@yrest/cli 0.8.0 → 0.9.0

package/dist/index.mjs

@@ -17,6 +17,56 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/storage/parseRelations.ts
+function parseRelations(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const result = {};
+  for (const [collection, fields] of Object.entries(raw)) {
+    if (!fields || typeof fields !== "object" || Array.isArray(fields)) continue;
+    result[collection] = {};
+    for (const [key, value] of Object.entries(fields)) {
+      const def = normaliseRelationDef(key, value);
+      if (def) result[collection][key] = def;
+    }
+  }
+  return result;
+}
+function normaliseRelationDef(key, value) {
+  if (typeof value === "string") {
+    return { type: "many2one", target: value };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const v = value;
+  const type = v["type"];
+  const nested = v["nested"] === true ? true : void 0;
+  if (type === "many2one" || type === void 0) {
+    const target = v["target"];
+    if (typeof target !== "string") return null;
+    return nested ? { type: "many2one", target, nested } : { type: "many2one", target };
+  }
+  if (type === "one2one") {
+    const target = v["target"];
+    if (typeof target !== "string") return null;
+    return nested ? { type: "one2one", target, nested } : { type: "one2one", target };
+  }
+  if (type === "many2many") {
+    const target = typeof v["target"] === "string" ? v["target"] : key;
+    const through = v["through"];
+    const foreignKey = v["foreignKey"];
+    const otherKey = v["otherKey"];
+    if (typeof through !== "string" || typeof foreignKey !== "string" || typeof otherKey !== "string")
+      return null;
+    return nested ? { type: "many2many", target, through, foreignKey, otherKey, nested } : { type: "many2many", target, through, foreignKey, otherKey };
+  }
+  return null;
+}
+var init_parseRelations = __esm({
+  "src/storage/parseRelations.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/utils/deepCopy.ts
 function deepCopyData(source) {
   return Object.fromEntries(
@@ -42,7 +92,7 @@ import { parse as parse2, stringify } from "yaml";
 function createYrestStorage(filePath) {
   const absPath = resolve(filePath);
   const raw = parse2(readFileSync2(absPath, "utf8")) ?? {};
-  const relations = raw["_rel"] ?? {};
+  const relations = parseRelations(raw["_rel"]);
   const routes = Array.isArray(raw["_routes"]) ? raw["_routes"] : [];
   const data = Object.fromEntries(
     Object.entries(raw).filter(([key]) => key !== "_rel" && key !== "_routes")
@@ -79,7 +129,7 @@ function createYrestStorage(filePath) {
     },
     reload() {
       const fresh = parse2(readFileSync2(absPath, "utf8")) ?? {};
-      const freshRelations = fresh["_rel"] ?? {};
+      const freshRelations = parseRelations(fresh["_rel"]);
       const freshData = Object.fromEntries(
         Object.entries(fresh).filter(([key]) => key !== "_rel" && key !== "_routes")
       );
@@ -112,6 +162,7 @@ var init_yrestStorage = __esm({
   "src/storage/yrestStorage.ts"() {
     "use strict";
     init_esm_shims();
+    init_parseRelations();
     init_deepCopy();
   }
 });
@@ -163,13 +214,21 @@ function dedent(str) {
 
 // src/api/yrestServer.ts
 init_esm_shims();
+init_parseRelations();
 import { resolve as resolve2 } from "path";
 
 // src/utils/handlers.ts
 init_esm_shims();
 import { existsSync } from "fs";
+var ALLOWED_EXTENSIONS = [".js", ".mjs", ".cjs"];
 async function loadHandlers(filePath) {
   if (!existsSync(filePath)) return /* @__PURE__ */ new Map();
+  if (!ALLOWED_EXTENSIONS.some((ext) => filePath.endsWith(ext))) {
+    console.error(
+      `  \x1B[31m[handlers] ${filePath} \u2014 only .js, .mjs and .cjs files are allowed\x1B[0m`
+    );
+    return /* @__PURE__ */ new Map();
+  }
   try {
     const mod = await import(filePath);
     const map = /* @__PURE__ */ new Map();
@@ -210,6 +269,9 @@ import { readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
+// src/router/templates/about.helpers.ts
+init_esm_shims();
+
 // src/utils/interpolate.ts
 init_esm_shims();
 import { randomUUID } from "crypto";
@@ -257,16 +319,7 @@ function hasTemplates(value) {
   return typeof value === "string" ? value.includes("{{") : JSON.stringify(value).includes("{{");
 }
 
-// src/router/templates/about.template.ts
-var _dir = dirname(fileURLToPath2(import.meta.url));
-var LOGO_SRC = (() => {
-  try {
-    const buf = readFileSync(join(_dir, "../../assets/logo-color.png"));
-    return `data:image/png;base64,${buf.toString("base64")}`;
-  } catch {
-    return "";
-  }
-})();
+// src/router/templates/about.helpers.ts
 var METHOD_COLOR = {
   GET: "#3fb950",
   POST: "#58a6ff",
@@ -275,8 +328,11 @@ var METHOD_COLOR = {
   DELETE: "#f85149",
   fn: "#f0883e"
 };
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function badge(label, color, bg) {
-  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${label}</span>`;
+  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${escapeHtml(label)}</span>`;
 }
 function methodBadge(method) {
   const color = METHOD_COLOR[method] ?? "#7d8590";
@@ -286,7 +342,7 @@ function endpointRow(method, path2, desc) {
   return `
     <tr>
       <td class="method-cell">${methodBadge(method)}</td>
-      <td class="path-cell"><code>${path2}</code></td>
+      <td class="path-cell"><code>${escapeHtml(path2)}</code></td>
       <td class="desc-cell">${desc}</td>
     </tr>`;
 }
@@ -320,7 +376,7 @@ function resourceAccordion(name, base, isOpen) {
   return `
   <details class="resource-card" ${isOpen ? "open" : ""}>
     <summary>
-      <span class="resource-name">/${name}</span>
+      <span class="resource-name">/${escapeHtml(name)}</span>
       <span class="route-count">6 routes</span>
     </summary>
     <table>
@@ -328,6 +384,139 @@ function resourceAccordion(name, base, isOpen) {
     </table>
   </details>`;
 }
+function nestedRoutesAccordion(relations, base) {
+  const rows = [];
+  for (const [source, fields] of Object.entries(relations)) {
+    for (const [key, def] of Object.entries(fields)) {
+      const nestedBadge = def.nested ? ` ${badge("nested", "#facc15", "#facc1518")}` : "";
+      if (def.type === "many2many") {
+        const singular = source.endsWith("s") ? source.slice(0, -1) : source;
+        const m2mBadge = badge("many2many", "#818cf8", "#818cf818");
+        rows.push(
+          endpointRow(
+            "GET",
+            `${base}/${source}/:id/${key}`,
+            `List ${def.target} linked to a ${singular} via ${def.through}. ${m2mBadge}${nestedBadge}`
+          )
+        );
+        const targetSingular = def.target.endsWith("s") ? def.target.slice(0, -1) : def.target;
+        rows.push(
+          endpointRow(
+            "GET",
+            `${base}/${def.target}/:id/${source}`,
+            `List ${source} linked to a ${targetSingular} via ${def.through} (inverse). ${m2mBadge}`
+          )
+        );
+      } else {
+        const path2 = `${base}/${def.target}/:id/${source}`;
+        const parentSingular = def.target.endsWith("s") ? def.target.slice(0, -1) : def.target;
+        const typeBadge = def.type === "one2one" ? ` ${badge("one2one", "#34d399", "#34d39918")}` : "";
+        rows.push(
+          endpointRow(
+            "GET",
+            path2,
+            `${def.type === "one2one" ? "Get" : "List"} ${source} belonging to a ${parentSingular}.${typeBadge}${nestedBadge}`
+          )
+        );
+      }
+    }
+  }
+  if (!rows.length) return "";
+  return `
+  <details class="resource-card nested-card">
+    <summary>
+      <span class="resource-name">Nested routes</span>
+      <span class="route-count">${rows.length} route${rows.length !== 1 ? "s" : ""}</span>
+    </summary>
+    <table><tbody>${rows.join("")}</tbody></table>
+  </details>`;
+}
+function snapshotAccordion() {
+  return `
+  <details class="resource-card nested-card">
+    <summary>
+      <span class="resource-name">/_snapshot</span>
+      <span class="route-count">3 routes</span>
+    </summary>
+    <table><tbody>
+      ${endpointRow("GET", "/_snapshot", "Returns metadata of the current snapshot: <code>savedAt</code> and item counts per collection.")}
+      ${endpointRow("POST", "/_snapshot/save", "Replaces the stored snapshot with the current database state.")}
+      ${endpointRow("POST", "/_snapshot/reset", "Restores the database to the last saved snapshot and persists to disk.")}
+    </tbody></table>
+  </details>`;
+}
+function customRoutesAccordion(routes, base, handlers) {
+  if (!routes.length) return "";
+  const rows = routes.map((r) => {
+    const fullPath = `${base}${r.path}`;
+    const tags = [];
+    if (r.error) tags.push(`<span style="color:#f85149;font-size:11px">error\xB7${r.error}</span>`);
+    if (r.delay && r.delay > 0)
+      tags.push(`<span style="color:#fb923c;font-size:11px">delay\xB7${r.delay}ms</span>`);
+    if (r.scenarios?.length) {
+      const hasOr = r.scenarios.some((s) => Array.isArray(s.when));
+      tags.push(
+        `<span style="color:#a371f7;font-size:11px">scenarios\xB7${r.scenarios.length}${hasOr ? " (OR)" : ""}</span>`
+      );
+    }
+    if (r.otherwise)
+      tags.push(`<span style="color:var(--text-muted);font-size:11px">otherwise</span>`);
+    let desc;
+    if (r.error) {
+      desc = `Error injection \u2014 <code>${r.error}</code>`;
+    } else if (r.handler) {
+      const found = handlers.has(r.handler);
+      const handlerName = escapeHtml(r.handler);
+      desc = found ? `Handler \u2014 <code>${handlerName}()</code>` : `Handler \u2014 <code>${handlerName}()</code> <span style="color:#f85149">(not loaded)</span>`;
+    } else if (r.scenarios?.length) {
+      const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
+      desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
+    } else if (r.response?.body != null && hasTemplates(r.response.body)) {
+      desc = `Dynamic \u2014 <code>{{\u2026}}</code>`;
+    } else {
+      const status = r.response?.status ?? 200;
+      desc = `Static \u2014 <code>${status}</code>${r.response?.headers ? ` + headers` : ""}`;
+    }
+    if (tags.length) desc += `&ensp;${tags.join("&ensp;")}`;
+    return endpointRow(r.method?.toUpperCase() ?? "GET", fullPath, desc);
+  });
+  return `
+  <details class="resource-card nested-card">
+    <summary>
+      <span class="resource-name">Custom routes</span>
+      <span class="route-count">${routes.length} route${routes.length !== 1 ? "s" : ""}</span>
+    </summary>
+    <table><tbody>
+      ${rows.join("")}
+    </tbody></table>
+  </details>`;
+}
+function handlersAccordion(handlers, routes, base) {
+  if (!handlers.size) return "";
+  const routesByHandler = /* @__PURE__ */ new Map();
+  for (const r of routes) {
+    if (r.handler) {
+      const list = routesByHandler.get(r.handler) ?? [];
+      list.push({ method: (r.method ?? "GET").toUpperCase(), path: `${base}${r.path}` });
+      routesByHandler.set(r.handler, list);
+    }
+  }
+  const rows = [...handlers.keys()].map((name) => {
+    const linked = routesByHandler.get(name);
+    const routeDesc = linked ? linked.map((r) => `<code>${r.method} ${r.path}</code>`).join(", ") : `<span style="color:var(--text-muted)">not referenced in _routes</span>`;
+    return endpointRow("fn", name + "()", routeDesc);
+  });
+  return `
+  <details class="resource-card nested-card">
+    <summary>
+      <span class="resource-name">Handlers</span>
+      <span class="route-count">${handlers.size} function${handlers.size !== 1 ? "s" : ""}</span>
+    </summary>
+    <table><tbody>
+      ${rows.join("")}
+    </tbody></table>
+  </details>`;
+}
 function examplesBlock(collections, relations, base, host, options, firstCustomRoute) {
   const examples = [];
   const firstCol = collections[0];
@@ -358,35 +547,36 @@ curl -X DELETE ${p}/1`
   const firstRel = Object.entries(relations)[0];
   if (firstRel) {
     const [child, fields] = firstRel;
-    const fk = Object.keys(fields)[0];
-    const expandKey = fk.replace(/Id$/i, "");
-    examples.push(
-      `# Embed parent with ?_expand
-curl "${host}${base}/${child}/1?_expand=${expandKey}"`
-    );
-  }
-  const firstRelEntry = Object.entries(relations)[0];
-  if (firstRelEntry) {
-    const [child, fields] = firstRelEntry;
-    const parent = Object.values(fields)[0];
-    if (parent) {
-      examples.push(`# Nested resource
-curl ${host}${base}/${parent}/1/${child}`);
+    const firstField = Object.entries(fields)[0];
+    if (firstField) {
+      const [fk, def] = firstField;
+      if (def.type !== "many2many") {
+        const expandKey = fk.replace(/Id$/i, "");
+        examples.push(
+          `# Embed parent with ?_expand
+curl "${host}${base}/${child}/1?_expand=${expandKey}"`,
+          `# Nested resource
+curl ${host}${base}/${def.target}/1/${child}`
+        );
+      } else {
+        examples.push(`# Many-to-many embed
+curl "${host}${base}/${child}/1/${fk}"`);
+      }
     }
   }
   if (options.pageable.enabled && firstCol) {
     examples.push(`# Pageable envelope
 curl "${host}${base}/${firstCol}?_page=2"`);
   }
-  const firstParentRel = Object.entries(relations).find(
-    ([, fields]) => Object.values(fields).includes(firstCol ?? "")
-  );
   if (firstCol) {
     examples.push(
       `# Project fields with ?_fields
 curl "${host}${base}/${firstCol}?_fields=id,name"`
     );
   }
+  const firstParentRel = Object.entries(relations).find(
+    ([, fields]) => Object.values(fields).some((def) => def.type !== "many2many" && def.target === firstCol)
+  );
   if (firstParentRel && firstCol) {
     const [childName] = firstParentRel;
     examples.push(
@@ -404,7 +594,7 @@ curl -X POST ${host}/_snapshot/reset`
   }
   if (firstCustomRoute) {
     const method = firstCustomRoute.method?.toUpperCase() ?? "GET";
-    const fullPath = `${host}${base}${firstCustomRoute.path}`;
+    const fullPath = `${host}${base}${escapeHtml(firstCustomRoute.path ?? "")}`;
     const curlFlag = method === "GET" ? "" : `-X ${method} `;
     examples.push(`# Custom route
 curl ${curlFlag}${fullPath}`);
@@ -412,9 +602,21 @@ curl ${curlFlag}${fullPath}`);
   const highlighted = examples.map((e) => e.replace(/^(#.+)$/gm, '<span class="cm">$1</span>')).join("\n\n");
   return `<pre>${highlighted}</pre>`;
 }
+
+// src/router/templates/about.template.ts
+var _dir = dirname(fileURLToPath2(import.meta.url));
+var LOGO_SRC = (() => {
+  try {
+    const buf = readFileSync(join(_dir, "../../assets/logo-color.png"));
+    return `data:image/png;base64,${buf.toString("base64")}`;
+  } catch {
+    return "";
+  }
+})();
 function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map()) {
   const collections = Object.keys(storage.getData());
   const relations = storage.getRelations();
+  const customRoutes = storage.getRoutes();
   const base = options.base;
   const host = `http://${options.host}:${options.port}`;
   const modes = [];
@@ -428,104 +630,6 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
   if (options.idStrategy !== "increment")
     modes.push(badge(`id \xB7 ${options.idStrategy}`, "#a371f7", "#a371f718"));
   const accordions = collections.map((col, i) => resourceAccordion(col, base, i === 0)).join("");
-  const nestedRows = [];
-  for (const [child, fields] of Object.entries(relations)) {
-    for (const [, parent] of Object.entries(fields)) {
-      const nestedPath = `${base}/${parent}/:id/${child}`;
-      const parentSingular = parent.endsWith("s") ? parent.slice(0, -1) : parent;
-      nestedRows.push(
-        endpointRow("GET", nestedPath, `List ${child} belonging to a ${parentSingular}.`)
-      );
-    }
-  }
-  const nestedAccordion = nestedRows.length ? `
-  <details class="resource-card nested-card">
-    <summary>
-      <span class="resource-name">Nested routes</span>
-      <span class="route-count">${nestedRows.length} route${nestedRows.length !== 1 ? "s" : ""}</span>
-    </summary>
-    <table><tbody>${nestedRows.join("")}</tbody></table>
-  </details>` : "";
-  const snapshotAccordion = options.snapshot ? `
-  <details class="resource-card nested-card">
-    <summary>
-      <span class="resource-name">/_snapshot</span>
-      <span class="route-count">3 routes</span>
-    </summary>
-    <table><tbody>
-      ${endpointRow("GET", "/_snapshot", "Returns metadata of the current snapshot: <code>savedAt</code> and item counts per collection.")}
-      ${endpointRow("POST", "/_snapshot/save", "Replaces the stored snapshot with the current database state.")}
-      ${endpointRow("POST", "/_snapshot/reset", "Restores the database to the last saved snapshot and persists to disk.")}
-    </tbody></table>
-  </details>` : "";
-  const customRoutes = storage.getRoutes();
-  const customRoutesAccordion = customRoutes.length ? `
-  <details class="resource-card nested-card">
-    <summary>
-      <span class="resource-name">Custom routes</span>
-      <span class="route-count">${customRoutes.length} route${customRoutes.length !== 1 ? "s" : ""}</span>
-    </summary>
-    <table><tbody>
-      ${customRoutes.map((r) => {
-    const fullPath = `${base}${r.path}`;
-    const tags = [];
-    if (r.error) {
-      tags.push(`<span style="color:#f85149;font-size:11px">error\xB7${r.error}</span>`);
-    }
-    if (r.delay && r.delay > 0) {
-      tags.push(`<span style="color:#fb923c;font-size:11px">delay\xB7${r.delay}ms</span>`);
-    }
-    if (r.scenarios?.length) {
-      const hasOr = r.scenarios.some((s) => Array.isArray(s.when));
-      tags.push(
-        `<span style="color:#a371f7;font-size:11px">scenarios\xB7${r.scenarios.length}${hasOr ? " (OR)" : ""}</span>`
-      );
-    }
-    if (r.otherwise) {
-      tags.push(`<span style="color:var(--text-muted);font-size:11px">otherwise</span>`);
-    }
-    let desc;
-    if (r.error) {
-      desc = `Error injection \u2014 <code>${r.error}</code>`;
-    } else if (r.handler) {
-      const found = handlers.has(r.handler);
-      desc = found ? `Handler \u2014 <code>${r.handler}()</code>` : `Handler \u2014 <code>${r.handler}()</code> <span style="color:#f85149">(not loaded)</span>`;
-    } else if (r.scenarios?.length) {
-      const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
-      desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
-    } else if (r.response?.body != null && hasTemplates(r.response.body)) {
-      desc = `Dynamic \u2014 <code>{{\u2026}}</code>`;
-    } else {
-      const status = r.response?.status ?? 200;
-      desc = `Static \u2014 <code>${status}</code>${r.response?.headers ? ` + headers` : ""}`;
-    }
-    if (tags.length) desc += `&ensp;${tags.join("&ensp;")}`;
-    return endpointRow(r.method?.toUpperCase() ?? "GET", fullPath, desc);
-  }).join("")}
-    </tbody></table>
-  </details>` : "";
-  const routesByHandler = /* @__PURE__ */ new Map();
-  for (const r of customRoutes) {
-    if (r.handler) {
-      const list = routesByHandler.get(r.handler) ?? [];
-      list.push({ method: (r.method ?? "GET").toUpperCase(), path: `${base}${r.path}` });
-      routesByHandler.set(r.handler, list);
-    }
-  }
-  const handlersAccordion = handlers.size > 0 ? `
-  <details class="resource-card nested-card">
-    <summary>
-      <span class="resource-name">Handlers</span>
-      <span class="route-count">${handlers.size} function${handlers.size !== 1 ? "s" : ""}</span>
-    </summary>
-    <table><tbody>
-      ${[...handlers.keys()].map((name) => {
-    const routes = routesByHandler.get(name);
-    const routeDesc = routes ? routes.map((r) => `<code>${r.method} ${r.path}</code>`).join(", ") : `<span style="color:var(--text-muted)">not referenced in _routes</span>`;
-    return endpointRow("fn", name + "()", routeDesc);
-  }).join("")}
-    </tbody></table>
-  </details>` : "";
   const paginationDesc = options.pageable.enabled ? `Pageable mode active \u2014 default limit <code>${options.pageable.limit}</code>. Response wrapped in <code>{ data, pagination }</code>.` : `Returns the requested slice. <code>X-Total-Count</code> header reflects the total before pagination.`;
   return `<!DOCTYPE html>
 <html lang="en">
@@ -673,10 +777,10 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
     <h2>Endpoints</h2>
     <div class="endpoints-grid">
       ${accordions}
-      ${nestedAccordion}
-      ${snapshotAccordion}
-      ${customRoutesAccordion}
-      ${handlersAccordion}
+      ${nestedRoutesAccordion(relations, base)}
+      ${options.snapshot ? snapshotAccordion() : ""}
+      ${customRoutesAccordion(customRoutes, base, handlers)}
+      ${handlersAccordion(handlers, customRoutes, base)}
     </div>
 
     <h2>Query Parameters</h2>
@@ -767,6 +871,7 @@ function applyOperator(itemValue, op, filterValue) {
     case "_start":
       return strItem.toLowerCase().startsWith(filterValue.toLowerCase());
     case "_regex": {
+      if (filterValue.length > 200) return false;
       try {
         return new RegExp(filterValue, "i").test(strItem);
       } catch {
@@ -882,10 +987,11 @@ function expandItems(input, query, resource, storage) {
   const resourceRelations = storage.getRelations()[resource] ?? {};
   const expansions = /* @__PURE__ */ new Map();
   for (const expandKey of keys) {
-    for (const [field, parentCollection] of Object.entries(resourceRelations)) {
+    for (const [field, def] of Object.entries(resourceRelations)) {
+      if (def.type === "many2many") continue;
       const derivedKey = field.replace(/Id$/i, "");
-      if (derivedKey === expandKey || parentCollection === expandKey || parentCollection === `${expandKey}s`) {
-        expansions.set(expandKey, { field, parentCollection });
+      if (derivedKey === expandKey || def.target === expandKey || def.target === `${expandKey}s`) {
+        expansions.set(expandKey, { field, parentCollection: def.target });
         break;
       }
     }
@@ -914,10 +1020,24 @@ function embedItems(input, query, resource, storage) {
   const relations = storage.getRelations();
   const embeds = /* @__PURE__ */ new Map();
   for (const embedKey of keys) {
+    const ownRelations = relations[resource] ?? {};
+    if (embedKey in ownRelations) {
+      const def = ownRelations[embedKey];
+      if (def.type === "many2many") {
+        embeds.set(embedKey, {
+          kind: "many2many",
+          target: def.target,
+          through: def.through,
+          foreignKey: def.foreignKey,
+          otherKey: def.otherKey
+        });
+        continue;
+      }
+    }
     outer: for (const [childCollection, fields] of Object.entries(relations)) {
-      for (const [fkField, parentCollection] of Object.entries(fields)) {
-        if (parentCollection === resource && childCollection === embedKey) {
-          embeds.set(embedKey, { childCollection, fkField });
+      for (const [fkField, def] of Object.entries(fields)) {
+        if ((def.type === "many2one" || def.type === "one2one") && def.target === resource && childCollection === embedKey) {
+          embeds.set(embedKey, { kind: def.type, childCollection, fkField });
           break outer;
         }
       }
@@ -926,10 +1046,57 @@ function embedItems(input, query, resource, storage) {
   if (embeds.size === 0) return isArray ? items : input;
   const result = items.map((item) => {
     const out = { ...item };
-    for (const [embedKey, { childCollection, fkField }] of embeds) {
-      out[embedKey] = (storage.getCollection(childCollection) ?? []).filter(
-        (child) => String(child[fkField]) === String(item["id"])
-      );
+    for (const [embedKey, spec] of embeds) {
+      if (spec.kind === "many2many") {
+        const pivot = storage.getCollection(spec.through) ?? [];
+        const matchingIds = new Set(
+          pivot.filter((row) => String(row[spec.foreignKey]) === String(item["id"])).map((row) => String(row[spec.otherKey]))
+        );
+        out[embedKey] = (storage.getCollection(spec.target) ?? []).filter(
+          (t) => matchingIds.has(String(t["id"]))
+        );
+      } else if (spec.kind === "one2one") {
+        out[embedKey] = (storage.getCollection(spec.childCollection) ?? []).find(
+          (child) => String(child[spec.fkField]) === String(item["id"])
+        ) ?? null;
+      } else {
+        out[embedKey] = (storage.getCollection(spec.childCollection) ?? []).filter(
+          (child) => String(child[spec.fkField]) === String(item["id"])
+        );
+      }
+    }
+    return out;
+  });
+  return isArray ? result : result[0];
+}
+function applyNested(input, resource, storage) {
+  const isArray = Array.isArray(input);
+  const items = isArray ? input : [input];
+  const resourceRelations = storage.getRelations()[resource] ?? {};
+  const nestedDefs = Object.entries(resourceRelations).filter(([, def]) => def.nested === true);
+  if (nestedDefs.length === 0) return input;
+  const result = items.map((item) => {
+    const out = { ...item };
+    for (const [key, def] of nestedDefs) {
+      if (def.type === "many2many") {
+        const pivot = storage.getCollection(def.through) ?? [];
+        const matchingIds = new Set(
+          pivot.filter((row) => String(row[def.foreignKey]) === String(item["id"])).map((row) => String(row[def.otherKey]))
+        );
+        out[key] = (storage.getCollection(def.target) ?? []).filter(
+          (t) => matchingIds.has(String(t["id"]))
+        );
+      } else {
+        const foreignKeyValue = item[key];
+        if (foreignKeyValue === void 0) continue;
+        const parent = (storage.getCollection(def.target) ?? []).find(
+          (p) => String(p["id"]) === String(foreignKeyValue)
+        );
+        if (parent !== void 0) {
+          const embedKey = key.replace(/Id$/i, "");
+          out[embedKey] = parent;
+        }
+      }
     }
     return out;
   });
@@ -969,7 +1136,12 @@ var CollectionRouteCommand = class {
         const totalPages = Math.ceil(totalItems / limit) || 1;
         const data = projectFields(
           embedItems(
-            expandItems(paginate(sorted, page, limit), req.query, this.resource, this.storage),
+            expandItems(
+              applyNested(paginate(sorted, page, limit), this.resource, this.storage),
+              req.query,
+              this.resource,
+              this.storage
+            ),
             req.query,
             this.resource,
             this.storage
@@ -1001,7 +1173,12 @@ var CollectionRouteCommand = class {
       }
       return projectFields(
         embedItems(
-          expandItems(result, req.query, this.resource, this.storage),
+          expandItems(
+            applyNested(result, this.resource, this.storage),
+            req.query,
+            this.resource,
+            this.storage
+          ),
           req.query,
           this.resource,
           this.storage
@@ -1187,7 +1364,12 @@ var ItemRouteCommand = class {
       const fields = (req.query["_fields"] ?? "").split(",").map((f) => f.trim()).filter(Boolean);
       return projectFields(
         embedItems(
-          expandItems(item, req.query, this.resource, this.storage),
+          expandItems(
+            applyNested(item, this.resource, this.storage),
+            req.query,
+            this.resource,
+            this.storage
+          ),
           req.query,
           this.resource,
           this.storage
@@ -1231,32 +1413,68 @@ var NestedRouteCommand = class {
   relations;
   base;
   register(server) {
-    for (const [child, fields] of Object.entries(this.relations)) {
-      for (const [field, parent] of Object.entries(fields)) {
-        const collectionPath = `${this.base}/${parent}/:id/${child}`;
-        const itemPath = `${this.base}/${parent}/:id/${child}/:childId`;
-        server.get(collectionPath, (req, reply) => {
-          const parentCollection = this.storage.getCollection(parent) ?? [];
-          const parentItem = findById(parentCollection, req.params.id);
-          if (!parentItem) return reply.status(404).send({ error: "Not found" });
-          const children = (this.storage.getCollection(child) ?? []).filter(
-            (item) => String(item[field]) === req.params.id
-          );
-          return children;
-        });
-        server.get(itemPath, (req, reply) => {
-          const parentCollection = this.storage.getCollection(parent) ?? [];
-          const parentItem = findById(parentCollection, req.params.id);
-          if (!parentItem) return reply.status(404).send({ error: "Not found" });
-          const childItem = (this.storage.getCollection(child) ?? []).find(
-            (item) => String(item[field]) === req.params.id && String(item["id"]) === req.params.childId
-          );
-          if (!childItem) return reply.status(404).send({ error: "Not found" });
-          return childItem;
-        });
+    for (const [source, fields] of Object.entries(this.relations)) {
+      for (const [key, def] of Object.entries(fields)) {
+        if (def.type === "many2many") {
+          this.registerMany2Many(server, source, key, def);
+        } else {
+          this.registerFkRelation(server, source, key, def.target, def.type);
+        }
       }
     }
   }
+  registerFkRelation(server, child, fkField, parent, type) {
+    const collectionPath = `${this.base}/${parent}/:id/${child}`;
+    const itemPath = `${this.base}/${parent}/:id/${child}/:childId`;
+    server.get(collectionPath, (req, reply) => {
+      const parentCollection = this.storage.getCollection(parent) ?? [];
+      const parentItem = findById(parentCollection, req.params.id);
+      if (!parentItem) return reply.status(404).send({ error: "Not found" });
+      const all = (this.storage.getCollection(child) ?? []).filter(
+        (item) => String(item[fkField]) === req.params.id
+      );
+      if (type === "one2one") return all[0] ?? reply.status(404).send({ error: "Not found" });
+      return all;
+    });
+    if (type === "many2one") {
+      server.get(itemPath, (req, reply) => {
+        const parentCollection = this.storage.getCollection(parent) ?? [];
+        const parentItem = findById(parentCollection, req.params.id);
+        if (!parentItem) return reply.status(404).send({ error: "Not found" });
+        const childItem = (this.storage.getCollection(child) ?? []).find(
+          (item) => String(item[fkField]) === req.params.id && String(item["id"]) === req.params.childId
+        );
+        if (!childItem) return reply.status(404).send({ error: "Not found" });
+        return childItem;
+      });
+    }
+  }
+  registerMany2Many(server, source, alias, def) {
+    server.get(`${this.base}/${source}/:id/${alias}`, (req, reply) => {
+      const sourceCollection = this.storage.getCollection(source) ?? [];
+      const sourceItem = findById(sourceCollection, req.params.id);
+      if (!sourceItem) return reply.status(404).send({ error: "Not found" });
+      const pivot = this.storage.getCollection(def.through) ?? [];
+      const matchingIds = new Set(
+        pivot.filter((row) => String(row[def.foreignKey]) === req.params.id).map((row) => String(row[def.otherKey]))
+      );
+      return (this.storage.getCollection(def.target) ?? []).filter(
+        (t) => matchingIds.has(String(t["id"]))
+      );
+    });
+    server.get(`${this.base}/${def.target}/:id/${source}`, (req, reply) => {
+      const targetCollection = this.storage.getCollection(def.target) ?? [];
+      const targetItem = findById(targetCollection, req.params.id);
+      if (!targetItem) return reply.status(404).send({ error: "Not found" });
+      const pivot = this.storage.getCollection(def.through) ?? [];
+      const matchingIds = new Set(
+        pivot.filter((row) => String(row[def.otherKey]) === req.params.id).map((row) => String(row[def.foreignKey]))
+      );
+      return (this.storage.getCollection(source) ?? []).filter(
+        (t) => matchingIds.has(String(t["id"]))
+      );
+    });
+  }
 };
 
 // src/router/routes/snapshot.routes.ts
@@ -1419,7 +1637,7 @@ function buildOptions(opts) {
 }
 function createInMemoryStorage(data) {
   const raw = data;
-  const relations = raw["_rel"] ?? {};
+  const relations = parseRelations(raw["_rel"]);
   const routes = Array.isArray(raw["_routes"]) ? raw["_routes"] : [];
   const collections = Object.fromEntries(
     Object.entries(raw).filter(([k]) => k !== "_rel" && k !== "_routes")