@quickql/server 1.0.0

package/dist/server/src/security.js

@@ -0,0 +1,189 @@
+/**
+ * QuickQL Security Engine
+ *
+ * Enforces authentication, authorization (RBAC), complexity limits, and rate limiting.
+ *
+ * (c) 2024-2026 Udinmo Inc. All rights reserved.
+ * Author: Udinmo Inc. <engineering@udinmo.com>
+ * License: MIT
+ */
+import { createSecurityError } from './errors';
+export class SecurityEngine {
+    options;
+    schemaSnapshot;
+    rateLimitMap = new Map();
+    constructor(options, schemaSnapshot // Added to allow recursive lookup
+    ) {
+        this.options = options;
+        this.schemaSnapshot = schemaSnapshot;
+    }
+    /**
+     * Enforces strict query depth limiting for security.
+     */
+    validateDepth(query, currentDepth = 0) {
+        if (currentDepth > this.options.maxDepth) {
+            throw createSecurityError(`Security violation: Nested query depth exceeds limit of ${this.options.maxDepth}.`);
+        }
+        // Calculate Complexity Budget
+        const complexity = this.calculateComplexity(query);
+        if (this.options.maxComplexity && complexity > this.options.maxComplexity) {
+            throw createSecurityError(`Complexity violation: Query complexity ${complexity} exceeds budget of ${this.options.maxComplexity}.`);
+        }
+        if (query.include) {
+            for (const nested of Object.values(query.include)) {
+                this.validateDepth(nested, currentDepth + 1);
+            }
+        }
+    }
+    calculateComplexity(query) {
+        let score = (query.select?.length || 5); // Default field weight
+        if (query.include) {
+            Object.values(query.include).forEach(nested => {
+                score += 10 + this.calculateComplexity(nested); // Relations weighted heavily
+            });
+        }
+        return score;
+    }
+    /**
+     * Verifies if the current context is authorized to access the collection or mutation.
+     */
+    async validateAuth(name, definition, ctx, isMutation = false) {
+        const userRole = ctx.user?.role || ctx.role || 'anonymous';
+        const rbac = this.options.rbac;
+        // 0. Global RBAC Check
+        if (rbac && rbac.roles[userRole]) {
+            const config = rbac.roles[userRole];
+            const isAdmin = userRole === (rbac.adminRole || 'admin');
+            if (!isAdmin) {
+                // Explicit denylist check
+                if (config.deny?.includes(name)) {
+                    throw createSecurityError(`Forbidden: Access to '${name}' is explicitly denied for role '${userRole}'`);
+                }
+                // Permission check
+                const permissions = isMutation ? config.write : config.can;
+                if (permissions && !permissions.includes(name) && !permissions.includes('*')) {
+                    throw createSecurityError(`Forbidden: Role '${userRole}' does not have ${isMutation ? 'write' : 'read'} access to '${name}'`);
+                }
+            }
+            else {
+                return; // Admin bypass!
+            }
+        }
+        // 1. Policy check (Top level)
+        if (definition?.policy) {
+            switch (definition.policy) {
+                case 'public': break; // Allow all
+                case 'private': throw createSecurityError(`Private collection '${name}': ACCESS_DENIED.`);
+                case 'authenticated':
+                    if (!ctx.user)
+                        throw createSecurityError(`Authenticated session required for '${name}'`);
+                    break;
+                case 'owner-only':
+                    if (!ctx.user)
+                        throw createSecurityError(`Access denied: Ownership required for '${name}'`);
+                    break;
+            }
+        }
+        // 2. Roles check (Shorthand in collection)
+        if (definition?.roles && Array.isArray(definition.roles)) {
+            if (!definition.roles.includes(userRole)) {
+                throw createSecurityError(`Forbidden: Role '${userRole}' is not allowed to access '${name}'`);
+            }
+        }
+        // 3. Custom Auth Hook (Fine-grained)
+        if (definition?.auth) {
+            const isAuthorized = await definition.auth(ctx);
+            if (!isAuthorized) {
+                throw createSecurityError(`Unauthorized: Access denied for '${name}'.`, [name]);
+            }
+        }
+    }
+    /**
+     * Filters the results to remove fields marked as 'private' or failing field-level auth.
+     */
+    async filterResults(collection, data, ctx) {
+        if (!data || data.length === 0)
+            return data;
+        const filteredData = await Promise.all(data.map(async (row) => {
+            const filteredRow = { ...row };
+            for (const [fieldName, fieldDef] of Object.entries(collection.fields)) {
+                // Handle both shorthand 'string' and full FieldDefinition objects
+                const isPrivate = typeof fieldDef === 'object' && fieldDef.private === true;
+                const hasAuth = typeof fieldDef === 'object' && fieldDef.auth;
+                const hasRoles = typeof fieldDef === 'object' && fieldDef.roles;
+                if (isPrivate) {
+                    delete filteredRow[fieldName];
+                    continue;
+                }
+                if (hasRoles && !fieldDef.roles.includes(ctx.user?.role || ctx.role)) {
+                    delete filteredRow[fieldName];
+                    continue;
+                }
+                if (hasAuth && !(await fieldDef.auth(ctx))) {
+                    delete filteredRow[fieldName];
+                }
+            }
+            // 2. Recursively filter relations if present in the row
+            if (collection.relations) {
+                for (const [relKey, relDef] of Object.entries(collection.relations)) {
+                    if (filteredRow[relKey] !== undefined) {
+                        const targetName = relDef.model || relDef.from;
+                        const targetCol = this.schemaSnapshot?.[targetName];
+                        if (targetCol) {
+                            const relData = filteredRow[relKey];
+                            if (Array.isArray(relData)) {
+                                filteredRow[relKey] = await this.filterResults(targetCol, relData, ctx);
+                            }
+                            else if (relData !== null && typeof relData === 'object') {
+                                filteredRow[relKey] = (await this.filterResults(targetCol, [relData], ctx))[0];
+                            }
+                        }
+                    }
+                }
+            }
+            return filteredRow;
+        }));
+        return filteredData;
+    }
+    /**
+     * Simple Memory-based Rate Limiter.
+     */
+    checkRateLimit(key) {
+        if (!this.options.rateLimit)
+            return;
+        const now = Date.now();
+        const windowMs = 60000; // 1 minute window
+        const userLimit = this.rateLimitMap.get(key) || { count: 0, lastReset: now };
+        if (now - userLimit.lastReset > windowMs) {
+            userLimit.count = 1;
+            userLimit.lastReset = now;
+        }
+        else {
+            userLimit.count++;
+        }
+        this.rateLimitMap.set(key, userLimit);
+        if (userLimit.count > this.options.rateLimit) {
+            throw createSecurityError(`Rate limit exceeded: Please try again in a minute.`);
+        }
+    }
+    /**
+     * Basic input sanitization.
+     */
+    sanitize(input) {
+        if (typeof input === 'string') {
+            return input.trim();
+        }
+        if (Array.isArray(input)) {
+            return input.map(i => this.sanitize(i));
+        }
+        if (typeof input === 'object' && input !== null) {
+            const sanitized = {};
+            for (const [key, value] of Object.entries(input)) {
+                sanitized[key] = this.sanitize(value);
+            }
+            return sanitized;
+        }
+        return input;
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/server/src/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAI/C,MAAM,OAAO,cAAc;IAIf;IAOA;IAVF,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE/E,YACU,OAMP,EACO,cAAoB,CAAC,kCAAkC;;QAPvD,YAAO,GAAP,OAAO,CAMd;QACO,mBAAc,GAAd,cAAc,CAAM;IAC3B,CAAC;IAEJ;;OAEG;IACH,aAAa,CAAC,KAAY,EAAE,YAAY,GAAG,CAAC;QAC1C,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,mBAAmB,CAAC,2DAA2D,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACjH,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACxE,MAAM,mBAAmB,CAAC,0CAA0C,UAAU,sBAAsB,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;QACvI,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,aAAa,CAAC,MAAe,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,KAAY;QACpC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB;QAChE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC1C,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAe,CAAC,CAAC,CAAC,6BAA6B;YAC1F,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,UAAsC,EACtC,GAAyB,EACzB,UAAU,GAAG,KAAK;QAElB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAE/B,uBAAuB;QACvB,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,0BAA0B;gBAC1B,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,MAAM,mBAAmB,CAAC,yBAAyB,IAAI,oCAAoC,QAAQ,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,mBAAmB;gBACnB,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC3D,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7E,MAAM,mBAAmB,CAAC,oBAAoB,QAAQ,mBAAmB,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,eAAe,IAAI,GAAG,CAAC,CAAC;gBAChI,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,gBAAgB;YAC1B,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,QAAQ,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC1B,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY;gBAClC,KAAK,SAAS,CAAC,CAAC,MAAM,mBAAmB,CAAC,uBAAuB,IAAI,mBAAmB,CAAC,CAAC;gBAC1F,KAAK,eAAe;oBAClB,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,MAAM,mBAAmB,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;oBACzF,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,MAAM,mBAAmB,CAAC,0CAA0C,IAAI,GAAG,CAAC,CAAC;oBAC5F,MAAM;YACV,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,oBAAoB,QAAQ,+BAA+B,IAAI,GAAG,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;YACrB,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,mBAAmB,CAAC,oCAAoC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,UAAgC,EAChC,IAAW,EACX,GAAyB;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5D,MAAM,WAAW,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAE/B,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,kEAAkE;gBAClE,MAAM,SAAS,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC5E,MAAM,OAAO,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAC9D,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC;gBAEhE,IAAI,SAAS,EAAE,CAAC;oBACZ,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;oBAC9B,SAAS;gBACb,CAAC;gBAED,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;oBAC9B,SAAS;gBACb,CAAC;gBAED,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClE,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,UAAU,GAAI,MAAc,CAAC,KAAK,IAAK,MAAc,CAAC,IAAI,CAAC;wBACjE,MAAM,SAAS,GAAI,IAAY,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;wBAC7D,IAAI,SAAS,EAAE,CAAC;4BACZ,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;4BACpC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gCACzB,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;4BAC5E,CAAC;iCAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gCACzD,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;4BACnF,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,GAAW;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,kBAAkB;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAE7E,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YACzC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC;YACpB,SAAS,CAAC,SAAS,GAAG,GAAG,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEtC,IAAI,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,mBAAmB,CAAC,oDAAoD,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAU;QACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,SAAS,GAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/server/src/types.d.ts

@@ -0,0 +1,158 @@
+/**
+ * QuickQL Server Types
+ *
+ * Core type definitions for the server engine, plugins, and configuration.
+ *
+ * (c) 2024-2026 Udinmo Inc. All rights reserved.
+ * Author: Udinmo Inc. <engineering@udinmo.com>
+ * License: MIT
+ */
+import { Query, Mutation } from '@quickql/core';
+/**
+ * Global Context Interface
+ */
+export interface QuickQLServerContext {
+    orm: any;
+    user?: any;
+    [key: string]: any;
+}
+/**
+ * Internal Engine Types
+ */
+export interface InternalRelationDefinition {
+    from: string;
+    localKey: string;
+    foreignKey: string;
+    isSingle?: boolean;
+}
+export type CollectionSchema = {
+    fields: Record<string, any> | string[];
+    relations?: Record<string, InternalRelationDefinition>;
+    resolver: (query: Partial<Query>, ctx?: QuickQLServerContext) => Promise<Record<string, unknown>[]>;
+    mutationResolver?: (mutation: Mutation, ctx?: QuickQLServerContext) => Promise<Record<string, unknown>>;
+};
+export type SchemaConfig = Record<string, CollectionSchema>;
+/**
+ * Hook & Plugin System
+ */
+export interface QuickQLPlugin {
+    name?: string;
+    /**
+     * Only run hooks if this matches the request context
+     */
+    when?: (ctx: QuickQLServerContext) => boolean | Promise<boolean>;
+    /**
+     * Run before query execution. Can transform the query or validation state.
+     */
+    beforeQuery?: (query: Query, ctx: QuickQLServerContext) => void | Query | Promise<void | Query>;
+    /**
+     * Run after successfull execution. Can transform the data results.
+     */
+    afterQuery?: (result: any[], ctx: QuickQLServerContext) => void | any[] | Promise<void | any[]>;
+    /**
+     * Run when an error occurs.
+     */
+    onError?: (error: unknown, ctx: QuickQLServerContext) => void | Promise<void>;
+    /**
+     * Run BEFORE a mutation. Can transform or block the mutation.
+     */
+    beforeMutation?: (mutation: Mutation, ctx: QuickQLServerContext) => void | Mutation | Promise<void | Mutation>;
+    /**
+     * Run AFTER a mutation succeeds.
+     */
+    onMutation?: (mutation: Mutation, ctx: QuickQLServerContext) => void | Promise<void>;
+}
+export interface RBACConfig {
+    roles: Record<string, {
+        can?: string[];
+        write?: string[];
+        deny?: string[];
+    }>;
+    adminRole?: string;
+}
+export interface CacheConfig {
+    enabled?: boolean;
+    ttl?: number;
+    maxItems?: number;
+    exclude?: string[];
+}
+export interface PlaygroundConfig {
+    endpoint?: string;
+    debug?: boolean;
+    /**
+     * If true, will hide some advanced features from the UI.
+     */
+    readonly?: boolean;
+}
+export interface AuthConfig {
+    secret?: string;
+    strategies?: ('jwt' | 'apiKey' | 'session' | 'custom')[];
+    onAuth?: (ctx: QuickQLServerContext) => Promise<boolean | QuickQLServerContext> | boolean | QuickQLServerContext;
+}
+export interface ServerFeatures {
+    /**
+     * Automatically match plural/singular or fuzzy collection names.
+     * Default: true
+     */
+    smartCollectionMatching?: boolean;
+    /**
+     * Automatically infer relations from field names (e.g. userId -> users).
+     * Default: true
+     */
+    smartRelationDiscovery?: boolean;
+    /**
+     * Allow select: ['*'] to return all fields from the resolver result.
+     * Default: true
+     */
+    superSelection?: boolean;
+    /**
+     * Include performance and security hints in response metadata.
+     * Default: true
+     */
+    smartHints?: boolean;
+}
+export interface LoggingConfig {
+    level?: 'debug' | 'info' | 'warn' | 'error' | 'none';
+    customLogger?: (level: string, message: string, data?: any) => void;
+    slowQueryThreshold?: number;
+}
+export interface DirectiveConfig {
+    name: string;
+    handler: (value: any, args: Record<string, any>, ctx: QuickQLServerContext) => any | Promise<any>;
+}
+export interface TransformerConfig {
+    onInput?: (data: any) => any;
+    onOutput?: (data: any) => any;
+}
+export interface ErrorConfig {
+    format?: (error: any, debug?: boolean) => any;
+    maskInternalErrors?: boolean;
+}
+export interface ServerOptions {
+    schema: SchemaConfig;
+    features?: ServerFeatures;
+    maxDepth?: number;
+    maxComplexity?: number;
+    rateLimit?: number;
+    cors?: boolean;
+    debug?: boolean;
+    playground?: boolean | PlaygroundConfig;
+    plugins?: QuickQLPlugin[];
+    auth?: AuthConfig;
+    rbac?: RBACConfig;
+    cache?: CacheConfig;
+    logging?: LoggingConfig;
+    directives?: DirectiveConfig[];
+    transformers?: TransformerConfig;
+    errors?: ErrorConfig;
+    /**
+     * Custom context builder function.
+     * Receives the request input and returns a context object.
+     */
+    context?: (reqInput: any) => Promise<Record<string, any>> | Record<string, any>;
+    /**
+     * Optional wrapper for atomic batch transactions (e.g. Prisma.$transaction)
+     */
+    transactionWrapper?: (ctx: QuickQLServerContext, executeBatch: (tx: any) => Promise<any>) => Promise<any>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAmB,MAAM,eAAe,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACvD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACpG,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzG,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE5D;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;OAEG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,oBAAoB,KAAK,IAAI,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAEhG;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,oBAAoB,KAAK,IAAI,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;IAEhG;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,oBAAoB,KAAK,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;IAE/G;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACpB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,GAAG,OAAO,GAAG,oBAAoB,CAAC;CAClH;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,oBAAoB,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,GAAG,CAAC;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACxC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAG1B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChF;;OAEG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CAC3G"}

package/dist/server/src/types.js

@@ -0,0 +1,11 @@
+/**
+ * QuickQL Server Types
+ *
+ * Core type definitions for the server engine, plugins, and configuration.
+ *
+ * (c) 2024-2026 Udinmo Inc. All rights reserved.
+ * Author: Udinmo Inc. <engineering@udinmo.com>
+ * License: MIT
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/server/src/validator.d.ts

@@ -0,0 +1,30 @@
+/**
+ * QuickQL Query Validator
+ *
+ * Ensures every incoming request matches the defined schema and
+ * respects the configured security rules.
+ *
+ * (c) 2024-2026 Udinmo Inc. All rights reserved.
+ * Author: Udinmo Inc. <engineering@udinmo.com>
+ * License: MIT
+ */
+import { Query, Mutation } from '@quickql/core';
+import { SchemaConfig } from './types';
+import { SchemaOptions } from './schema/types';
+import { ServerFeatures } from './types';
+export declare class QueryValidator {
+    private schema;
+    private maxDepth;
+    private schemaOptions?;
+    private features;
+    constructor(schema: SchemaConfig, maxDepth: number, schemaOptions?: SchemaOptions | undefined, features?: ServerFeatures);
+    private suggestionCache;
+    private fieldSetCache;
+    private getFieldsSet;
+    validateQuery(query: Query, depth?: number): void;
+    validateMutation(mutation: Mutation): void;
+    private validateArguments;
+    private findCachedSuggestion;
+    private findSuggestion;
+}
+//# sourceMappingURL=validator.d.ts.map

package/dist/server/src/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,qBAAa,cAAc;IAEvB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,QAAQ;gBAHR,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,aAAa,YAAA,EAC7B,QAAQ,GAAE,cAAgF;IAGpG,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,aAAa,CAAkC;IAEvD,OAAO,CAAC,YAAY;IAOpB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,SAAI,GAAG,IAAI;IAgF5C,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAqB1C,OAAO,CAAC,iBAAiB;IAsCzB,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,cAAc;CAYvB"}

package/dist/server/src/validator.js

@@ -0,0 +1,171 @@
+/**
+ * QuickQL Query Validator
+ *
+ * Ensures every incoming request matches the defined schema and
+ * respects the configured security rules.
+ *
+ * (c) 2024-2026 Udinmo Inc. All rights reserved.
+ * Author: Udinmo Inc. <engineering@udinmo.com>
+ * License: MIT
+ */
+import { createValidationError, createSecurityError } from './errors';
+export class QueryValidator {
+    schema;
+    maxDepth;
+    schemaOptions;
+    features;
+    constructor(schema, maxDepth, schemaOptions, features = { smartCollectionMatching: true, smartRelationDiscovery: true }) {
+        this.schema = schema;
+        this.maxDepth = maxDepth;
+        this.schemaOptions = schemaOptions;
+        this.features = features;
+    }
+    suggestionCache = new Map();
+    fieldSetCache = new Map();
+    getFieldsSet(collectionName, fields) {
+        if (this.fieldSetCache.has(collectionName))
+            return this.fieldSetCache.get(collectionName);
+        const set = new Set(Array.isArray(fields) ? fields : Object.keys(fields));
+        this.fieldSetCache.set(collectionName, set);
+        return set;
+    }
+    validateQuery(query, depth = 0) {
+        if (depth > this.maxDepth) {
+            throw createSecurityError(`Security violation: Query exceeds maximum depth of ${this.maxDepth}.`);
+        }
+        const collectionName = query.from;
+        let collection = this.schema[collectionName];
+        // Smart Discovery: Try singular / plural / fuzzy variations
+        if (!collection && this.features.smartCollectionMatching) {
+            const candidates = Object.keys(this.schema);
+            const exactMatch = candidates.find(c => c === collectionName ||
+                c === `${collectionName}s` ||
+                c === `${collectionName}es` ||
+                c === collectionName.replace(/s$/, ''));
+            if (exactMatch) {
+                collection = this.schema[exactMatch];
+            }
+            else {
+                const suggestion = this.findCachedSuggestion(collectionName, candidates);
+                if (suggestion) {
+                    collection = this.schema[suggestion];
+                }
+            }
+        }
+        if (!collection) {
+            const suggestion = this.findCachedSuggestion(collectionName, Object.keys(this.schema));
+            throw createValidationError(`Unknown collection: ${collectionName}${suggestion ? `. Did you mean '${suggestion}'?` : ''}`);
+        }
+        // 1. Validate fields in selection
+        const fieldSet = this.getFieldsSet(collectionName, collection.fields);
+        if (query.select) {
+            for (const field of query.select) {
+                if (field === '*')
+                    continue;
+                if (!fieldSet.has(field)) {
+                    throw createValidationError(`Invalid field selection: '${field}' does not exist on collection '${collectionName}'`);
+                }
+            }
+        }
+        // 2. Validate relations in inclusion
+        if (query.include) {
+            for (const relationKey of Object.keys(query.include)) {
+                let relationDef = collection.relations?.[relationKey];
+                // Smart Discovery: If missing, allow if naming convention might match (e.g. author -> authorId)
+                if (!relationDef && this.features.smartRelationDiscovery) {
+                    const possibleKeys = [`${relationKey}Id`, `${relationKey}_id`, `${relationKey}`];
+                    const hasMatchingField = possibleKeys.some(k => collection.fields.includes(k));
+                    const guestTarget = [relationKey, `${relationKey}s`, `${relationKey}es`].some(t => this.schema[t]);
+                    if (hasMatchingField && guestTarget) {
+                        // Implicitly allowed!
+                        continue;
+                    }
+                }
+                if (!relationDef) {
+                    throw createValidationError(`Invalid relation inclusion: '${relationKey}' is not defined for collection '${collectionName}'`);
+                }
+                const nestedQuery = query.include?.[relationKey];
+                if (nestedQuery) {
+                    // Normalize the nested query 'from' for validation
+                    const schemaQuery = { ...nestedQuery, from: relationDef.from };
+                    this.validateQuery(schemaQuery, depth + 1);
+                }
+            }
+        }
+        // 3. Validate arguments in where clause
+        if (query.where) {
+            this.validateArguments(query.where, collection.fields, collectionName);
+        }
+    }
+    validateMutation(mutation) {
+        // 1. Check if it's a custom root mutation (Schema-level)
+        if (this.schemaOptions?.mutations?.[mutation.collection]) {
+            return;
+        }
+        // Fallback logic for collection-level mutations
+        const collection = this.schema[mutation.collection];
+        if (collection) {
+            if (!collection.mutationResolver) {
+                throw createValidationError(`Mutations are NOT enabled for collection: ${mutation.collection}`);
+            }
+            if ((mutation.type === 'create' || mutation.type === 'update') && !mutation.data) {
+                throw createValidationError(`Data payload is required for mutation type: ${mutation.type}`);
+            }
+            return;
+        }
+        throw createValidationError(`Unknown mutation or collection: ${mutation.collection}`);
+    }
+    validateArguments(where, collectionFields, collectionName) {
+        const keys = Object.keys(where);
+        const fieldNames = Array.isArray(collectionFields) ? collectionFields : Object.keys(collectionFields);
+        for (const key of keys) {
+            if (key === 'AND' || key === 'OR') {
+                const subConditions = where[key];
+                if (Array.isArray(subConditions)) {
+                    subConditions.forEach(sub => this.validateArguments(sub, collectionFields, collectionName));
+                }
+                continue;
+            }
+            if (!fieldNames.includes(key)) {
+                throw createValidationError(`Invalid filter: Field '${key}' does not exist on collection '${collectionName}'`);
+            }
+            // Add Type-Safety Check!
+            if (!Array.isArray(collectionFields)) {
+                const fieldDef = collectionFields[key];
+                const type = typeof fieldDef === 'string' ? fieldDef : fieldDef.type;
+                const value = where[key];
+                if (type && typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                    // Operator check (can't easily type check the value inside 'eq/gt' here without a mapping)
+                }
+                else if (type && value !== null) {
+                    const actualType = typeof value;
+                    if (type === 'number' && actualType !== 'number') {
+                        throw createValidationError(`Type mismatch: Field '${key}' expects ${type}, but got ${actualType}`);
+                    }
+                    if (type === 'boolean' && actualType !== 'boolean') {
+                        throw createValidationError(`Type mismatch: Field '${key}' expects ${type}, but got ${actualType}`);
+                    }
+                }
+            }
+        }
+    }
+    findCachedSuggestion(input, options) {
+        if (this.suggestionCache.has(input))
+            return this.suggestionCache.get(input);
+        const suggestion = this.findSuggestion(input, options);
+        this.suggestionCache.set(input, suggestion);
+        return suggestion;
+    }
+    findSuggestion(input, options) {
+        if (options.length === 0)
+            return undefined;
+        const inputLower = input.toLowerCase();
+        // Exact case-insensitive match
+        const nearMatch = options.find(o => o.toLowerCase() === inputLower);
+        if (nearMatch)
+            return nearMatch;
+        // Basic substring check or length proximity
+        return options.find(o => o.toLowerCase().includes(inputLower) || inputLower.includes(o.toLowerCase()));
+    }
+}
+//# sourceMappingURL=validator.js.map

package/dist/server/src/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAItE,MAAM,OAAO,cAAc;IAEf;IACA;IACA;IACA;IAJV,YACU,MAAoB,EACpB,QAAgB,EAChB,aAA6B,EAC7B,WAA2B,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE;QAH1F,WAAM,GAAN,MAAM,CAAc;QACpB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,kBAAa,GAAb,aAAa,CAAgB;QAC7B,aAAQ,GAAR,QAAQ,CAAkF;IACjG,CAAC;IAEI,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,YAAY,CAAC,cAAsB,EAAE,MAAsC;QACjF,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;QAC3F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,aAAa,CAAC,KAAY,EAAE,KAAK,GAAG,CAAC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,mBAAmB,CAAC,sDAAsD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC;QAClC,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAE7C,4DAA4D;QAC5D,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,KAAK,cAAc;gBACpB,CAAC,KAAK,GAAG,cAAc,GAAG;gBAC1B,CAAC,KAAK,GAAG,cAAc,IAAI;gBAC3B,CAAC,KAAK,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACvC,CAAC;YACF,IAAI,UAAU,EAAE,CAAC;gBACd,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACL,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;gBACzE,IAAI,UAAU,EAAE,CAAC;oBACd,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACxC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,uBAAuB,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,CAAC;QAED,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjC,IAAI,KAAK,KAAK,GAAG;oBAAE,SAAS;gBAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,qBAAqB,CAAC,6BAA6B,KAAK,mCAAmC,cAAc,GAAG,CAAC,CAAC;gBACtH,CAAC;YACH,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,IAAI,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;gBAEtD,gGAAgG;gBAChG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;oBACxD,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,IAAI,EAAE,GAAG,WAAW,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;oBACjF,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/E,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,GAAG,EAAE,GAAG,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;oBAEnG,IAAI,gBAAgB,IAAI,WAAW,EAAE,CAAC;wBAClC,sBAAsB;wBACtB,SAAS;oBACb,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,WAAW,EAAE,CAAC;oBAChB,MAAM,qBAAqB,CAAC,gCAAgC,WAAW,oCAAoC,cAAc,GAAG,CAAC,CAAC;gBACjI,CAAC;gBAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,WAAW,EAAE,CAAC;oBAChB,mDAAmD;oBACnD,MAAM,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;oBAC/D,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,QAAkB;QACjC,yDAAyD;QACzD,IAAI,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,qBAAqB,CAAC,6CAA6C,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjF,MAAM,qBAAqB,CAAC,+CAA+C,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,qBAAqB,CAAC,mCAAmC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACxF,CAAC;IAEO,iBAAiB,CAAC,KAAU,EAAE,gBAAgD,EAAE,cAAsB;QAC5G,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEtG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;gBAC9F,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,qBAAqB,CAAC,0BAA0B,GAAG,mCAAmC,cAAc,GAAG,CAAC,CAAC;YACjH,CAAC;YAED,yBAAyB;YACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACrE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEzB,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/E,2FAA2F;gBAC/F,CAAC;qBAAM,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAChC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC;oBAChC,IAAI,IAAI,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;wBAC/C,MAAM,qBAAqB,CAAC,yBAAyB,GAAG,aAAa,IAAI,aAAa,UAAU,EAAE,CAAC,CAAC;oBACxG,CAAC;oBACD,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBACnD,MAAM,qBAAqB,CAAC,yBAAyB,GAAG,aAAa,IAAI,aAAa,UAAU,EAAE,CAAC,CAAC;oBACtG,CAAC;gBACL,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,KAAa,EAAE,OAAiB;QAC3D,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,cAAc,CAAC,KAAa,EAAE,OAAiB;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE3C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAEvC,+BAA+B;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,4CAA4C;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;CACF"}

package/package.json

@@ -0,0 +1,25 @@
+{
+  "version": "1.0.0",
+  "name": "@quickql/server",
+  "description": "Enterprise-grade QuickQL server engine with advanced security and performance.",
+  "author": "Udinmo Inc. <engineering@udinmo.com>",
+  "license": "MIT",
+  "homepage": "https://quickql.io",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "test": "tsx tests/runner.ts",
+    "playground": "tsx dev.ts"
+  },
+  "dependencies": {
+    "@quickql/core": "*"
+  },
+  "devDependencies": {
+    "prismjs": "^1.30.0"
+  }
+}