+	return {
+		boundary,
+		parts: batchParts
+	};
+}
+/**
+* Split a normalized (LF-only) body by the multipart boundary.
+* Returns the content segments between boundary markers.
+*/
+function splitByBoundary(body, boundary) {
+	const delimiter = `--${boundary}`;
+	const terminator = `--${boundary}--`;
+	const lines = body.split("\n");
+	const segments = [];
+	let currentSegment = [];
+	let inSegment = false;
+	for (const line of lines) {
+		const trimmedLine = line.trimEnd();
+		if (trimmedLine === terminator) {
+			if (inSegment && currentSegment.length > 0) segments.push(currentSegment.join("\n"));
+			inSegment = false;
+			currentSegment = [];
+			break;
+		} else if (trimmedLine === delimiter) {
+			if (inSegment && currentSegment.length > 0) {
+				segments.push(currentSegment.join("\n"));
+				currentSegment = [];
+			}
+			inSegment = true;
+		} else if (inSegment) currentSegment.push(line);
+	}
+	if (inSegment && currentSegment.length > 0) segments.push(currentSegment.join("\n"));
+	return segments;
+}
+/**
+* Parse a single multipart segment into a BatchPart.
+* Detects whether it's a changeset or an individual request.
+*/
+function parsePart(segment) {
+	const blankLineIdx = segment.indexOf("\n\n");
+	if (blankLineIdx === -1) throw new ODataValidationError("Malformed batch part: missing blank line separator between headers and content", "$batch", "part");
+	const headerSection = segment.slice(0, blankLineIdx);
+	const content = segment.slice(blankLineIdx + 2);
+	const partHeaders = parseMimeHeaders(headerSection);
+	const contentType = getHeaderValue(partHeaders, "content-type");
+	if (contentType && contentType.toLowerCase().startsWith("multipart/mixed")) return parseChangeset(content, contentType);
+	else return parseRequestPart(content, partHeaders);
+}
+/**
+* Parse a changeset part (kind: 'changeset') by recursively parsing its sub-parts.
+*/
+function parseChangeset(content, changesetContentType) {
+	const changesetBoundary = extractBoundary(changesetContentType);
+	const subSegments = splitByBoundary(content.trim(), changesetBoundary);
+	const subParts = [];
+	for (const subSegment of subSegments) {
+		const trimmed = subSegment.trim();
+		if (!trimmed) continue;
+		const blankLineIdx = trimmed.indexOf("\n\n");
+		if (blankLineIdx === -1) throw new ODataValidationError("Malformed changeset sub-part: missing blank line separator", "$batch", "changeset-part");
+		const subHeaderSection = trimmed.slice(0, blankLineIdx);
+		const requestPart = parseRequestPart(trimmed.slice(blankLineIdx + 2), parseMimeHeaders(subHeaderSection));
+		if (requestPart) subParts.push(requestPart);
+	}
+	return {
+		kind: "changeset",
+		parts: subParts
+	};
+}
+/**
+* Parse an individual HTTP request embedded in a batch part.
+*
+* The content is an embedded HTTP request:
+*   METHOD URL HTTP/1.1\n
+*   Header-Name: value\n
+*   \n
+*   [optional body]
+*/
+function parseRequestPart(content, mimeHeaders) {
+	const lines = content.trim().split("\n");
+	if (lines.length === 0 || !lines[0]) throw new ODataValidationError("Malformed batch sub-request: empty content", "$batch", "request");
+	const requestLine = lines[0].trimEnd();
+	const requestLineMatch = /^(\S+)\s+(\S+)(?:\s+HTTP\/\S+)?$/.exec(requestLine);
+	if (!requestLineMatch) throw new ODataValidationError(`Malformed batch sub-request line: '${requestLine}'`, "$batch", "request-line");
+	const method = requestLineMatch[1] ?? "";
+	const url = requestLineMatch[2] ?? "";
+	const httpHeaders = {};
+	let bodyStartIdx = 1;
+	for (let i = 1; i < lines.length; i++) {
+		const line = lines[i].trimEnd();
+		if (line === "") {
+			bodyStartIdx = i + 1;
+			break;
+		}
+		const colonIdx = line.indexOf(":");
+		if (colonIdx !== -1) {
+			const headerName = line.slice(0, colonIdx).trim().toLowerCase();
+			httpHeaders[headerName] = line.slice(colonIdx + 1).trim();
+		}
+		bodyStartIdx = i + 1;
+	}
+	const body = lines.slice(bodyStartIdx).join("\n").trim() || void 0;
+	const contentId = getHeaderValue(mimeHeaders, "content-id");
+	return {
+		kind: "request",
+		contentId: contentId !== void 0 ? contentId.replace(/^<|>$/g, "") : void 0,
+		method: method.toUpperCase(),
+		url,
+		headers: httpHeaders,
+		body
+	};
+}
+/**
+* Parse MIME-style headers from a header section string.
+* Returns a map of lowercase header names to values.
+*/
+function parseMimeHeaders(headerSection) {
+	const headers = {};
+	const lines = headerSection.split("\n");
+	for (const line of lines) {
+		const trimmedLine = line.trimEnd();
+		if (!trimmedLine) continue;
+		const colonIdx = trimmedLine.indexOf(":");
+		if (colonIdx !== -1) {
+			const name = trimmedLine.slice(0, colonIdx).trim().toLowerCase();
+			headers[name] = trimmedLine.slice(colonIdx + 1).trim();
+		}
+	}
+	return headers;
+}
+/**
+* Get a header value by name (case-insensitive lookup).
+* Returns undefined if not found.
+*/
+function getHeaderValue(headers, name) {
+	return headers[name.toLowerCase()];
+}
+//#endregion
+//#region src/parser/visitor.ts
+/**
+* Dispatch a FilterNode to the appropriate visitor method.
+* Convenience function to avoid writing switch statements in every visitor.
+*/
+function acceptVisitor(node, visitor) {
+	switch (node.kind) {
+		case "BinaryExpr": return visitor.visitBinaryExpr(node);
+		case "UnaryExpr": return visitor.visitUnaryExpr(node);
+		case "FunctionCall": return visitor.visitFunctionCall(node);
+		case "LambdaExpr": return visitor.visitLambdaExpr(node);
+		case "PropertyAccess": return visitor.visitPropertyAccess(node);
+		case "Literal": return visitor.visitLiteral(node);
+	}
+}
+//#endregion
+//#region src/parser/errors.ts
+/**
+* OData parser error types.
+* ODataParseError carries position information for diagnostic messages.
+*/
+/**
+* Thrown when the lexer or parser encounters malformed OData query syntax.
+*
+* The `position` field indicates the character offset in the input string
+* where the error was detected. The `token` field (if available) holds
+* the token that triggered the error.
+*
+* Note: position info is intentionally included — the input is the user's own
+* query string, not server-internal data, so there is no information disclosure risk.
+*/
+var ODataParseError = class ODataParseError extends Error {
+	constructor(message, position, token = null, queryContext) {
+		super(message);
+		this.position = position;
+		this.token = token;
+		this.queryContext = queryContext;
+		this.name = "ODataParseError";
+		Object.setPrototypeOf(this, new.target.prototype);
+	}
+	/**
+	* Create an ODataParseError with a context snippet extracted from the query string.
+	* Extracts ~20 characters before and after the error position for diagnostic context.
+	*
+	* Per threat model T-12-05: context snippet shows only the user's own query input
+	* (already known to them) — never includes stack traces or internal paths.
+	*
+	* @param message - Base error message
+	* @param position - Character offset where the error was detected
+	* @param queryString - The full query string for context extraction
+	* @param token - Optional token that triggered the error
+	*/
+	static withContext(message, position, queryString, token = null) {
+		const contextRadius = 20;
+		const start = Math.max(0, position - contextRadius);
+		const end = Math.min(queryString.length, position + contextRadius);
+		const prefix = start > 0 ? "..." : "";
+		const suffix = end < queryString.length ? "..." : "";
+		const snippet = `${prefix}${queryString.slice(start, end)}${suffix}`;
+		return new ODataParseError(`${message} at position ${position}: ${snippet}`, position, token, snippet);
+	}
+};
+//#endregion
+//#region src/parser/lexer.ts
+/**
+* OData v4 Lexer (tokenizer).
+* Converts an OData query expression string into a token stream.
+*
+* Character-by-character scanning with keyword disambiguation.
+* OData keyword recognition per Part 2 Section 5.1.1 ABNF grammar.
+*/
+/** All token kinds produced by the OData lexer */
+let TokenKind = /* @__PURE__ */ function(TokenKind) {
+	TokenKind["STRING_LITERAL"] = "STRING_LITERAL";
+	TokenKind["INT_LITERAL"] = "INT_LITERAL";
+	TokenKind["DECIMAL_LITERAL"] = "DECIMAL_LITERAL";
+	TokenKind["BOOL_LITERAL"] = "BOOL_LITERAL";
+	TokenKind["NULL_LITERAL"] = "NULL_LITERAL";
+	TokenKind["GUID_LITERAL"] = "GUID_LITERAL";
+	TokenKind["DATETIME_LITERAL"] = "DATETIME_LITERAL";
+	TokenKind["IDENTIFIER"] = "IDENTIFIER";
+	TokenKind["OPEN_PAREN"] = "OPEN_PAREN";
+	TokenKind["CLOSE_PAREN"] = "CLOSE_PAREN";
+	TokenKind["COMMA"] = "COMMA";
+	TokenKind["SLASH"] = "SLASH";
+	TokenKind["COLON"] = "COLON";
+	TokenKind["STAR"] = "STAR";
+	TokenKind["AND"] = "AND";
+	TokenKind["OR"] = "OR";
+	TokenKind["NOT"] = "NOT";
+	TokenKind["EQ"] = "EQ";
+	TokenKind["NE"] = "NE";
+	TokenKind["LT"] = "LT";
+	TokenKind["LE"] = "LE";
+	TokenKind["GT"] = "GT";
+	TokenKind["GE"] = "GE";
+	TokenKind["HAS"] = "HAS";
+	TokenKind["IN"] = "IN";
+	TokenKind["ADD"] = "ADD";
+	TokenKind["SUB"] = "SUB";
+	TokenKind["MUL"] = "MUL";
+	TokenKind["DIV"] = "DIV";
+	TokenKind["DIVBY"] = "DIVBY";
+	TokenKind["MOD"] = "MOD";
+	TokenKind["EOF"] = "EOF";
+	return TokenKind;
+}({});
+/** Mapping of OData keyword strings to their TokenKind */
+const KEYWORDS = {
+	and: TokenKind.AND,
+	or: TokenKind.OR,
+	not: TokenKind.NOT,
+	eq: TokenKind.EQ,
+	ne: TokenKind.NE,
+	lt: TokenKind.LT,
+	le: TokenKind.LE,
+	gt: TokenKind.GT,
+	ge: TokenKind.GE,
+	has: TokenKind.HAS,
+	in: TokenKind.IN,
+	add: TokenKind.ADD,
+	sub: TokenKind.SUB,
+	mul: TokenKind.MUL,
+	div: TokenKind.DIV,
+	divby: TokenKind.DIVBY,
+	mod: TokenKind.MOD
+};
+/** GUID pattern: 8-4-4-4-12 hex chars */
+const GUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isAlpha(ch) {
+	return ch >= "a" && ch <= "z" || ch >= "A" && ch <= "Z" || ch === "_";
+}
+function isAlphaNum(ch) {
+	return isAlpha(ch) || isDigit(ch);
+}
+/**
+* Tokenize an OData query expression string into a token array.
+* The last token is always EOF.
+*
+* @param input - Raw OData expression string (e.g., "Price gt 5 and Active eq true")
+* @returns Array of tokens ending with EOF
+* @throws ODataParseError on unrecognized characters
+*/
+function tokenize(input) {
+	const tokens = [];
+	let pos = 0;
+	while (pos < input.length) {
+		if (input[pos] === " " || input[pos] === "	") {
+			pos++;
+			continue;
+		}
+		const start = pos;
+		const ch = input[pos];
+		if (ch === "(") {
+			tokens.push({
+				kind: TokenKind.OPEN_PAREN,
+				value: "(",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === ")") {
+			tokens.push({
+				kind: TokenKind.CLOSE_PAREN,
+				value: ")",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === ",") {
+			tokens.push({
+				kind: TokenKind.COMMA,
+				value: ",",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === "/") {
+			tokens.push({
+				kind: TokenKind.SLASH,
+				value: "/",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === ":") {
+			tokens.push({
+				kind: TokenKind.COLON,
+				value: ":",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === "*") {
+			tokens.push({
+				kind: TokenKind.STAR,
+				value: "*",
+				position: start
+			});
+			pos++;
+			continue;
+		}
+		if (ch === "'") {
+			pos++;
+			let value = "";
+			while (pos < input.length) if (input[pos] === "'") if (pos + 1 < input.length && input[pos + 1] === "'") {
+				value += "'";
+				pos += 2;
+			} else {
+				pos++;
+				break;
+			}
+			else {
+				value += input[pos];
+				pos++;
+			}
+			tokens.push({
+				kind: TokenKind.STRING_LITERAL,
+				value,
+				position: start
+			});
+			continue;
+		}
+		if (isDigit(ch)) {
+			let numStr = "";
+			while (pos < input.length && isDigit(input[pos])) numStr += input[pos++];
+			if (pos < input.length && input[pos] === "." && pos + 1 < input.length && isDigit(input[pos + 1])) {
+				numStr += ".";
+				pos++;
+				while (pos < input.length && isDigit(input[pos])) numStr += input[pos++];
+				tokens.push({
+					kind: TokenKind.DECIMAL_LITERAL,
+					value: parseFloat(numStr),
+					position: start
+				});
+			} else {
+				const remaining = input.slice(start);
+				if (GUID_RE.exec(remaining) && remaining.length >= 36) {
+					const guidStr = remaining.slice(0, 36);
+					if (GUID_RE.test(guidStr)) {
+						tokens.push({
+							kind: TokenKind.GUID_LITERAL,
+							value: guidStr,
+							position: start
+						});
+						pos = start + 36;
+						continue;
+					}
+				}
+				tokens.push({
+					kind: TokenKind.INT_LITERAL,
+					value: parseInt(numStr, 10),
+					position: start
+				});
+			}
+			continue;
+		}
+		if (isAlpha(ch)) {
+			let word = "";
+			while (pos < input.length && (isAlphaNum(input[pos]) || input[pos] === "-")) {
+				if (input[pos] === "-") {
+					word + input.slice(start, pos);
+					const remaining = input.slice(start);
+					if (GUID_RE.test(remaining.slice(0, 36))) {
+						const guidStr = remaining.slice(0, 36);
+						tokens.push({
+							kind: TokenKind.GUID_LITERAL,
+							value: guidStr,
+							position: start
+						});
+						pos = start + 36;
+						word = "";
+						break;
+					}
+					break;
+				}
+				word += input[pos++];
+			}
+			if (word === "") continue;
+			if (word === "true") {
+				tokens.push({
+					kind: TokenKind.BOOL_LITERAL,
+					value: true,
+					position: start
+				});
+				continue;
+			}
+			if (word === "false") {
+				tokens.push({
+					kind: TokenKind.BOOL_LITERAL,
+					value: false,
+					position: start
+				});
+				continue;
+			}
+			if (word === "null") {
+				tokens.push({
+					kind: TokenKind.NULL_LITERAL,
+					value: null,
+					position: start
+				});
+				continue;
+			}
+			if (word in KEYWORDS) {
+				tokens.push({
+					kind: KEYWORDS[word],
+					value: word,
+					position: start
+				});
+				continue;
+			}
+			tokens.push({
+				kind: TokenKind.IDENTIFIER,
+				value: word,
+				position: start
+			});
+			continue;
+		}
+		throw new ODataParseError(`Unexpected character '${ch}' at position ${pos}`, pos);
+	}
+	tokens.push({
+		kind: TokenKind.EOF,
+		value: null,
+		position: pos
+	});
+	return tokens;
+}
+//#endregion
+//#region src/parser/parser.ts
+/** Maximum nesting depth for parenthesized expressions (DoS protection, T-01-09) */
+const MAX_NESTING_DEPTH = 50;
+/**
+* Operator precedence levels.
+* Higher number = binds tighter.
+*/
+const PRECEDENCE = {
+	[TokenKind.OR]: 1,
+	[TokenKind.AND]: 2,
+	[TokenKind.EQ]: 4,
+	[TokenKind.NE]: 4,
+	[TokenKind.LT]: 4,
+	[TokenKind.LE]: 4,
+	[TokenKind.GT]: 4,
+	[TokenKind.GE]: 4,
+	[TokenKind.HAS]: 4,
+	[TokenKind.IN]: 4,
+	[TokenKind.ADD]: 5,
+	[TokenKind.SUB]: 5,
+	[TokenKind.MUL]: 6,
+	[TokenKind.DIV]: 6,
+	[TokenKind.DIVBY]: 6,
+	[TokenKind.MOD]: 6
+};
+/** Map from TokenKind to BinaryOperator string */
+const BINARY_OP_MAP = {
+	[TokenKind.EQ]: "eq",
+	[TokenKind.NE]: "ne",
+	[TokenKind.LT]: "lt",
+	[TokenKind.LE]: "le",
+	[TokenKind.GT]: "gt",
+	[TokenKind.GE]: "ge",
+	[TokenKind.HAS]: "has",
+	[TokenKind.IN]: "in",
+	[TokenKind.AND]: "and",
+	[TokenKind.OR]: "or",
+	[TokenKind.ADD]: "add",
+	[TokenKind.SUB]: "sub",
+	[TokenKind.MUL]: "mul",
+	[TokenKind.DIV]: "div",
+	[TokenKind.DIVBY]: "divby",
+	[TokenKind.MOD]: "mod"
+};
+/**
+* Known OData v4 built-in functions that the parser validates.
+* Prevents arbitrary function names from being silently accepted.
+*/
+const KNOWN_FUNCTIONS = new Set([
+	"startswith",
+	"endswith",
+	"contains",
+	"indexof",
+	"substring",
+	"length",
+	"tolower",
+	"toupper",
+	"trim",
+	"concat",
+	"matchesPattern",
+	"year",
+	"month",
+	"day",
+	"hour",
+	"minute",
+	"second",
+	"fractionalseconds",
+	"totaloffsetminutes",
+	"date",
+	"time",
+	"now",
+	"mindatetime",
+	"maxdatetime",
+	"totalseconds",
+	"round",
+	"floor",
+	"ceiling",
+	"cast",
+	"isof",
+	"geo.distance",
+	"geo.intersects",
+	"geo.length"
+]);
+/** Lambda operators */
+const LAMBDA_OPS = new Set(["any", "all"]);
+var Parser = class {
+	tokens;
+	pos = 0;
+	nestingDepth = 0;
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	peek() {
+		return this.tokens[this.pos] ?? {
+			kind: TokenKind.EOF,
+			value: null,
+			position: -1
+		};
+	}
+	advance() {
+		const tok = this.tokens[this.pos];
+		if (tok === void 0) return {
+			kind: TokenKind.EOF,
+			value: null,
+			position: -1
+		};
+		this.pos++;
+		return tok;
+	}
+	expect(kind) {
+		const tok = this.peek();
+		if (tok.kind !== kind) throw new ODataParseError(`Expected ${kind} but got ${tok.kind} ('${String(tok.value)}') at position ${tok.position}`, tok.position, tok);
+		return this.advance();
+	}
+	isBinaryOperator(token) {
+		return token.kind in PRECEDENCE;
+	}
+	getPrecedence(token) {
+		return PRECEDENCE[token.kind] ?? 0;
+	}
+	/**
+	* Parse a filter expression using Pratt/precedence-climbing.
+	* @param minPrecedence - Minimum binding power for the current operator level
+	*/
+	parseExpression(minPrecedence = 0) {
+		let left = this.parsePrimary();
+		while (this.isBinaryOperator(this.peek()) && this.getPrecedence(this.peek()) > minPrecedence) {
+			const opToken = this.advance();
+			const prec = this.getPrecedence(opToken);
+			const right = this.parseExpression(prec);
+			const operator = BINARY_OP_MAP[opToken.kind];
+			if (operator === void 0) throw new ODataParseError(`Unknown binary operator token: ${opToken.kind}`, opToken.position, opToken);
+			left = {
+				kind: "BinaryExpr",
+				operator,
+				left,
+				right
+			};
+		}
+		return left;
+	}
+	/**
+	* Parse a primary expression (literals, identifiers, function calls, lambdas, parens, unary).
+	*/
+	parsePrimary() {
+		const token = this.peek();
+		if (token.kind === TokenKind.OPEN_PAREN) {
+			this.advance();
+			this.nestingDepth++;
+			if (this.nestingDepth > MAX_NESTING_DEPTH) throw new ODataParseError(`Maximum nesting depth of ${MAX_NESTING_DEPTH} exceeded`, token.position, token);
+			const expr = this.parseExpression(0);
+			this.nestingDepth--;
+			this.expect(TokenKind.CLOSE_PAREN);
+			return expr;
+		}
+		if (token.kind === TokenKind.NOT) {
+			this.advance();
+			return {
+				kind: "UnaryExpr",
+				operator: "not",
+				operand: this.parseExpression(3)
+			};
+		}
+		if (token.kind === TokenKind.SUB) {
+			this.advance();
+			const operand = this.parsePrimary();
+			if (operand.kind === "Literal" && operand.literalKind === "number") return {
+				kind: "Literal",
+				literalKind: operand.literalKind,
+				value: -operand.value
+			};
+			return {
+				kind: "UnaryExpr",
+				operator: "neg",
+				operand
+			};
+		}
+		if (token.kind === TokenKind.STRING_LITERAL || token.kind === TokenKind.INT_LITERAL || token.kind === TokenKind.DECIMAL_LITERAL) {
+			this.advance();
+			return {
+				kind: "Literal",
+				literalKind: token.kind === TokenKind.STRING_LITERAL ? "string" : "number",
+				value: token.value
+			};
+		}
+		if (token.kind === TokenKind.BOOL_LITERAL) {
+			this.advance();
+			return {
+				kind: "Literal",
+				literalKind: "boolean",
+				value: token.value
+			};
+		}
+		if (token.kind === TokenKind.NULL_LITERAL) {
+			this.advance();
+			return {
+				kind: "Literal",
+				literalKind: "null",
+				value: null
+			};
+		}
+		if (token.kind === TokenKind.GUID_LITERAL) {
+			this.advance();
+			return {
+				kind: "Literal",
+				literalKind: "guid",
+				value: token.value
+			};
+		}
+		if (token.kind === TokenKind.DATETIME_LITERAL) {
+			this.advance();
+			return {
+				kind: "Literal",
+				literalKind: "dateTimeOffset",
+				value: token.value
+			};
+		}
+		if (token.kind === TokenKind.IDENTIFIER) return this.parseIdentifierExpression();
+		throw new ODataParseError(`Unexpected token ${token.kind} ('${String(token.value)}') at position ${token.position}`, token.position, token);
+	}
+	/**
+	* Parse an identifier-started expression:
+	*  1. identifier(   → function call
+	*  2. identifier/identifier(  → lambda (any/all)
+	*  3. identifier/identifier/.../identifier  → property access
+	*  4. identifier  → single-segment property access
+	*/
+	parseIdentifierExpression() {
+		const firstToken = this.advance();
+		const firstName = firstToken.value;
+		if (this.peek().kind === TokenKind.OPEN_PAREN) return this.parseFunctionCall(firstName, firstToken.position);
+		if (this.peek().kind === TokenKind.SLASH) {
+			this.advance();
+			const nextToken = this.peek();
+			if (nextToken.kind !== TokenKind.IDENTIFIER) throw new ODataParseError(`Expected identifier after '/' but got ${nextToken.kind} at position ${nextToken.position}`, nextToken.position, nextToken);
+			const secondName = nextToken.value;
+			if (LAMBDA_OPS.has(secondName)) {
+				const savedPos = this.pos;
+				this.advance();
+				if (this.peek().kind === TokenKind.OPEN_PAREN) return this.parseLambdaExpr(firstName, secondName, firstToken.position);
+				this.pos = savedPos;
+			}
+			this.advance();
+			const path = [firstName, secondName];
+			while (this.peek().kind === TokenKind.SLASH) {
+				this.advance();
+				const segToken = this.peek();
+				if (segToken.kind !== TokenKind.IDENTIFIER) throw new ODataParseError(`Expected identifier after '/' but got ${segToken.kind} at position ${segToken.position}`, segToken.position, segToken);
+				path.push(segToken.value);
+				this.advance();
+			}
+			return {
+				kind: "PropertyAccess",
+				path
+			};
+		}
+		return {
+			kind: "PropertyAccess",
+			path: [firstName]
+		};
+	}
+	/**
+	* Parse a function call: name(arg1, arg2, ...)
+	* Validates against the known built-in function list.
+	*/
+	parseFunctionCall(name, position) {
+		if (!KNOWN_FUNCTIONS.has(name)) throw new ODataParseError(`Unknown function '${name}' at position ${position}. Known functions: ${Array.from(KNOWN_FUNCTIONS).join(", ")}`, position);
+		this.expect(TokenKind.OPEN_PAREN);
+		const args = [];
+		if (this.peek().kind !== TokenKind.CLOSE_PAREN) {
+			args.push(this.parseExpression(0));
+			while (this.peek().kind === TokenKind.COMMA) {
+				this.advance();
+				args.push(this.parseExpression(0));
+			}
+		}
+		this.expect(TokenKind.CLOSE_PAREN);
+		return {
+			kind: "FunctionCall",
+			name,
+			args
+		};
+	}
+	/**
+	* Parse a lambda expression: collection/operator(variable:predicate)
+	* e.g., Tags/any(t:t/Name eq 'electronics')
+	* e.g., Tags/any() — no-predicate variant
+	*/
+	parseLambdaExpr(collection, operator, position) {
+		if (!LAMBDA_OPS.has(operator)) throw new ODataParseError(`Unknown lambda operator '${operator}' at position ${position}`, position);
+		this.expect(TokenKind.OPEN_PAREN);
+		if (this.peek().kind === TokenKind.CLOSE_PAREN) {
+			this.advance();
+			return {
+				kind: "LambdaExpr",
+				operator,
+				collection,
+				variable: null,
+				predicate: null
+			};
+		}
+		const variable = this.expect(TokenKind.IDENTIFIER).value;
+		this.expect(TokenKind.COLON);
+		const predicate = this.parseExpression(0);
+		this.expect(TokenKind.CLOSE_PAREN);
+		return {
+			kind: "LambdaExpr",
+			operator,
+			collection,
+			variable,
+			predicate
+		};
+	}
+	/**
+	* Ensure we have consumed all tokens (no trailing garbage).
+	*/
+	expectEOF() {
+		const tok = this.peek();
+		if (tok.kind !== TokenKind.EOF) throw new ODataParseError(`Unexpected token ${tok.kind} ('${String(tok.value)}') at position ${tok.position} — expected end of expression`, tok.position, tok);
+	}
+};
+/**
+* Parse a standalone OData $filter expression string into a FilterNode AST.
+*
+* @param input - Raw filter expression (e.g., "Price gt 5 and Active eq true")
+* @returns Root FilterNode of the parsed expression
+* @throws ODataParseError on syntax errors
+*/
+function parseFilter(input) {
+	if (!input.trim()) throw new ODataParseError("Filter expression must not be empty", 0);
+	const parser = new Parser(tokenize(input));
+	const node = parser.parseExpression(0);
+	parser.expectEOF();
+	return node;
+}
+/**
+* Parse an OData query string into a QueryOptions object.
+* Handles $filter, $orderby, $select, $top, $skip.
+* Unknown query options are silently ignored.
+*
+* @param queryString - Raw query string, with or without leading '?'
+* @returns Parsed QueryOptions (fields are optional — only present when found in query)
+* @throws ODataParseError on syntax errors
+*/
+function parseQuery(queryString) {
+	const qs = queryString.startsWith("?") ? queryString.slice(1) : queryString;
+	if (!qs.trim()) return {};
+	const parts = qs.split("&");
+	let filter;
+	let orderBy;
+	let select;
+	let top;
+	let skip;
+	let expand;
+	for (const part of parts) {
+		const lpart = part.toLowerCase();
+		if (lpart.startsWith("$filter=")) filter = parseFilter(part.slice(8));
+		else if (lpart.startsWith("$orderby=")) orderBy = parseOrderBy(part.slice(9));
+		else if (lpart.startsWith("$select=")) select = parseSelect(part.slice(8));
+		else if (lpart.startsWith("$top=")) top = parseNonNegativeInt(part.slice(5), "$top", 0);
+		else if (lpart.startsWith("$skip=")) skip = parseNonNegativeInt(part.slice(6), "$skip", 0);
+		else if (lpart.startsWith("$expand=")) expand = parseExpand(part.slice(8));
+	}
+	return {
+		filter,
+		orderBy,
+		select,
+		top,
+		skip,
+		expand
+	};
+}
+/**
+* Parse the value of a $orderby query option.
+* Format: expr [asc|desc] (, expr [asc|desc])*
+*/
+function parseOrderBy(value) {
+	if (!value.trim()) return [];
+	return value.split(",").map((item) => {
+		const trimmed = item.trim();
+		let exprStr = trimmed;
+		let direction = "asc";
+		const lower = trimmed.toLowerCase();
+		if (/ desc$/i.test(lower)) {
+			direction = "desc";
+			exprStr = trimmed.slice(0, -5).trimEnd();
+		} else if (/ asc$/i.test(lower)) {
+			direction = "asc";
+			exprStr = trimmed.slice(0, -4).trimEnd();
+		}
+		const parser = new Parser(tokenize(exprStr));
+		const expression = parser.parseExpression(0);
+		parser.expectEOF();
+		return {
+			expression,
+			direction
+		};
+	});
+}
+/**
+* Parse the value of a $select query option.
+* Format: * | path (, path)*  where path is a slash-separated property name list
+*/
+function parseSelect(value) {
+	if (value.trim() === "*") return { all: true };
+	return { items: value.split(",").map((p) => {
+		return { path: p.trim().split("/").filter(Boolean) };
+	}) };
+}
+/**
+* Split an $expand value string by top-level commas only (not commas inside parentheses).
+* Tracks parenthesis depth to avoid splitting nested options like Items($filter=x),Customer.
+*/
+function splitTopLevelCommas$1(value) {
+	const segments = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < value.length; i++) {
+		const ch = value[i];
+		if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			segments.push(value.slice(start, i));
+			start = i + 1;
+		}
+	}
+	segments.push(value.slice(start));
+	return segments;
+}
+/**
+* Parse the value of a $expand query option into an ExpandNode.
+* Handles simple (Customer), multi (Customer,Items), nested options (Items($filter=...)),
+* and recursive nested expand (Items($expand=Product)).
+*
+* Per D-07: Full nested $expand support.
+* Per D-08: Nested query options use semicolons as separators.
+* Per T-04-01: Inherits max nesting depth from recursive parseQuery calls.
+*/
+function parseExpand(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return { items: [] };
+	return { items: splitTopLevelCommas$1(trimmed).map((seg) => seg.trim()).filter((seg) => seg.length > 0).map((seg) => {
+		const parenIdx = seg.indexOf("(");
+		if (parenIdx === -1) return { navigationProperty: seg.trim() };
+		const navigationProperty = seg.slice(0, parenIdx).trim();
+		const nested = parseQuery(seg.slice(parenIdx + 1, seg.length - 1).replace(/;/g, "&"));
+		return {
+			navigationProperty,
+			...nested.filter !== void 0 && { filter: nested.filter },
+			...nested.select !== void 0 && { select: nested.select },
+			...nested.orderBy !== void 0 && { orderBy: nested.orderBy },
+			...nested.top !== void 0 && { top: nested.top },
+			...nested.skip !== void 0 && { skip: nested.skip },
+			...nested.expand !== void 0 && { expand: nested.expand }
+		};
+	}) };
+}
+/**
+* Parse and validate a non-negative integer value for $top or $skip.
+* @throws ODataParseError if the value is not a valid non-negative integer
+*/
+function parseNonNegativeInt(value, paramName, position) {
+	const trimmed = value.trim();
+	if (!/^\d+$/.test(trimmed)) throw new ODataParseError(`${paramName} must be a non-negative integer, got '${trimmed}'`, position);
+	const n = parseInt(trimmed, 10);
+	if (n < 0) throw new ODataParseError(`${paramName} must be a non-negative integer, got ${n}`, position);
+	return n;
+}
+//#endregion
+//#region src/parser/search-parser.ts
+/** Maximum number of binary operations allowed in a search expression (DoS protection). */
+const MAX_SEARCH_DEPTH = 20;
+/**
+* Tokenizes a $search query string into a flat list of tokens.
+* Handles double-quoted phrases and keyword recognition.
+*/
+function tokenizeSearch(input) {
+	const tokens = [];
+	let i = 0;
+	const trimmed = input.trim();
+	while (i < trimmed.length) {
+		while (i < trimmed.length && trimmed[i] === " ") i++;
+		if (i >= trimmed.length) break;
+		if (trimmed[i] === "\"") {
+			i++;
+			let phrase = "";
+			while (i < trimmed.length && trimmed[i] !== "\"") phrase += trimmed[i++];
+			if (i < trimmed.length) i++;
+			tokens.push({
+				type: "TERM",
+				value: phrase,
+				negated: false
+			});
+			continue;
+		}
+		let word = "";
+		while (i < trimmed.length && trimmed[i] !== " ") word += trimmed[i++];
+		if (word === "AND") tokens.push({ type: "AND" });
+		else if (word === "OR") tokens.push({ type: "OR" });
+		else if (word === "NOT") {
+			while (i < trimmed.length && trimmed[i] === " ") i++;
+			if (i >= trimmed.length) throw new ODataParseError("NOT operator must be followed by a search term", i);
+			if (trimmed[i] === "\"") {
+				i++;
+				let phrase = "";
+				while (i < trimmed.length && trimmed[i] !== "\"") phrase += trimmed[i++];
+				if (i < trimmed.length) i++;
+				tokens.push({
+					type: "TERM",
+					value: phrase,
+					negated: true
+				});
+			} else {
+				let nextWord = "";
+				while (i < trimmed.length && trimmed[i] !== " ") nextWord += trimmed[i++];
+				tokens.push({
+					type: "TERM",
+					value: nextWord,
+					negated: true
+				});
+			}
+		} else tokens.push({
+			type: "TERM",
+			value: word,
+			negated: false
+		});
+	}
+	return tokens;
+}
+/**
+* Build a SearchNode from a flat token list using a recursive-descent approach.
+* OR has lower precedence than AND (AND binds tighter).
+*/
+function buildSearchNode(tokens, depth) {
+	if (depth > MAX_SEARCH_DEPTH) throw new ODataParseError(`$search expression exceeds maximum depth of ${MAX_SEARCH_DEPTH} — expression too complex`, 0);
+	if (tokens.length === 0) throw new ODataParseError("Empty $search expression — at least one search term is required", 0);
+	const orIdx = findTopLevelOperator(tokens, "OR");
+	if (orIdx !== -1) return {
+		kind: "SearchBinary",
+		operator: "OR",
+		left: buildSearchNode(tokens.slice(0, orIdx), depth + 1),
+		right: buildSearchNode(tokens.slice(orIdx + 1), depth + 1)
+	};
+	const andIdx = findTopLevelOperator(tokens, "AND");
+	if (andIdx !== -1) return {
+		kind: "SearchBinary",
+		operator: "AND",
+		left: buildSearchNode(tokens.slice(0, andIdx), depth + 1),
+		right: buildSearchNode(tokens.slice(andIdx + 1), depth + 1)
+	};
+	const termTokens = tokens.filter((t) => t.type === "TERM");
+	if (termTokens.length > 1) {
+		let left = termToNode(termTokens[0]);
+		for (let i = 1; i < termTokens.length; i++) {
+			const right = termToNode(termTokens[i]);
+			if (depth + i > MAX_SEARCH_DEPTH) throw new ODataParseError(`$search expression exceeds maximum depth of ${MAX_SEARCH_DEPTH}`, 0);
+			left = {
+				kind: "SearchBinary",
+				operator: "AND",
+				left,
+				right
+			};
+		}
+		return left;
+	}
+	if (tokens.length === 1 && tokens[0].type === "TERM") return termToNode(tokens[0]);
+	throw new ODataParseError(`Unexpected token sequence in $search expression`, 0);
+}
+function termToNode(token) {
+	return token.negated ? {
+		kind: "SearchTerm",
+		value: token.value,
+		negated: true
+	} : {
+		kind: "SearchTerm",
+		value: token.value
+	};
+}
+/**
+* Find the index of the last top-level occurrence of the given operator type.
+* Returns -1 if not found.
+* "Top-level" means outside of any grouping (search doesn't use parens, so all are top-level).
+*/
+function findTopLevelOperator(tokens, opType) {
+	let lastIdx = -1;
+	for (let i = 0; i < tokens.length; i++) if (tokens[i].type === opType) lastIdx = i;
+	return lastIdx;
+}
+/**
+* Parse an OData $search query string into a SearchNode AST.
+*
+* @param input - The raw $search query string value (without the $search= prefix)
+* @throws ODataParseError if the input is empty, malformed, or exceeds MAX_SEARCH_DEPTH
+*/
+function parseSearch(input) {
+	const trimmed = input.trim();
+	if (!trimmed) throw new ODataParseError("Empty $search expression — at least one search term is required", 0);
+	const tokens = tokenizeSearch(trimmed);
+	if (tokens.length === 0) throw new ODataParseError("Empty $search expression — at least one search term is required", 0);
+	const operatorCount = tokens.filter((t) => t.type === "AND" || t.type === "OR").length;
+	const termCount = tokens.filter((t) => t.type === "TERM").length;
+	const explicitOps = operatorCount;
+	if (explicitOps + (explicitOps === 0 && termCount > 1 ? termCount - 1 : 0) >= MAX_SEARCH_DEPTH) throw new ODataParseError(`$search expression exceeds maximum depth of ${MAX_SEARCH_DEPTH} — expression too complex`, 0);
+	return buildSearchNode(tokens, 0);
+}
+//#endregion
+//#region src/parser/apply-parser.ts
+/** Regex for valid SQL-safe identifiers (prevents SQL injection via aliases). */
+const ALIAS_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Split a $apply string on '/' characters that are at parenthesis depth 0.
+* This correctly handles filter(a/b gt 0) without splitting inside the parens.
+*/
+function splitApplyPipeline(value) {
+	const steps = [];
+	let depth = 0;
+	let current = "";
+	for (let i = 0; i < value.length; i++) {
+		const ch = value[i];
+		if (ch === "(") {
+			depth++;
+			current += ch;
+		} else if (ch === ")") {
+			depth--;
+			current += ch;
+		} else if (ch === "/" && depth === 0) {
+			steps.push(current.trim());
+			current = "";
+		} else current += ch;
+	}
+	if (current.trim()) steps.push(current.trim());
+	return steps;
+}
+/**
+* Parse a comma-separated list of aggregate expressions.
+* Handles both:
+*   - `property with method as alias`
+*   - `$count as alias` (shorthand for count of records)
+*/
+function parseAggregateExpressions(inner) {
+	return splitTopLevelCommas(inner).map((part) => parseOneAggregateExpression(part.trim()));
+}
+function parseOneAggregateExpression(expr) {
+	const countMatch = /^\$count\s+as\s+(\S+)$/.exec(expr);
+	if (countMatch) {
+		const alias = countMatch[1];
+		validateAlias(alias);
+		return {
+			property: "$count",
+			method: "count",
+			alias
+		};
+	}
+	const withMatch = /^(\S+)\s+with\s+(\w+)\s+as\s+(\S+)$/.exec(expr);
+	if (withMatch) {
+		const [, property, methodRaw, alias] = withMatch;
+		const method = methodRaw.toLowerCase();
+		if (!isValidMethod(method)) throw new ODataParseError(`Unknown aggregate method '${method}'. Valid methods: sum, count, avg, min, max, countdistinct`, 0);
+		validateAlias(alias);
+		return {
+			property,
+			method,
+			alias
+		};
+	}
+	throw new ODataParseError(`Invalid aggregate expression '${expr}'. Expected 'property with method as alias' or '$count as alias'`, 0);
+}
+function isValidMethod(method) {
+	return [
+		"sum",
+		"count",
+		"avg",
+		"min",
+		"max",
+		"countdistinct"
+	].includes(method);
+}
+function validateAlias(alias) {
+	if (!ALIAS_REGEX.test(alias)) throw new ODataParseError(`Invalid aggregate alias '${alias}'. Aliases must match /^[A-Za-z_][A-Za-z0-9_]*$/ to prevent SQL injection`, 0);
+}
+function parseFilterStep(inner) {
+	return {
+		kind: "ApplyFilter",
+		filter: parseFilter(inner)
+	};
+}
+function parseAggregateStep(inner) {
+	return {
+		kind: "ApplyAggregate",
+		expressions: parseAggregateExpressions(inner)
+	};
+}
+function parseGroupByStep(inner) {
+	if (!inner.startsWith("(")) throw new ODataParseError(`Invalid groupby() syntax: expected '(' to start property list, got '${inner[0]}'`, 0);
+	let depth = 0;
+	let propEnd = -1;
+	for (let i = 0; i < inner.length; i++) if (inner[i] === "(") depth++;
+	else if (inner[i] === ")") {
+		depth--;
+		if (depth === 0) {
+			propEnd = i;
+			break;
+		}
+	}
+	if (propEnd === -1) throw new ODataParseError("Unclosed parenthesis in groupby() property list", 0);
+	const properties = inner.slice(1, propEnd).split(",").map((p) => p.trim()).filter(Boolean);
+	const rest = inner.slice(propEnd + 1).trim();
+	let aggregate;
+	if (rest.startsWith(",aggregate(")) aggregate = parseAggregateExpressions(rest.slice(11, rest.length - 1));
+	else if (rest.startsWith(",")) throw new ODataParseError(`Unexpected content after groupby() property list: '${rest}'`, 0);
+	return {
+		kind: "ApplyGroupBy",
+		properties,
+		aggregate
+	};
+}
+/**
+* Split a string on ',' characters at parenthesis depth 0.
+* Reusable utility — same algorithm as pipeline splitter but for commas.
+*/
+function splitTopLevelCommas(value) {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (let i = 0; i < value.length; i++) {
+		const ch = value[i];
+		if (ch === "(") {
+			depth++;
+			current += ch;
+		} else if (ch === ")") {
+			depth--;
+			current += ch;
+		} else if (ch === "," && depth === 0) {
+			parts.push(current.trim());
+			current = "";
+		} else current += ch;
+	}
+	if (current.trim()) parts.push(current.trim());
+	return parts;
+}
+/**
+* Parse an OData $apply transformation pipeline into an ApplyNode AST.
+*
+* Steps are separated by '/' at depth 0. Each step is one of:
+*   - filter(...)
+*   - aggregate(...)
+*   - groupby((...),aggregate(...))
+*
+* @param input - The raw $apply query string value (without the $apply= prefix)
+* @throws ODataParseError for empty input, unrecognized steps, invalid aliases,
+*         or post-groupby filter steps (HAVING not supported)
+*/
+function parseApply(input) {
+	const trimmed = input.trim();
+	if (!trimmed) throw new ODataParseError("Empty $apply expression — at least one transformation step is required", 0);
+	const stepStrings = splitApplyPipeline(trimmed);
+	const steps = [];
+	let seenAggregation = false;
+	for (const stepStr of stepStrings) if (stepStr.startsWith("filter(") && stepStr.endsWith(")")) {
+		if (seenAggregation) throw new ODataParseError("Post-groupby filter (HAVING) is not supported in this version. Place filter() steps before groupby()", 0);
+		const inner = stepStr.slice(7, stepStr.length - 1);
+		steps.push(parseFilterStep(inner));
+	} else if (stepStr.startsWith("aggregate(") && stepStr.endsWith(")")) {
+		seenAggregation = true;
+		const inner = stepStr.slice(10, stepStr.length - 1);
+		steps.push(parseAggregateStep(inner));
+	} else if (stepStr.startsWith("groupby(") && stepStr.endsWith(")")) {
+		seenAggregation = true;
+		const inner = stepStr.slice(8, stepStr.length - 1);
+		steps.push(parseGroupByStep(inner));
+	} else {
+		const nameMatch = /^(\w+)\(/.exec(stepStr);
+		throw new ODataParseError(`Unrecognized $apply transformation step '${nameMatch ? nameMatch[1] : stepStr}'. Supported steps: filter, aggregate, groupby`, 0);
+	}
+	return { steps };
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.122.0/helpers/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/edm/edm-registry.ts
+let EdmRegistry = class EdmRegistry {
+	entityTypes = /* @__PURE__ */ new Map();
+	entitySets = /* @__PURE__ */ new Map();
+	/** Per-entity security option overrides keyed by entitySetName (per D-07) */
+	entitySecurityOptions = /* @__PURE__ */ new Map();
+	/**
+	* Register an entity type and its corresponding entity set.
+	*
+	* Idempotent: if the same entity type name is already registered (e.g. from multiple
+	* ODataTypeOrmModule.forFeature() calls in different feature modules), the registration
+	* is silently skipped. This supports the common pattern of importing forFeature() in
+	* both a root AppModule and a feature module for the same entity.
+	*
+	* Throws only if a DIFFERENT entity type is registered under the same name (name collision).
+	*/
+	register(entityType, entitySet) {
+		if (this.entityTypes.has(entityType.name)) return;
+		this.entityTypes.set(entityType.name, entityType);
+		this.entitySets.set(entitySet.name, entitySet);
+	}
+	/** Retrieve a registered entity type by name. Returns undefined if not found. */
+	getEntityType(name) {
+		return this.entityTypes.get(name);
+	}
+	/** Retrieve a registered entity set by name. Returns undefined if not found. */
+	getEntitySet(name) {
+		return this.entitySets.get(name);
+	}
+	/** All registered entity types as a read-only map. */
+	getEntityTypes() {
+		return this.entityTypes;
+	}
+	/** All registered entity sets as a read-only map. */
+	getEntitySets() {
+		return this.entitySets;
+	}
+	/**
+	* Store per-entity security option overrides for a given entity set name.
+	* These override global ODataModuleResolvedOptions values (per D-07).
+	*/
+	setEntitySecurityOptions(entitySetName, options) {
+		this.entitySecurityOptions.set(entitySetName, options);
+	}
+	/**
+	* Retrieve per-entity security options for a given entity set name.
+	* Returns undefined if no overrides have been set.
+	*/
+	getEntitySecurityOptions(entitySetName) {
+		return this.entitySecurityOptions.get(entitySetName);
+	}
+};
+EdmRegistry = __decorate([Injectable()], EdmRegistry);
+//#endregion
+//#region src/edm/pluralize.ts
+/**
+* Pluralize an entity class name to produce an EntitySet name.
+* Uses the `pluralize` library which handles irregular forms (Person → People,
+* Category → Categories, Index → Indices, etc.).
+*
+* @param name - Entity class name in PascalCase (e.g., 'Product', 'OrderItem')
+* @returns Pluralized entity set name (e.g., 'Products', 'OrderItems')
+*/
+function pluralizeEntityName(name) {
+	return pluralize(name);
+}
+//#endregion
+//#region src/interfaces/edm-deriver.interface.ts
+/** NestJS injection token for IEdmDeriver */
+const EDM_DERIVER = Symbol("EDM_DERIVER");
+//#endregion
+//#region src/interfaces/query-translator.interface.ts
+/** NestJS injection token for IQueryTranslator */
+const QUERY_TRANSLATOR = Symbol("QUERY_TRANSLATOR");
+//#endregion
+//#region src/interfaces/etag.interface.ts
+/**
+* Injection token for IETagProvider.
+* Use this token when registering or injecting the ETag provider via NestJS DI.
+*/
+const ETAG_PROVIDER = Symbol("ETAG_PROVIDER");
+//#endregion
+//#region src/interfaces/search.interface.ts
+/**
+* Injection token for ISearchProvider.
+* Use this token when registering or injecting the search provider via NestJS DI.
+*/
+const SEARCH_PROVIDER = Symbol("SEARCH_PROVIDER");
+//#endregion
+//#region src/tokens.ts
+/**
+* DI injection token for the array of EdmEntityConfig objects
+* registered via ODataModule.forFeature().
+*/
+const EDM_ENTITY_CONFIGS = Symbol("EDM_ENTITY_CONFIGS");
+/**
+* DI injection token for the fully-resolved ODataModuleOptions (with defaults applied).
+* Defined here (not in odata.module.ts) to avoid circular imports with metadata builders.
+*/
+const ODATA_MODULE_OPTIONS = Symbol("ODATA_MODULE_OPTIONS");
+//#endregion
+//#region \0@oxc-project+runtime@0.122.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.122.0/helpers/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region src/query/odata-query.pipe.ts
+var _ref$5;
+let ODataQueryPipe = class ODataQueryPipe {
+	constructor(edmRegistry, options) {
+		this.edmRegistry = edmRegistry;
+		this.options = options;
+	}
+	transform(value, metadata) {
+		const entitySetName = metadata.data ?? "";
+		const parts = [];
+		let count = false;
+		let search;
+		let apply;
+		for (const [key, val] of Object.entries(value)) {
+			const lkey = key.toLowerCase();
+			if (lkey === "$count") count = val === "true";
+			else if (lkey === "$search") search = parseSearch(decodeURIComponent(val));
+			else if (lkey === "$apply") apply = parseApply(decodeURIComponent(val));
+			else parts.push(`${key}=${val}`);
+		}
+		const parsed = parseQuery(parts.join("&"));
+		const effectiveMaxTop = this.edmRegistry.getEntitySecurityOptions(entitySetName)?.maxTop ?? this.options.maxTop;
+		const top = parsed.top;
+		if (top !== void 0 && top > effectiveMaxTop) throw new ODataValidationError(`$top value ${top} exceeds maximum of ${effectiveMaxTop}`, entitySetName, "$top");
+		if (entitySetName) {
+			const entitySet = this.edmRegistry.getEntitySet(entitySetName);
+			if (entitySet) {
+				const entityType = this.edmRegistry.getEntityType(entitySet.entityTypeName);
+				if (entityType) {
+					if (parsed.filter) this.validateFilterNode(parsed.filter, entityType);
+					if (parsed.select?.items) for (const item of parsed.select.items) this.validateSelectItem(item, entityType);
+					if (parsed.orderBy) for (const orderItem of parsed.orderBy) this.validateFilterNode(orderItem.expression, entityType);
+					if (parsed.expand?.items) this.validateExpandNode(parsed.expand, entityType);
+				}
+			}
+		}
+		return {
+			filter: parsed.filter,
+			select: parsed.select,
+			orderBy: parsed.orderBy,
+			top,
+			skip: parsed.skip,
+			count: count || void 0,
+			entitySetName,
+			expand: parsed.expand,
+			search,
+			apply
+		};
+	}
+	/**
+	* Recursively walk a FilterNode tree and throw ODataValidationError for any
+	* PropertyAccessNode whose path[0] is not in entityType.properties.
+	*
+	* Per D-10: validates property references before any DB query is constructed.
+	* Per T-03-01: unknown properties throw ODataValidationError (not a generic error).
+	*/
+	validateFilterNode(node, entityType) {
+		switch (node.kind) {
+			case "PropertyAccess": {
+				const propertyName = node.path[0];
+				if (!propertyName) break;
+				const knownNames = entityType.properties.map((p) => p.name);
+				if (!knownNames.includes(propertyName)) throw new ODataValidationError(`Property '${propertyName}' not found on entity '${entityType.name}'`, entityType.name, propertyName, knownNames);
+				break;
+			}
+			case "BinaryExpr":
+				this.validateFilterNode(node.left, entityType);
+				this.validateFilterNode(node.right, entityType);
+				break;
+			case "UnaryExpr":
+				this.validateFilterNode(node.operand, entityType);
+				break;
+			case "FunctionCall":
+				for (const arg of node.args) this.validateFilterNode(arg, entityType);
+				break;
+			case "LambdaExpr":
+				if (node.predicate) this.validateFilterNode(node.predicate, entityType);
+				break;
+			case "Literal": break;
+		}
+	}
+	/**
+	* Validate $expand navigation property names against the entity type's navigationProperties.
+	* Validates top-level navigation properties only — nested expand validation is handled
+	* by TypeOrmExpandVisitor at translation time with full EDM registry access.
+	*
+	* Per T-04-09: prevents users from expanding properties not declared as navigation properties.
+	* Per D-10: validates property references before any DB query is constructed.
+	*/
+	validateExpandNode(expandNode, entityType) {
+		for (const item of expandNode.items) {
+			const navNames = entityType.navigationProperties.map((np) => np.name);
+			if (!navNames.includes(item.navigationProperty)) throw new ODataValidationError(`Navigation property '${item.navigationProperty}' not found on entity '${entityType.name}'`, entityType.name, item.navigationProperty, navNames);
+		}
+	}
+	/**
+	* Validate a $select item path[0] against entityType.properties.
+	* Throws ODataValidationError for unknown property names.
+	*/
+	validateSelectItem(item, entityType) {
+		const propertyName = item.path[0];
+		if (!propertyName) return;
+		const knownNames = entityType.properties.map((p) => p.name);
+		if (!knownNames.includes(propertyName)) throw new ODataValidationError(`Property '${propertyName}' not found on entity '${entityType.name}'`, entityType.name, propertyName, knownNames);
+	}
+};
+ODataQueryPipe = __decorate([
+	Injectable(),
+	__decorateParam(1, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof (_ref$5 = typeof EdmRegistry !== "undefined" && EdmRegistry) === "function" ? _ref$5 : Object, Object])
+], ODataQueryPipe);
+//#endregion
+//#region src/decorators/metadata-keys.ts
+/** Metadata key for @EdmType() property decorator — stores EdmTypeOptions per property */
+const EDM_TYPE_KEY = Symbol("nestjs-odata:edm-type");
+/** Metadata key for @ODataExclude() property decorator — stores Set<string> of excluded property names */
+const ODATA_EXCLUDE_KEY = Symbol("nestjs-odata:odata-exclude");
+/** Metadata key for @ODataEntitySet() class decorator — stores the entity set name string */
+const ODATA_ENTITY_SET_KEY = Symbol("nestjs-odata:entity-set");
+/** Metadata key for @ODataKey() property decorator — stores string[] of key property names */
+const ODATA_KEY_KEY = Symbol("nestjs-odata:odata-key");
+/** Metadata key for @ODataView() class decorator — stores ODataViewOptions */
+const ODATA_VIEW_KEY = Symbol("nestjs-odata:odata-view");
+/** Metadata key for @ODataGet() method decorator — marks a route as an OData route */
+const ODATA_ROUTE_KEY = Symbol("ODATA_ROUTE");
+/** Metadata key for @ODataController() class decorator — stores the entity set name string */
+const ODATA_CONTROLLER_KEY = Symbol("nestjs-odata:odata-controller");
+/** Metadata key for @ODataETag() property decorator — stores the ETag source property name */
+const ODATA_ETAG_KEY = Symbol("nestjs-odata:odata-etag");
+/** Metadata key for @ODataSearchable() property decorator — stores string[] of searchable property names */
+const ODATA_SEARCHABLE_KEY = Symbol("nestjs-odata:odata-searchable");
+//#endregion
+//#region src/decorators/odata-etag.decorator.ts
+/**
+* Marks a property as the ETag source for concurrency control.
+* Per D-03: opt-in per entity. Only entities with @ODataETag or @UpdateDateColumn get ETags.
+*
+* Usage:
+*   class Product {
+*     @ODataETag()
+*     version: number
+*   }
+*/
+function ODataETag() {
+	return (target, propertyKey) => {
+		Reflect.defineMetadata(ODATA_ETAG_KEY, String(propertyKey), target.constructor);
+	};
+}
+/**
+* Get the ETag property name for a given entity class.
+* Returns undefined if the entity does not have @ODataETag.
+*/
+function getETagProperty(target) {
+	return Reflect.getMetadata(ODATA_ETAG_KEY, target);
+}
+//#endregion
+//#region src/decorators/odata-searchable.decorator.ts
+/**
+* Marks a property as searchable via OData $search.
+* Multiple properties on the same entity can be decorated — all are stored.
+*
+* Usage:
+*   class Product {
+*     @ODataSearchable()
+*     name: string
+*
+*     @ODataSearchable()
+*     description: string
+*   }
+*/
+function ODataSearchable() {
+	return (target, propertyKey) => {
+		const ctor = target.constructor;
+		const existing = Reflect.getMetadata(ODATA_SEARCHABLE_KEY, ctor) ?? [];
+		Reflect.defineMetadata(ODATA_SEARCHABLE_KEY, [...existing, String(propertyKey)], ctor);
+	};
+}
+/**
+* Get the list of searchable property names for a given entity class.
+* Returns an empty array if no properties are decorated with @ODataSearchable().
+*/
+function getSearchableProperties(target) {
+	return Reflect.getMetadata(ODATA_SEARCHABLE_KEY, target) ?? [];
+}
+//#endregion
+//#region src/decorators/edm-type.decorator.ts
+/**
+* @EdmType() — override the EDM primitive type for a property.
+* Use when the TypeScript type cannot be automatically mapped, or when
+* precision/scale/maxLength constraints are needed (e.g., Edm.Decimal).
+*
+* Zero imports from typeorm, @nestjs/common, or any ORM. Pure reflect-metadata.
+*/
+function EdmType(options) {
+	return (target, propertyKey) => {
+		const constructor = target.constructor;
+		const existing = Reflect.getMetadata(EDM_TYPE_KEY, constructor) ?? {};
+		Reflect.defineMetadata(EDM_TYPE_KEY, {
+			...existing,
+			[propertyKey]: options
+		}, constructor);
+	};
+}
+/** Read all @EdmType overrides registered on a class */
+function getEdmTypeOverrides(target) {
+	return Reflect.getMetadata(EDM_TYPE_KEY, target) ?? {};
+}
+//#endregion
+//#region src/decorators/odata-exclude.decorator.ts
+/**
+* @ODataExclude() — marks a property to be excluded from the OData EDM.
+* The property will not appear in $metadata and will be stripped from responses.
+*
+* Zero imports from typeorm, @nestjs/common, or any ORM. Pure reflect-metadata.
+*/
+function ODataExclude() {
+	return (target, propertyKey) => {
+		const constructor = target.constructor;
+		const existing = Reflect.getMetadata(ODATA_EXCLUDE_KEY, constructor) ?? /* @__PURE__ */ new Set();
+		const updated = new Set(existing);
+		updated.add(propertyKey);
+		Reflect.defineMetadata(ODATA_EXCLUDE_KEY, updated, constructor);
+	};
+}
+/** Read all property names excluded via @ODataExclude() on a class */
+function getExcludedProperties(target) {
+	const meta = Reflect.getMetadata(ODATA_EXCLUDE_KEY, target);
+	if (!meta) return /* @__PURE__ */ new Set();
+	const result = /* @__PURE__ */ new Set();
+	for (const key of meta) if (typeof key === "string") result.add(key);
+	return result;
+}
+//#endregion
+//#region src/decorators/odata-entity-set.decorator.ts
+/**
+* @ODataEntitySet(name) — override the entity set name for an entity class.
+* Without this decorator, the adapter will auto-pluralize the class name.
+*
+* Zero imports from typeorm, @nestjs/common, or any ORM. Pure reflect-metadata.
+*/
+function ODataEntitySet(name) {
+	return (target) => {
+		Reflect.defineMetadata(ODATA_ENTITY_SET_KEY, name, target);
+	};
+}
+/** Read the entity set name set via @ODataEntitySet(), or undefined if not set */
+function getEntitySetName(target) {
+	return Reflect.getMetadata(ODATA_ENTITY_SET_KEY, target);
+}
+//#endregion
+//#region src/decorators/odata-key.decorator.ts
+/**
+* @ODataKey() — marks a property as part of the entity key.
+* Can be applied to multiple properties for composite keys.
+*
+* Zero imports from typeorm, @nestjs/common, or any ORM. Pure reflect-metadata.
+*/
+function ODataKey() {
+	return (target, propertyKey) => {
+		const constructor = target.constructor;
+		const existing = Reflect.getMetadata(ODATA_KEY_KEY, constructor) ?? [];
+		if (typeof propertyKey === "string") Reflect.defineMetadata(ODATA_KEY_KEY, [...existing, propertyKey], constructor);
+	};
+}
+/** Read all key property names registered via @ODataKey() on a class */
+function getKeyProperties(target) {
+	return Reflect.getMetadata(ODATA_KEY_KEY, target) ?? [];
+}
+//#endregion
+//#region src/decorators/odata-view.decorator.ts
+/**
+* @ODataView() — marks a class as a virtual OData view.
+* A virtual view projects a subset of an existing entity type's properties
+* as its own EntitySet without duplicating entity registration. Per D-22, D-23.
+*
+* Zero imports from typeorm, @nestjs/common, or any ORM. Pure reflect-metadata.
+*/
+function ODataView(options) {
+	return (target) => {
+		Reflect.defineMetadata(ODATA_VIEW_KEY, options, target);
+	};
+}
+/** Read the ODataView options from a class, or undefined if not decorated */
+function getODataViewOptions(target) {
+	return Reflect.getMetadata(ODATA_VIEW_KEY, target);
+}
+//#endregion
+//#region src/response/odata-context-url.builder.ts
+/**
+* Builds the OData v4 @odata.context URL per spec section 10.
+*
+* Format: {serviceRoot}/$metadata#{entitySetName}[(field1,field2,...)]
+* Single-entity format: {serviceRoot}/$metadata#{entitySetName}/$entity
+*
+* Per D-07: when $select has specific items (not all, not undefined),
+* a select projection suffix is appended.
+* Per D-05: when isSingleEntity is true, /$entity suffix is appended.
+*
+* @param serviceRoot - The OData service root path (e.g. '/odata')
+* @param entitySetName - The name of the entity set (e.g. 'Products')
+* @param select - Optional SelectNode from the parsed query
+* @param isSingleEntity - When true, appends /$entity suffix for single-entity responses
+*/
+function buildContextUrl(serviceRoot, entitySetName, select, isSingleEntity) {
+	const base = `${serviceRoot.endsWith("/") ? serviceRoot.slice(0, -1) : serviceRoot}/$metadata#${entitySetName}`;
+	if (isSingleEntity) return `${base}/$entity`;
+	if (select?.items?.length) return `${base}(${select.items.map((item) => item.path.join("/")).join(",")})`;
+	return base;
+}
+//#endregion
+//#region src/response/odata-annotation.builder.ts
+/**
+* Build the canonical key string for a given entity and its key properties.
+*
+* - Single key, integer value: (1)
+* - Single key, string value: ('abc')
+* - Composite key: (orderId=1,productId=2)
+*
+* @param entity - The entity object
+* @param keyProperties - The key property names from the EDM entity type
+*/
+function buildKeyString(entity, keyProperties) {
+	if (keyProperties.length === 1) {
+		const keyValue = entity[keyProperties[0]];
+		if (typeof keyValue === "string") return `('${keyValue}')`;
+		return `(${String(keyValue)})`;
+	}
+	return `(${keyProperties.map((keyName) => {
+		const keyValue = entity[keyName];
+		if (typeof keyValue === "string") return `${keyName}='${keyValue}'`;
+		return `${keyName}=${String(keyValue)}`;
+	}).join(",")})`;
+}
+/**
+* Annotate a single entity object with OData v4 metadata annotations.
+*
+* Adds:
+* - @odata.id — canonical URL for the entity (RESP-04)
+* - @odata.type — qualified type name with namespace prefix (RESP-05)
+* - {navProp}@odata.navigationLink — for each navigation property (RESP-06)
+*
+* Returns the entity unchanged if it is null, undefined, or not an object.
+*
+* This function is pure — it never mutates the input entity.
+*
+* @param entity - The entity object to annotate
+* @param ctx - The annotation context (service root, entity set name, entity type, namespace)
+*/
+function annotateEntity(entity, ctx) {
+	if (entity === null || entity === void 0 || typeof entity !== "object") return entity;
+	const { serviceRoot, entitySetName, entityType, namespace } = ctx;
+	const odataId = `${serviceRoot.endsWith("/") ? serviceRoot.slice(0, -1) : serviceRoot}/${entitySetName}${buildKeyString(entity, entityType.keyProperties)}`;
+	const odataType = `#${namespace}.${entityType.name}`;
+	const navLinks = {};
+	for (const navProp of entityType.navigationProperties) navLinks[`${navProp.name}@odata.navigationLink`] = `${odataId}/${navProp.name}`;
+	return {
+		...entity,
+		"@odata.id": odataId,
+		"@odata.type": odataType,
+		...navLinks
+	};
+}
+/**
+* Annotate an array of entity objects with OData v4 metadata annotations.
+*
+* Applies `annotateEntity` to every item in the array and returns a new array.
+* Does not mutate the input array or any items.
+*
+* @param items - The array of entity objects to annotate
+* @param ctx - The annotation context
+*/
+function annotateEntities(items, ctx) {
+	return items.map((item) => annotateEntity(item, ctx));
+}
+//#endregion
+//#region src/response/odata-response.interceptor.ts
+var _ref$4, _ref2$1;
+let ODataResponseInterceptor = class ODataResponseInterceptor {
+	constructor(reflector, options, edmRegistry) {
+		this.reflector = reflector;
+		this.options = options;
+		this.edmRegistry = edmRegistry;
+	}
+	/**
+	* Resolve the AnnotationContext for an entity set name.
+	* Returns null when the entity set or its type is not registered (graceful degradation).
+	*/
+	resolveAnnotationContext(entitySetName) {
+		const entitySet = this.edmRegistry.getEntitySet(entitySetName);
+		if (!entitySet) return null;
+		const entityType = this.edmRegistry.getEntityType(entitySet.entityTypeName);
+		if (!entityType) return null;
+		return {
+			serviceRoot: this.options.serviceRoot,
+			entitySetName,
+			entityType,
+			namespace: this.options.namespace
+		};
+	}
+	intercept(context, next) {
+		const metadata = this.reflector.get(ODATA_ROUTE_KEY, context.getHandler());
+		if (!metadata) return next.handle();
+		const { entitySetName, operation, isSingleEntity } = metadata;
+		return next.handle().pipe(map((result) => {
+			if (operation === "create" && result !== null && typeof result === "object") {
+				const createResult = result;
+				if (createResult.locationUrl) context.switchToHttp().getResponse().setHeader("Location", createResult.locationUrl);
+				const entity = createResult.entity ?? result;
+				const contextUrl = buildContextUrl(this.options.serviceRoot, entitySetName, void 0, true);
+				const annotationCtx = this.resolveAnnotationContext(entitySetName);
+				const annotatedEntity = annotationCtx ? annotateEntity(entity, annotationCtx) : entity;
+				return {
+					"@odata.context": contextUrl,
+					...annotatedEntity
+				};
+			}
+			if (isSingleEntity) {
+				const entityResult = result;
+				if (entityResult["__notModified"] === true) {
+					const etag = entityResult["etag"];
+					const httpResponse = context.switchToHttp().getResponse();
+					httpResponse.setHeader("ETag", etag);
+					httpResponse.status(304).end();
+					return null;
+				}
+				const contextUrl = buildContextUrl(this.options.serviceRoot, entitySetName, void 0, true);
+				const annotationCtx = this.resolveAnnotationContext(entitySetName);
+				let entityToAnnotate = entityResult;
+				if (entityResult["__etag"]) {
+					const etag = entityResult["__etag"];
+					context.switchToHttp().getResponse().setHeader("ETag", etag);
+					const rest = {};
+					for (const key of Object.keys(entityResult)) if (key !== "__etag") rest[key] = entityResult[key];
+					entityToAnnotate = {
+						"@odata.etag": etag,
+						...rest
+					};
+				}
+				const annotatedEntity = annotationCtx ? annotateEntity(entityToAnnotate, annotationCtx) : entityToAnnotate;
+				return {
+					"@odata.context": contextUrl,
+					...annotatedEntity
+				};
+			}
+			const queryResult = result;
+			if (queryResult.isAggregated) {
+				const projectedSelect = queryResult.applyProperties?.length ? { items: queryResult.applyProperties.map((p) => ({ path: [p] })) } : void 0;
+				const aggContextUrl = buildContextUrl(this.options.serviceRoot, entitySetName, projectedSelect);
+				const aggResponse = {
+					"@odata.context": aggContextUrl,
+					value: queryResult.items
+				};
+				if (queryResult.count !== void 0) aggResponse["@odata.count"] = queryResult.count;
+				return aggResponse;
+			}
+			const contextUrl = buildContextUrl(this.options.serviceRoot, entitySetName, queryResult.select);
+			const annotationCtx = this.resolveAnnotationContext(entitySetName);
+			const items = annotationCtx ? annotateEntities(queryResult.items, annotationCtx) : queryResult.items;
+			const response = {
+				"@odata.context": contextUrl,
+				value: items
+			};
+			if (queryResult.count !== void 0) response["@odata.count"] = queryResult.count;
+			if (queryResult.nextLink !== void 0) response["@odata.nextLink"] = queryResult.nextLink;
+			return response;
+		}));
+	}
+};
+ODataResponseInterceptor = __decorate([
+	Injectable(),
+	__decorateParam(1, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [
+		typeof (_ref$4 = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref$4 : Object,
+		Object,
+		typeof (_ref2$1 = typeof EdmRegistry !== "undefined" && EdmRegistry) === "function" ? _ref2$1 : Object
+	])
+], ODataResponseInterceptor);
+//#endregion
+//#region src/response/odata-exception.filter.ts
+let ODataExceptionFilter = class ODataExceptionFilter {
+	catch(exception, host) {
+		const response = host.switchToHttp().getResponse();
+		let status;
+		let body;
+		if (exception instanceof ODataParseError) {
+			status = HttpStatus.BAD_REQUEST;
+			const details = exception.queryContext ? [{ target: exception.queryContext }] : [];
+			body = { error: {
+				code: "BadRequest",
+				message: exception.message,
+				details
+			} };
+		} else if (exception instanceof ODataValidationError) {
+			status = HttpStatus.BAD_REQUEST;
+			const details = exception.availableProperties && exception.availableProperties.length > 0 ? [{
+				target: "availableProperties",
+				value: [...exception.availableProperties]
+			}] : [];
+			body = { error: {
+				code: "BadRequest",
+				message: exception.message,
+				details
+			} };
+		} else if (exception instanceof HttpException) {
+			status = exception.getStatus();
+			body = { error: {
+				code: httpStatusToODataCode(status),
+				message: exception.message,
+				details: []
+			} };
+		} else {
+			status = HttpStatus.INTERNAL_SERVER_ERROR;
+			body = { error: {
+				code: "InternalServerError",
+				message: "An unexpected error occurred.",
+				details: []
+			} };
+		}
+		response.status(status).json(body);
+	}
+};
+ODataExceptionFilter = __decorate([Catch()], ODataExceptionFilter);
+/**
+* Map HTTP status code to an OData error code string.
+* Only covers the most common HTTP status codes.
+*/
+function httpStatusToODataCode(status) {
+	return {
+		400: "BadRequest",
+		401: "Unauthorized",
+		403: "Forbidden",
+		404: "NotFound",
+		405: "MethodNotAllowed",
+		409: "Conflict",
+		410: "Gone",
+		422: "UnprocessableEntity",
+		429: "TooManyRequests",
+		500: "InternalServerError",
+		501: "NotImplemented",
+		503: "ServiceUnavailable"
+	}[status] ?? "Error";
+}
+//#endregion
+//#region src/decorators/odata-get.decorator.ts
+/**
+* Composite method decorator for OData GET endpoints.
+*
+* Composes:
+*   1. Get(path) — NestJS route decorator
+*   2. SetMetadata(ODATA_ROUTE_KEY, { entitySetName }) — marks the route as OData
+*   3. UseInterceptors(ODataResponseInterceptor) — wraps result in OData JSON envelope
+*   4. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* @param entitySetName - The OData entity set name (e.g. 'Products'). Used to build
+*   the @odata.context URL and for response formatting.
+* @param options - Optional configuration
+*
+* Per D-12, D-13, RESEARCH.md Pattern 5.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataGet(entitySetName, options) {
+	return applyDecorators(Get(options?.path ?? entitySetName), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		autoHandler: options?.autoHandler ?? false
+	}), UseInterceptors(ODataResponseInterceptor), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-query.decorator.ts
+/**
+* Internal param decorator that extracts req.query from the HTTP execution context.
+* Not exported — consumers use the ODataQueryParam wrapper which auto-attaches ODataQueryPipe.
+*/
+const RawQuery = createParamDecorator((_data, ctx) => {
+	return ctx.switchToHttp().getRequest().query;
+});
+/**
+* Parameter decorator that extracts req.query and auto-applies ODataQueryPipe.
+*
+* Usage:
+*   @Get()
+*   async getProducts(@ODataQueryParam('Products') query: ODataQuery) { ... }
+*
+* The decorator passes the entitySetName as `data` so that the ODataQueryPipe
+* can inject it into the query object for context URL construction and field validation.
+*
+* Per D-04: auto-applies ODataQueryPipe — no @UsePipes(ODataQueryPipe) needed.
+* Per D-05: ODataQueryPipe remains exported for advanced use cases.
+* Per D-06: eliminates silent validation bypass when forgetting @UsePipes.
+*
+* NestJS resolves ODataQueryPipe from DI automatically when a class reference
+* is passed as the pipe argument to a createParamDecorator result.
+*
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+const ODataQueryParam = (entitySetName) => RawQuery(entitySetName, ODataQueryPipe);
+//#endregion
+//#region src/decorators/odata-post.decorator.ts
+/**
+* Composite method decorator for OData POST (create) endpoints.
+*
+* Composes:
+*   1. Post(path) — NestJS route decorator
+*   2. HttpCode(201) — POST returns 201 Created per D-03
+*   3. SetMetadata(ODATA_ROUTE_KEY, { entitySetName, operation: 'create' })
+*   4. UseInterceptors(ODataResponseInterceptor) — wraps result in OData JSON envelope
+*   5. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* Per D-03: POST returns 201. Per D-12: explicit opt-in per operation.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataPost(entitySetName, options) {
+	return applyDecorators(Post(options?.path ?? ""), HttpCode(201), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		operation: "create"
+	}), UseInterceptors(ODataResponseInterceptor), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-patch.decorator.ts
+/**
+* Composite method decorator for OData PATCH (update) endpoints.
+*
+* Composes:
+*   1. Patch(path) — NestJS route decorator, defaults to ':key'
+*   2. SetMetadata(ODATA_ROUTE_KEY, { entitySetName, operation: 'update', isSingleEntity: true })
+*   3. UseInterceptors(ODataResponseInterceptor) — wraps result in single-entity OData envelope
+*   4. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* Per D-01: merge-patch semantics. Per D-02: parenthetical key via ':key' param.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataPatch(entitySetName, options) {
+	return applyDecorators(Patch(options?.path ?? ":key"), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		operation: "update",
+		isSingleEntity: true
+	}), UseInterceptors(ODataResponseInterceptor), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-put.decorator.ts
+/**
+* Composite method decorator for OData PUT (full entity replacement) endpoints.
+*
+* Composes:
+*   1. Put(path) — NestJS route decorator, defaults to ':key'
+*   2. SetMetadata(ODATA_ROUTE_KEY, { entitySetName, operation: 'replace', isSingleEntity: true })
+*   3. UseInterceptors(ODataResponseInterceptor) — wraps result in single-entity OData envelope
+*   4. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* Per D-01: PUT semantics — full entity replacement. All unspecified fields reset to
+* column defaults (null for nullable, default value for columns with defaults).
+* Per D-02: parenthetical key via ':key' param.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataPut(entitySetName, options) {
+	return applyDecorators(Put(options?.path ?? ":key"), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		operation: "replace",
+		isSingleEntity: true
+	}), UseInterceptors(ODataResponseInterceptor), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-delete.decorator.ts
+/**
+* Composite method decorator for OData DELETE endpoints.
+*
+* Composes:
+*   1. Delete(path) — NestJS route decorator, defaults to ':key'
+*   2. HttpCode(204) — DELETE returns 204 No Content per D-04
+*   3. SetMetadata(ODATA_ROUTE_KEY, { entitySetName, operation: 'delete' })
+*   4. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* Per D-04: DELETE returns 204 with no body. No ODataResponseInterceptor — no body.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataDelete(entitySetName, options) {
+	return applyDecorators(Delete(options?.path ?? ":key"), HttpCode(204), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		operation: "delete"
+	}), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-get-by-key.decorator.ts
+/**
+* Composite method decorator for OData GET-by-key (single entity) endpoints.
+*
+* Composes:
+*   1. Get(path) — NestJS route decorator, defaults to ':key'
+*   2. SetMetadata(ODATA_ROUTE_KEY, { entitySetName, operation: 'getByKey', isSingleEntity: true })
+*   3. UseInterceptors(ODataResponseInterceptor) — returns entity directly (not wrapped in value array)
+*   4. UseFilters(ODataExceptionFilter) — formats errors as OData v4 error bodies
+*
+* Per D-05: Returns single entity, not wrapped in value array.
+* Context URL uses /$entity suffix for single-entity responses.
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataGetByKey(entitySetName, options) {
+	return applyDecorators(Get(options?.path ?? ":key"), SetMetadata(ODATA_ROUTE_KEY, {
+		entitySetName,
+		operation: "getByKey",
+		isSingleEntity: true
+	}), UseInterceptors(ODataResponseInterceptor), UseFilters(ODataExceptionFilter));
+}
+//#endregion
+//#region src/decorators/odata-controller.decorator.ts
+/**
+* Class decorator for OData controllers.
+*
+* Composes:
+*   1. Controller(path) — NestJS route prefix, defaults to entitySetName
+*   2. SetMetadata(ODATA_CONTROLLER_KEY, entitySetName) — marks as OData controller
+*      (used by ODataModule.forRoot() to patch PATH_METADATA with serviceRoot)
+*
+* Per D-11: Separate from @Controller() — sets entity context and route prefix.
+* Per D-17: The service root prefix is applied by ODataModule.forRoot({ controllers })
+*   via Reflect.defineMetadata(PATH_METADATA) — the same pattern used by MetadataController.
+*   The controller is initially registered with just the entitySetName as path;
+*   the module prepends serviceRoot during forRoot().
+*
+* Note: ODataResponseInterceptor and ODataExceptionFilter are NOT applied at class level.
+* Each CRUD method decorator (@ODataGet, @ODataPost, @ODataPatch, @ODataDelete, @ODataGetByKey)
+* applies these per-method. This avoids double-wrapping when method and class decorators
+* are both used.
+*
+* @param entitySetName - The OData entity set name (e.g. 'Products')
+* @param options - Optional configuration
+*
+* Zero TypeORM imports — per PKG-01 architecture constraint.
+*/
+function ODataController(entitySetName, options) {
+	return applyDecorators(Controller(options?.path ?? entitySetName), SetMetadata(ODATA_CONTROLLER_KEY, entitySetName));
+}
+//#endregion
+//#region src/edm/edm-feature-initializer.ts
+var _ref$3;
+let EdmFeatureInitializer = class EdmFeatureInitializer {
+	constructor(edmRegistry, options, entityConfigs) {
+		this.edmRegistry = edmRegistry;
+		this.options = options;
+		this.entityConfigs = entityConfigs;
+	}
+	onModuleInit() {
+		const namespace = this.options.namespace;
+		for (const config of this.entityConfigs) {
+			const entityType = {
+				name: config.entityTypeName,
+				namespace,
+				properties: config.properties,
+				navigationProperties: config.navigationProperties,
+				keyProperties: config.keyProperties,
+				isReadOnly: config.isReadOnly
+			};
+			const entitySet = {
+				name: config.entitySetName,
+				entityTypeName: config.entityTypeName,
+				namespace,
+				isReadOnly: config.isReadOnly
+			};
+			this.edmRegistry.register(entityType, entitySet);
+		}
+	}
+};
+EdmFeatureInitializer = __decorate([
+	Injectable(),
+	__decorateParam(1, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateParam(2, Inject(EDM_ENTITY_CONFIGS)),
+	__decorateMetadata("design:paramtypes", [
+		typeof (_ref$3 = typeof EdmRegistry !== "undefined" && EdmRegistry) === "function" ? _ref$3 : Object,
+		Object,
+		Array
+	])
+], EdmFeatureInitializer);
+//#endregion
+//#region src/metadata/csdl-builder.ts
+var _ref$2;
+let CsdlBuilder = class CsdlBuilder {
+	cachedXml = null;
+	constructor(edmRegistry, options) {
+		this.edmRegistry = edmRegistry;
+		this.options = options;
+	}
+	/**
+	* Build and return the CSDL XML string.
+	* Builds once on first call; returns cached string on subsequent calls.
+	*/
+	buildCsdlXml() {
+		if (this.cachedXml !== null) return this.cachedXml;
+		this.cachedXml = this.buildXml();
+		return this.cachedXml;
+	}
+	buildXml() {
+		const namespace = this.options.namespace ?? "Default";
+		const entityTypes = Array.from(this.edmRegistry.getEntityTypes().values());
+		const entitySets = Array.from(this.edmRegistry.getEntitySets().values());
+		const parts = [];
+		parts.push("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+		parts.push("<edmx:Edmx xmlns:edmx=\"http://docs.oasis-open.org/odata/ns/edmx\" Version=\"4.0\">");
+		parts.push("  <edmx:DataServices>");
+		parts.push(`    <Schema xmlns="http://docs.oasis-open.org/odata/ns/edm" Namespace="${namespace}">`);
+		for (const entityType of entityTypes) parts.push(this.buildEntityTypeXml(entityType));
+		parts.push("      <EntityContainer Name=\"Container\">");
+		for (const entitySet of entitySets) parts.push(this.buildEntitySetXml(entitySet, namespace));
+		parts.push("      </EntityContainer>");
+		parts.push("    </Schema>");
+		parts.push("  </edmx:DataServices>");
+		parts.push("</edmx:Edmx>");
+		return parts.join("\n");
+	}
+	buildEntityTypeXml(entityType) {
+		const lines = [];
+		lines.push(`      <EntityType Name="${entityType.name}">`);
+		if (entityType.keyProperties.length > 0) {
+			lines.push("        <Key>");
+			for (const keyProp of entityType.keyProperties) lines.push(`          <PropertyRef Name="${keyProp}"/>`);
+			lines.push("        </Key>");
+		}
+		for (const prop of entityType.properties) lines.push(this.buildPropertyXml(prop));
+		for (const nav of entityType.navigationProperties) lines.push(this.buildNavigationPropertyXml(nav));
+		lines.push("      </EntityType>");
+		return lines.join("\n");
+	}
+	buildPropertyXml(prop) {
+		let xml = `        <Property Name="${prop.name}" Type="${prop.type}" Nullable="${prop.nullable}"`;
+		if (prop.precision !== void 0) xml += ` Precision="${prop.precision}"`;
+		if (prop.scale !== void 0) xml += ` Scale="${prop.scale}"`;
+		if (prop.maxLength !== void 0) xml += ` MaxLength="${prop.maxLength}"`;
+		xml += "/>";
+		return xml;
+	}
+	buildNavigationPropertyXml(nav) {
+		if (nav.isCollection) return `        <NavigationProperty Name="${nav.name}" Type="${nav.type}"/>`;
+		return `        <NavigationProperty Name="${nav.name}" Type="${nav.type}" Nullable="${nav.nullable}"/>`;
+	}
+	buildEntitySetXml(entitySet, namespace) {
+		return `        <EntitySet Name="${entitySet.name}" EntityType="${namespace}.${entitySet.entityTypeName}"/>`;
+	}
+};
+CsdlBuilder = __decorate([
+	Injectable(),
+	__decorateParam(1, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof (_ref$2 = typeof EdmRegistry !== "undefined" && EdmRegistry) === "function" ? _ref$2 : Object, Object])
+], CsdlBuilder);
+//#endregion
+//#region src/metadata/service-document-builder.ts
+var _ref$1;
+let ServiceDocumentBuilder = class ServiceDocumentBuilder {
+	constructor(edmRegistry, options) {
+		this.edmRegistry = edmRegistry;
+		this.options = options;
+	}
+	/**
+	* Build the OData service document JSON object.
+	* Returns @odata.context pointing to $metadata and a value array with all EntitySets.
+	*/
+	buildServiceDocument() {
+		const serviceRoot = this.options.serviceRoot;
+		const value = Array.from(this.edmRegistry.getEntitySets().values()).map((es) => ({
+			name: es.name,
+			url: es.name,
+			kind: "EntitySet"
+		}));
+		return {
+			"@odata.context": `${serviceRoot}/$metadata`,
+			value
+		};
+	}
+};
+ServiceDocumentBuilder = __decorate([
+	Injectable(),
+	__decorateParam(1, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof (_ref$1 = typeof EdmRegistry !== "undefined" && EdmRegistry) === "function" ? _ref$1 : Object, Object])
+], ServiceDocumentBuilder);
+//#endregion
+//#region src/metadata/metadata.controller.ts
+var _ref, _ref2;
+let MetadataController = class MetadataController {
+	constructor(csdlBuilder, serviceDocumentBuilder, options) {
+		this.csdlBuilder = csdlBuilder;
+		this.serviceDocumentBuilder = serviceDocumentBuilder;
+		this.options = options;
+	}
+	/**
+	* GET {serviceRoot}/$metadata
+	* Returns OData v4 CSDL XML document.
+	* Content-Type: application/xml per OData spec.
+	*/
+	getMetadata() {
+		return this.csdlBuilder.buildCsdlXml();
+	}
+	/**
+	* GET {serviceRoot}/ (service document)
+	* Returns OData service document listing all available EntitySets.
+	* Content-Type: application/json per OData spec.
+	*/
+	getServiceDocument() {
+		return this.serviceDocumentBuilder.buildServiceDocument();
+	}
+};
+__decorate([
+	Get("$metadata"),
+	Header("Content-Type", "application/xml"),
+	__decorateMetadata("design:type", Function),
+	__decorateMetadata("design:paramtypes", []),
+	__decorateMetadata("design:returntype", String)
+], MetadataController.prototype, "getMetadata", null);
+__decorate([
+	Get(""),
+	Header("Content-Type", "application/json"),
+	__decorateMetadata("design:type", Function),
+	__decorateMetadata("design:paramtypes", []),
+	__decorateMetadata("design:returntype", Object)
+], MetadataController.prototype, "getServiceDocument", null);
+MetadataController = __decorate([
+	Controller(),
+	__decorateParam(2, Inject(ODATA_MODULE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [
+		typeof (_ref = typeof CsdlBuilder !== "undefined" && CsdlBuilder) === "function" ? _ref : Object,
+		typeof (_ref2 = typeof ServiceDocumentBuilder !== "undefined" && ServiceDocumentBuilder) === "function" ? _ref2 : Object,
+		Object
+	])
+], MetadataController);
+//#endregion
+//#region src/odata.module.ts
+var _ODataModule;
+const DEFAULT_OPTIONS = {
+	namespace: "Default",
+	maxTop: 1e3,
+	maxExpandDepth: 2,
+	maxFilterDepth: 10,
+	unmappedTypeStrategy: "skip",
+	maxDeepInsertDepth: 5
+};
+const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN } = new ConfigurableModuleBuilder().setClassMethodName("forRoot").setFactoryMethodName("create").build();
+/** Provider that applies defaults to the raw options and exposes them under ODATA_MODULE_OPTIONS */
+const resolvedOptionsProvider = {
+	provide: ODATA_MODULE_OPTIONS,
+	useFactory: (raw) => ({
+		...DEFAULT_OPTIONS,
+		...raw
+	}),
+	inject: [MODULE_OPTIONS_TOKEN]
+};
+/**
+* Patch the MetadataController's PATH_METADATA to use the given serviceRoot.
+* This allows the controller to serve routes under the correct path without
+* hardcoding the serviceRoot.
+*
+* Uses Reflect.defineMetadata to set the NestJS controller path at module
+* registration time (before the DI container compiles the module).
+*/
+function createMetadataControllerWithPath(serviceRoot) {
+	const path = serviceRoot.startsWith("/") ? serviceRoot.slice(1) : serviceRoot;
+	Reflect.defineMetadata(PATH_METADATA, path, MetadataController);
+	return MetadataController;
+}
+let ODataModule = class ODataModule extends ConfigurableModuleClass {
+	static {
+		_ODataModule = this;
+	}
+	/** Static storage for serviceRoot, set by forRoot() and read by forFeature() adapters. */
+	static _serviceRoot = "";
+	/** Returns the serviceRoot registered via forRoot(). Used by adapter modules (e.g. ODataTypeOrmModule). */
+	static get registeredServiceRoot() {
+		return _ODataModule._serviceRoot;
+	}
+	/** Override forRoot to inject the resolved-options provider into the dynamic module. */
+	static forRoot(options) {
+		if (!options.serviceRoot || options.serviceRoot.trim() === "") throw new Error("ODataModule.forRoot(): serviceRoot must be a non-empty string");
+		_ODataModule._serviceRoot = options.serviceRoot;
+		const parent = super.forRoot(options);
+		const metadataController = createMetadataControllerWithPath(options.serviceRoot);
+		const odataControllers = options.controllers ?? [];
+		if (odataControllers.length > 0) {
+			const root = options.serviceRoot.startsWith("/") ? options.serviceRoot.slice(1) : options.serviceRoot;
+			for (const ctrl of odataControllers) {
+				const entitySetName = Reflect.getMetadata(ODATA_CONTROLLER_KEY, ctrl);
+				if (entitySetName) {
+					const fullPath = root ? `${root}/${entitySetName}` : entitySetName;
+					Reflect.defineMetadata(PATH_METADATA, fullPath, ctrl);
+				}
+			}
+		}
+		return {
+			...parent,
+			providers: [
+				...parent.providers ?? [],
+				resolvedOptionsProvider,
+				CsdlBuilder,
+				ServiceDocumentBuilder
+			],
+			controllers: [...parent.controllers ?? [], metadataController],
+			exports: [
+				...parent.exports ?? [],
+				ODATA_MODULE_OPTIONS,
+				CsdlBuilder
+			]
+		};
+	}
+	/** Override forRootAsync to inject the resolved-options provider into the dynamic module. */
+	static forRootAsync(options) {
+		const parent = super.forRootAsync(options);
+		const controller = MetadataController;
+		return {
+			...parent,
+			providers: [
+				...parent.providers ?? [],
+				resolvedOptionsProvider,
+				CsdlBuilder,
+				ServiceDocumentBuilder
+			],
+			controllers: [...parent.controllers ?? [], controller],
+			exports: [
+				...parent.exports ?? [],
+				ODATA_MODULE_OPTIONS,
+				CsdlBuilder
+			]
+		};
+	}
+	/**
+	* Register EDM entity configurations from a feature module.
+	* Entities provided here are available via the EDM_ENTITY_CONFIGS injection token.
+	*/
+	static forFeature(entityConfigs) {
+		return {
+			module: _ODataModule,
+			providers: [{
+				provide: EDM_ENTITY_CONFIGS,
+				useValue: entityConfigs
+			}, EdmFeatureInitializer],
+			exports: [EDM_ENTITY_CONFIGS]
+		};
+	}
+};
+ODataModule = _ODataModule = __decorate([Global(), Module({
+	providers: [EdmRegistry],
+	exports: [EdmRegistry]
+})], ODataModule);
+//#endregion
+//#region src/utils/odata-key-parser.ts
+/**
+* Parse an OData parenthetical key string into a Record of key-value pairs.
+*
+* Formats per D-02:
+*   Simple:    '42'                  -> { Id: 42 }
+*   String:    "'hello'"             -> { Name: 'hello' }
+*   Composite: 'OrderId=1,ItemId=3'  -> { OrderId: 1, ItemId: 3 }
+*
+* Per T-04-02: Key values are returned as typed JS values (number, string, boolean)
+* — never interpolated into SQL. Safe for parameterized ORM queries.
+*/
+/**
+* Coerce an OData key value string to the appropriate JS type.
+* - Strips surrounding single quotes (OData string literal)
+* - Parses 'true'/'false' as boolean
+* - Parses numeric strings as numbers
+* - Otherwise returns as string
+*/
+function coerceKeyValue(val) {
+	const trimmed = val.trim();
+	if (trimmed.startsWith("'") && trimmed.endsWith("'")) return trimmed.slice(1, -1);
+	if (trimmed === "true") return true;
+	if (trimmed === "false") return false;
+	if (/^-?\d+(\.\d+)?$/.test(trimmed)) return Number(trimmed);
+	return trimmed;
+}
+/**
+* Parse an OData parenthetical key string into a Record of key-value pairs.
+*
+* @param keyStr - The key string extracted from parentheses (e.g., '42', "'hello'", 'OrderId=1,ItemId=3')
+* @param keyProperties - Ordered list of key property names (used for simple keys)
+* @returns Record mapping property names to coerced values
+* @throws Error if keyStr is empty
+*/
+function parseODataKey(keyStr, keyProperties) {
+	if (!keyStr) throw new Error("OData key cannot be empty");
+	if (keyStr.includes("=")) {
+		const pairs = keyStr.split(",");
+		const result = {};
+		for (const pair of pairs) {
+			const eqIdx = pair.indexOf("=");
+			const name = pair.slice(0, eqIdx).trim();
+			result[name] = coerceKeyValue(pair.slice(eqIdx + 1).trim());
+		}
+		return result;
+	}
+	return { [keyProperties[0]]: coerceKeyValue(keyStr) };
+}
+//#endregion
+//#region src/index.ts
+const VERSION = "0.0.1";
+//#endregion
+export { CsdlBuilder, EDM_DERIVER, EDM_ENTITY_CONFIGS, EDM_TYPE_KEY, ETAG_PROVIDER, EdmRegistry, EdmType, MAX_BATCH_OPERATIONS, MetadataController, ODATA_CONTROLLER_KEY, ODATA_ENTITY_SET_KEY, ODATA_ETAG_KEY, ODATA_EXCLUDE_KEY, ODATA_KEY_KEY, ODATA_MODULE_OPTIONS, ODATA_ROUTE_KEY, ODATA_SEARCHABLE_KEY, ODATA_VIEW_KEY, ODataController, ODataDelete, ODataETag, ODataEntitySet, ODataExceptionFilter, ODataExclude, ODataGet, ODataGetByKey, ODataKey, ODataModule, ODataParseError, ODataPatch, ODataPost, ODataPut, ODataQueryParam, ODataQueryPipe, ODataResponseInterceptor, ODataSearchable, ODataValidationError, ODataView, QUERY_TRANSLATOR, SEARCH_PROVIDER, ServiceDocumentBuilder, VERSION, acceptVisitor, annotateEntities, annotateEntity, buildContextUrl, extractBoundary, getETagProperty, getEdmTypeOverrides, getEntitySetName, getExcludedProperties, getKeyProperties, getODataViewOptions, getSearchableProperties, parseApply, parseBatchBody, parseFilter, parseODataKey, parseQuery, parseSearch, pluralizeEntityName, tokenize };
+
+//# sourceMappingURL=index.mjs.map