@cequrebackends/cequre-ts 0.11.4

package/dist/index.js

@@ -0,0 +1,3152 @@
+// @bun
+import {
+  BaseSqlAdapter,
+  CequreMailer,
+  MemoryCacheStore,
+  MemoryStreamStore,
+  buildCollectionCreateSchema,
+  buildCollectionUpdateSchema,
+  createMailer,
+  createRouteContext,
+  exports_sdk,
+  generateBackendSchemas,
+  generateOpenAPISpec,
+  generateScalarHTML,
+  generateSharedModels,
+  generateTypeScriptClientSDK,
+  init_openapi,
+  init_sdk,
+  parseQuery,
+  sortPlugins,
+  sqlIdentifier,
+  sqlLiteral,
+  validateCreate,
+  validateUpdate
+} from "./index-kyvy0s1x.js";
+import {
+  CequreStreamMedia,
+  methodNotAllowed,
+  notFound,
+  toResponse
+} from "./index-mfqj7cwr.js";
+import {
+  CequreErrorLogs,
+  CequreKV,
+  CequreQueueManager,
+  createLogger,
+  init_kv,
+  init_logger,
+  logger
+} from "./index-rf1kdn5b.js";
+import {
+  CequreError,
+  __require,
+  __toCommonJS,
+  buildErrorResponse,
+  extractPathname,
+  getConstraintErrorMessage,
+  getConstraintErrorStatus,
+  parseConstraintError,
+  toErrorResponse,
+  ulid
+} from "./index-17yswtmg.js";
+
+// shared/main/sse.ts
+var encoder = new TextEncoder;
+function toSSE(payload) {
+  if (typeof payload === "string")
+    return encoder.encode(`data: ${payload}
+
+`);
+  if (payload && typeof payload === "object" && "toSSE" in payload && typeof payload.toSSE === "function") {
+    return encoder.encode(payload.toSSE());
+  }
+  const item = payload;
+  if (item && typeof item === "object" && (("data" in item) || ("event" in item) || ("id" in item) || ("retry" in item))) {
+    const lines = [];
+    if (item.id !== undefined)
+      lines.push(`id: ${item.id}`);
+    if (item.event)
+      lines.push(`event: ${item.event}`);
+    if (item.retry !== undefined)
+      lines.push(`retry: ${item.retry}`);
+    const data = item.data === undefined ? "" : typeof item.data === "string" ? item.data : JSON.stringify(item.data);
+    for (const line of data.split(`
+`))
+      lines.push(`data: ${line}`);
+    return encoder.encode(`${lines.join(`
+`)}
+
+`);
+  }
+  return encoder.encode(`data: ${JSON.stringify(payload)}
+
+`);
+}
+function parseChannels(request) {
+  const url = new URL(request.url);
+  const channels = new Set;
+  for (const channel of url.searchParams.getAll("channel")) {
+    const trimmed = channel.trim();
+    if (trimmed)
+      channels.add(trimmed);
+  }
+  const rawChannels = url.searchParams.get("channels");
+  if (rawChannels) {
+    for (const channel of rawChannels.split(",")) {
+      const trimmed = channel.trim();
+      if (trimmed)
+        channels.add(trimmed);
+    }
+  }
+  return [...channels];
+}
+
+class SSEManager {
+  connections = new Map;
+  channels = new Map;
+  metadata = new Map;
+  register(connection) {
+    this.connections.set(connection.id, connection);
+    this.metadata.set(connection.id, {});
+  }
+  remove(id) {
+    const connection = this.connections.get(id);
+    if (!connection)
+      return;
+    for (const channel of connection.channels)
+      this.unsubscribe(id, channel);
+    this.connections.delete(id);
+    this.metadata.delete(id);
+  }
+  subscribe(id, channel) {
+    const connection = this.connections.get(id);
+    if (!connection)
+      return;
+    if (!this.channels.has(channel))
+      this.channels.set(channel, new Set);
+    this.channels.get(channel).add(id);
+    connection.channels.add(channel);
+  }
+  unsubscribe(id, channel) {
+    this.channels.get(channel)?.delete(id);
+    if (this.channels.get(channel)?.size === 0)
+      this.channels.delete(channel);
+    this.connections.get(id)?.channels.delete(channel);
+  }
+  sendTo(id, payload) {
+    const connection = this.connections.get(id);
+    if (!connection)
+      return false;
+    try {
+      connection.controller.enqueue(toSSE(payload));
+      return true;
+    } catch {
+      this.remove(id);
+      return false;
+    }
+  }
+  broadcastToChannel(channel, payload, { exclude = [] } = {}) {
+    const members = this.channels.get(channel);
+    if (!members)
+      return 0;
+    let sent = 0;
+    for (const id of members) {
+      if (exclude.includes(id))
+        continue;
+      if (this.sendTo(id, payload))
+        sent++;
+    }
+    return sent;
+  }
+  broadcastAll(payload, { exclude = [] } = {}) {
+    let sent = 0;
+    for (const id of this.connections.keys()) {
+      if (exclude.includes(id))
+        continue;
+      if (this.sendTo(id, payload))
+        sent++;
+    }
+    return sent;
+  }
+  setMeta(id, key, value) {
+    const meta = this.metadata.get(id);
+    if (meta)
+      meta[key] = value;
+  }
+  getMeta(id, key) {
+    return this.metadata.get(id)?.[key];
+  }
+  getChannelMembers(channel) {
+    return [...this.channels.get(channel) ?? []];
+  }
+  getConnectionChannels(id) {
+    return [...this.connections.get(id)?.channels ?? []];
+  }
+  listChannels() {
+    return [...this.channels.keys()];
+  }
+  get connectionCount() {
+    return this.connections.size;
+  }
+  get channelCount() {
+    return this.channels.size;
+  }
+  getStats() {
+    return {
+      connections: this.connectionCount,
+      channels: Object.fromEntries([...this.channels.entries()].map(([channel, ids]) => [channel, ids.size]))
+    };
+  }
+}
+var sseManager = new SSEManager;
+function createBunSSERoute({
+  path = "/sse",
+  heartbeat,
+  resolveUser,
+  onConnect,
+  onSubscribe
+} = {}) {
+  return async (request) => {
+    const user = resolveUser ? await resolveUser(request) : null;
+    const channels = parseChannels(request);
+    const id = ulid();
+    const info = { id, request, user };
+    if (onConnect) {
+      const allowed = await onConnect(info);
+      if (allowed !== true) {
+        const message = typeof allowed === "string" ? allowed : user ? "Forbidden" : "Unauthorized";
+        return new Response(JSON.stringify({ message }), {
+          status: user ? 403 : 401,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    }
+    const allowedChannels = [];
+    for (const channel of channels) {
+      if (!onSubscribe || await onSubscribe({ ...info, channel }) === true) {
+        allowedChannels.push(channel);
+      }
+    }
+    let heartbeatTimer = null;
+    const stream = new ReadableStream({
+      start(controller) {
+        const connection = {
+          id,
+          controller,
+          channels: new Set,
+          request,
+          user,
+          connectedAt: Date.now()
+        };
+        sseManager.register(connection);
+        for (const channel of allowedChannels)
+          sseManager.subscribe(id, channel);
+        controller.enqueue(toSSE({ event: "connected", data: { id, channels: allowedChannels, authenticated: !!user } }));
+        if (heartbeat !== false) {
+          heartbeatTimer = setInterval(() => {
+            sseManager.sendTo(id, {
+              event: heartbeat?.event ?? "ping",
+              data: heartbeat?.data ?? { ts: new Date().toISOString() }
+            });
+          }, heartbeat?.interval ?? 30000);
+          if (heartbeatTimer.unref)
+            heartbeatTimer.unref();
+        }
+        request.signal.addEventListener("abort", () => {
+          if (heartbeatTimer)
+            clearInterval(heartbeatTimer);
+          sseManager.remove(id);
+          try {
+            controller.close();
+          } catch {}
+        }, { once: true });
+      },
+      cancel() {
+        if (heartbeatTimer)
+          clearInterval(heartbeatTimer);
+        sseManager.remove(id);
+      }
+    });
+    return new Response(stream, {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      }
+    });
+  };
+}
+
+class CequreSSE {
+  static get manager() {
+    return sseManager;
+  }
+  static route(options = {}) {
+    return createBunSSERoute(options);
+  }
+  static register(connection) {
+    return sseManager.register(connection);
+  }
+  static remove(id) {
+    return sseManager.remove(id);
+  }
+  static subscribe(id, channel) {
+    return sseManager.subscribe(id, channel);
+  }
+  static unsubscribe(id, channel) {
+    return sseManager.unsubscribe(id, channel);
+  }
+  static sendTo(id, payload) {
+    return sseManager.sendTo(id, payload);
+  }
+  static broadcastToChannel(channel, payload, opts) {
+    return sseManager.broadcastToChannel(channel, payload, opts);
+  }
+  static broadcastAll(payload, opts) {
+    return sseManager.broadcastAll(payload, opts);
+  }
+  static setMeta(id, key, value) {
+    return sseManager.setMeta(id, key, value);
+  }
+  static getMeta(id, key) {
+    return sseManager.getMeta(id, key);
+  }
+  static getChannelMembers(channel) {
+    return sseManager.getChannelMembers(channel);
+  }
+  static getConnectionChannels(id) {
+    return sseManager.getConnectionChannels(id);
+  }
+  static listChannels() {
+    return sseManager.listChannels();
+  }
+  static get connectionCount() {
+    return sseManager.connectionCount;
+  }
+  static get channelCount() {
+    return sseManager.channelCount;
+  }
+  static getStats() {
+    return sseManager.getStats();
+  }
+}
+
+// shared/main/access-evaluator.ts
+function evaluateAccessExpression(expr, ctx, action) {
+  if (expr === null) {
+    return null;
+  }
+  if (expr === undefined) {
+    return false;
+  }
+  if (typeof expr !== "object") {
+    return expr;
+  }
+  switch (expr.type) {
+    case "identifier":
+      return resolveIdentifier(expr.name, ctx);
+    case "memberExpression":
+      return resolveMember(expr.path, ctx);
+    case "unaryExpression":
+      return evalUnary(expr, ctx, action);
+    case "binaryExpression":
+      return evalBinary(expr, ctx, action);
+    default:
+      return false;
+  }
+}
+function resolveIdentifier(name, ctx) {
+  switch (name) {
+    case "user":
+      return ctx.user;
+    case "data":
+      return ctx.data;
+    case "id":
+      return ctx.id;
+    case "true":
+      return true;
+    case "false":
+      return false;
+    case "null":
+      return false;
+    default:
+      return false;
+  }
+}
+function resolveMember(path, ctx) {
+  const root = path[0];
+  let val;
+  switch (root) {
+    case "user":
+      val = ctx.user;
+      break;
+    case "data":
+      val = ctx.data;
+      break;
+    case "id":
+      val = ctx.id;
+      break;
+    default:
+      return;
+  }
+  for (let i = 1;i < path.length; i++) {
+    if (val === null || val === undefined)
+      return;
+    val = val[path[i]];
+  }
+  return val;
+}
+function evalUnary(expr, ctx, action) {
+  const inner = evaluateAccessExpression(expr.argument, ctx, action);
+  const boolVal = toBool(inner);
+  return !boolVal;
+}
+function evalBinary(expr, ctx, action) {
+  const { operator, left, right } = expr;
+  if (operator === "&&" || operator === "||") {
+    return evalLogical(operator, left, right, ctx, action);
+  }
+  return evalComparison(operator, left, right, ctx, action);
+}
+function evalLogical(op, leftExpr, rightExpr, ctx, action) {
+  const leftVal = evaluateAccessExpression(leftExpr, ctx, action);
+  const rightVal = evaluateAccessExpression(rightExpr, ctx, action);
+  if (op === "&&") {
+    if (!leftVal || !rightVal)
+      return false;
+    if (leftVal === true && rightVal === true)
+      return true;
+    if (leftVal === true && typeof rightVal === "object")
+      return rightVal;
+    if (typeof leftVal === "object" && rightVal === true)
+      return leftVal;
+    if (typeof leftVal === "object" && typeof rightVal === "object") {
+      return { AND: [leftVal, rightVal] };
+    }
+  }
+  if (op === "||") {
+    if (leftVal === true || rightVal === true)
+      return true;
+    if (typeof leftVal === "object" && typeof rightVal === "object") {
+      return { OR: [leftVal, rightVal] };
+    }
+    if (typeof leftVal === "object" && !rightVal)
+      return leftVal;
+    if (!leftVal && typeof rightVal === "object")
+      return rightVal;
+  }
+  return false;
+}
+function evalComparison(op, leftExpr, rightExpr, ctx, action) {
+  const leftVal = evaluateAccessExpression(leftExpr, ctx, action);
+  const rightVal = evaluateAccessExpression(rightExpr, ctx, action);
+  if (action !== "create" && (op === "==" || op === "!=")) {
+    if (leftExpr && leftExpr.type === "memberExpression" && leftExpr.path && leftExpr.path[0] === "data") {
+      const fieldName = leftExpr.path[1];
+      if (fieldName) {
+        if (rightVal === undefined)
+          return false;
+        const filterOp = op === "==" ? "eq" : "neq";
+        return { [fieldName]: { [filterOp]: rightVal } };
+      }
+    }
+    if (rightExpr && rightExpr.type === "memberExpression" && rightExpr.path && rightExpr.path[0] === "data") {
+      const fieldName = rightExpr.path[1];
+      if (fieldName) {
+        if (leftVal === undefined)
+          return false;
+        const filterOp = op === "==" ? "eq" : "neq";
+        return { [fieldName]: { [filterOp]: leftVal } };
+      }
+    }
+  }
+  const lv = leftVal;
+  const rv = rightVal;
+  switch (op) {
+    case "==":
+      return lv === rv;
+    case "!=":
+      return lv !== rv;
+    case ">":
+      return lv > rv;
+    case ">=":
+      return lv >= rv;
+    case "<":
+      return lv < rv;
+    case "<=":
+      return lv <= rv;
+    default:
+      return false;
+  }
+}
+function toBool(val) {
+  if (typeof val === "boolean")
+    return val;
+  if (val && typeof val === "object")
+    return Object.keys(val).length > 0;
+  return !!val;
+}
+
+// shared/main/router.ts
+import { TypeCompiler } from "@sinclair/typebox/compiler";
+import { Value } from "@sinclair/typebox/value";
+
+// shared/main/aot.ts
+function compileRouteHandler(route, options, ctx) {
+  const needsRequestId = options.requestId?.enabled === true;
+  const needsUser = !!options.resolveUser;
+  const plugins = options.plugins || [];
+  const compileState = {};
+  const compileVars = {
+    request: "request",
+    server: "server",
+    ctx: "ctx",
+    routeCtx: "routeCtx",
+    response: "response",
+    errResponse: "errResponse",
+    error: "error",
+    pluginState: "pluginState"
+  };
+  const runPhase = (phase, extraVars) => {
+    let out = "";
+    const vars = extraVars ? { ...compileVars, ...extraVars } : compileVars;
+    for (const plugin of plugins) {
+      if (plugin.onCompile) {
+        const snippet = plugin.onCompile({ phase, vars, state: compileState });
+        if (snippet)
+          out += snippet + `
+`;
+      }
+    }
+    return out;
+  };
+  const guards = route.options?.beforeHandle ? Array.isArray(route.options.beforeHandle) ? route.options.beforeHandle : [route.options.beforeHandle] : [];
+  const hasResponseHeaders = ctx.hasResponseHeaders === true;
+  const hasState = ctx.hasState === true;
+  const supportsStreaming = route.options?.stream === true;
+  let code = `
+  return function handler(request, server) {
+    const pluginState = {};
+    ${runPhase("request.start")}
+  `;
+  code += `
+    return dispatch(request, server, pluginState);
+  };
+  `;
+  code += `
+  function dispatch(request, server, pluginState) {
+    try {
+  `;
+  if (needsRequestId) {
+    code += `
+      const requestId = ctx.options.monitoring?.requestId?.(request) ?? ctx.ulid();
+      const res = ctx.requestContextStorage.run(requestId, () => runRequest(requestId, request, server, pluginState));
+      if (res instanceof Promise) {
+        return res.catch(err => {
+          const errResponse = ctx.options.onError ? ctx.options.onError(err, request) : ctx.toErrorResponse(err, request, ctx.options.cequre?.adapter);
+          return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(request, undefined))" : "errResponse"};
+        });
+      }
+      return res;
+    `;
+  } else {
+    code += `
+      const res = runRequest(undefined, request, server, pluginState);
+      if (res instanceof Promise) {
+        return res.catch(err => {
+          const errResponse = ctx.options.onError ? ctx.options.onError(err, request) : ctx.toErrorResponse(err, request, ctx.options.cequre?.adapter);
+          return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(request, undefined))" : "errResponse"};
+        });
+      }
+      return res;
+    `;
+  }
+  code += `
+    } catch (error) {
+      const errResponse = ctx.options.onError ? ctx.options.onError(error, request) : ctx.toErrorResponse(error, request, ctx.options.cequre?.adapter);
+      ${runPhase("request.error")}
+      return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(request, undefined))" : "errResponse"};
+    }
+  }
+  `;
+  code += `
+  function runRequest(requestId, request, server, pluginState) {
+    const requestHeaders = requestId ? { "X-Request-ID": requestId } : undefined;
+    const handlerRequest = requestId
+      ? new Request(request, { headers: new Headers([...request.headers, ["X-Request-ID", requestId]]) })
+      : request;
+  `;
+  if (hasState) {
+    code += `
+      const state = ctx.resolveState(server);
+    `;
+  } else {
+    code += `
+      const state = undefined;
+    `;
+  }
+  code += `
+      function executePluginsAndProcess(user, state) {
+  `;
+  if (plugins.length > 0) {
+    code += `
+        const pluginCtx = { request: handlerRequest, user, cequre: ctx.options.cequre, state };
+    `;
+    code += `
+        function runPlugin(index) {
+          if (index >= ${plugins.length}) return processRoute(pluginCtx.user !== undefined ? pluginCtx.user : user, pluginCtx.state !== undefined ? pluginCtx.state : state);
+          const plugin = ctx.options.plugins[index];
+          if (plugin.beforeRequest) {
+            try {
+              const res = plugin.beforeRequest(pluginCtx);
+              if (res instanceof Promise) {
+                return res.then(() => runPlugin(index + 1)).catch((err) => {
+                  const errResponse = ctx.options.onError ? ctx.options.onError(err, handlerRequest) : ctx.toErrorResponse(err, handlerRequest, ctx.options.cequre?.adapter);
+                  return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(handlerRequest, requestHeaders))" : "errResponse"};
+                });
+              }
+            } catch (err) {
+              const errResponse = ctx.options.onError ? ctx.options.onError(err, handlerRequest) : ctx.toErrorResponse(err, handlerRequest, ctx.options.cequre?.adapter);
+              return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(handlerRequest, requestHeaders))" : "errResponse"};
+            }
+          }
+          return runPlugin(index + 1);
+        }
+        return runPlugin(0);
+    `;
+  } else {
+    code += `        return processRoute(user, state);
+`;
+  }
+  code += `
+      }
+  `;
+  if (needsUser) {
+    code += `
+      const userResult = ctx.options.resolveUser(handlerRequest);
+      if (userResult instanceof Promise) {
+        return userResult.then((user) => executePluginsAndProcess(user, state));
+      }
+      return executePluginsAndProcess(userResult, state);
+    `;
+  } else {
+    code += `      return executePluginsAndProcess(null, state);
+`;
+  }
+  code += `
+    function processRoute(user, state) {
+  `;
+  if (route.shouldReadBody) {
+    code += `
+      const rawBodyResult = ctx.readBody(handlerRequest, ctx.options.maxBodyBytes);
+      if (rawBodyResult instanceof Promise) {
+        return rawBodyResult.then((rawBody) => {
+          const body = ctx.route.bodyCoercer ? ctx.route.bodyCoercer(rawBody) : rawBody;
+          return runHandler(user, state, body);
+        });
+      }
+      const body = ctx.route.bodyCoercer ? ctx.route.bodyCoercer(rawBodyResult) : rawBodyResult;
+      return runHandler(user, state, body);
+    `;
+  } else {
+    code += `      return runHandler(user, state, undefined);
+`;
+  }
+  code += `    }
+`;
+  code += `
+    function runHandler(user, state, body) {
+  `;
+  if (supportsStreaming) {
+    code += `
+      let resolveStream;
+      const streamPromise = new Promise((resolve) => { resolveStream = resolve; });
+    `;
+  }
+  code += `
+      const routeCtx = ctx.createRouteContext(ctx.route, handlerRequest, request.params ?? ctx.EMPTY_PARAMS, state, user, body, ctx.options.cequre);
+  `;
+  if (supportsStreaming) {
+    code += `
+      routeCtx._streamResolver = resolveStream;
+    `;
+  }
+  code += `
+      let handlerResult;
+      try {
+        ${runPhase("beforeHandler")}
+  `;
+  if (guards.length > 0) {
+    code += `
+        const rawGuards = ctx.route.options.beforeHandle;
+        const guards = Array.isArray(rawGuards) ? rawGuards : [rawGuards];
+        function executeGuards(index) {
+          if (index >= guards.length) return ctx.route.handler(routeCtx);
+          const guardResult = guards[index](routeCtx);
+          if (guardResult instanceof Promise) {
+            return guardResult.then((res) => {
+              if (res !== undefined) return res;
+              return executeGuards(index + 1);
+            });
+          }
+          if (guardResult !== undefined) return guardResult;
+          return executeGuards(index + 1);
+        }
+        handlerResult = executeGuards(0);
+    `;
+  } else {
+    code += `        handlerResult = ctx.route.handler(routeCtx);
+`;
+  }
+  code += `
+      } catch (syncErr) {
+        const errResponse = ctx.options.onError ? ctx.options.onError(syncErr, handlerRequest) : ctx.toErrorResponse(syncErr, handlerRequest, ctx.options.cequre?.adapter);
+        ${runPhase("request.error", { error: "syncErr" })}
+        return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(handlerRequest, requestHeaders))" : "errResponse"};
+      }
+  `;
+  code += `
+      if (handlerResult instanceof Promise) {
+        const finalPromise = handlerResult.then((res) => {
+  `;
+  if (supportsStreaming) {
+    code += `
+          if (routeCtx._streamInitiated) {
+            if (routeCtx._streamWriter) routeCtx._streamWriter.close().catch(()=>{});
+            return streamPromise;
+          }
+    `;
+  }
+  code += `
+          return finish(res, user);
+        }).catch((asyncErr) => {
+  `;
+  if (supportsStreaming) {
+    code += `
+          if (routeCtx._streamInitiated) {
+            if (routeCtx._streamWriter) routeCtx._streamWriter.close().catch(()=>{});
+            return undefined;
+          }
+    `;
+  }
+  code += `
+          const errResponse = ctx.options.onError ? ctx.options.onError(asyncErr, handlerRequest) : ctx.toErrorResponse(asyncErr, handlerRequest, ctx.options.cequre?.adapter);
+          ${runPhase("request.error", { error: "asyncErr" })}
+          return ${hasResponseHeaders ? "ctx.withHeaders(errResponse, ctx.requestResponseHeaders(handlerRequest, requestHeaders))" : "errResponse"};
+        });
+  `;
+  code += `
+        const timeoutMs = ctx.options.cequre?.schema?.core?.api?.requestTimeoutMs;
+        let finalExecutionPromise = ${supportsStreaming ? "Promise.race([streamPromise, finalPromise])" : "finalPromise"};
+        if (timeoutMs) {
+          let timeoutHandle;
+          const timeoutPromise = new Promise((_, reject) => {
+            timeoutHandle = setTimeout(() => reject(new ctx.CequreError("Request Timeout", "TIMEOUT", 408)), timeoutMs);
+          });
+          finalExecutionPromise = Promise.race([
+            finalExecutionPromise.finally(() => clearTimeout(timeoutHandle)),
+            timeoutPromise
+          ]);
+        }
+        return finalExecutionPromise;
+  `;
+  code += `      }
+`;
+  if (supportsStreaming) {
+    code += `
+      if (routeCtx._streamInitiated) {
+        if (routeCtx._streamWriter) routeCtx._streamWriter.close().catch(()=>{});
+        return streamPromise;
+      }
+    `;
+  }
+  code += `
+      return finish(handlerResult, user);
+    }
+  `;
+  code += `
+    function finish(resolvedResult, user) {
+      const response = ctx.toResponse(resolvedResult);
+      ${runPhase("request.completed")}
+  `;
+  if (hasResponseHeaders) {
+    code += `      const finalResponse = ctx.withHeaders(response, ctx.requestResponseHeaders(handlerRequest, requestHeaders));
+`;
+  } else {
+    code += `      const finalResponse = response;
+`;
+  }
+  code += `      ${runPhase("afterHandler", { response: "finalResponse" })}
+`;
+  if (plugins.length > 0) {
+    code += `
+      const pluginCtx = { request: handlerRequest, user, cequre: ctx.options.cequre, state: null };
+      function runAfterPlugin(index) {
+        if (index >= ${plugins.length}) return finalResponse;
+        const plugin = ctx.options.plugins[index];
+        if (plugin.afterRequest) {
+          try {
+            const afterRes = plugin.afterRequest(pluginCtx, finalResponse);
+            if (afterRes instanceof Promise) {
+              return afterRes.then(() => runAfterPlugin(index + 1)).catch(() => runAfterPlugin(index + 1));
+            }
+          } catch (err) { console.error("AOT AFTERREQUEST ERR:", err); }
+        }
+        return runAfterPlugin(index + 1);
+      }
+      return runAfterPlugin(0);
+    `;
+  } else {
+    code += `      return finalResponse;
+`;
+  }
+  code += `    }
+`;
+  code += `
+  }
+  `;
+  return new Function("ctx", code)(ctx);
+}
+
+// shared/main/router.ts
+var BODY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var EMPTY_PARAMS = Object.freeze({});
+var EMPTY_QUERY = Object.freeze({});
+function normalizePath(path) {
+  if (!path)
+    return "/";
+  const prefixed = path.startsWith("/") ? path : `/${path}`;
+  if (prefixed.length === 1)
+    return prefixed;
+  return prefixed.replace(/\/+$/, "");
+}
+function splitPath(path) {
+  const normalized = normalizePath(path);
+  if (normalized === "/")
+    return [];
+  return normalized.slice(1).split("/");
+}
+function matchPath(route, pathname) {
+  const requestSegments = splitPath(pathname);
+  if (route.segments.length !== requestSegments.length)
+    return null;
+  const params = {};
+  for (let i = 0;i < route.segments.length; i++) {
+    const expected = route.segments[i];
+    const actual = requestSegments[i];
+    if (expected === undefined || actual === undefined)
+      return null;
+    if (expected.startsWith(":")) {
+      params[expected.slice(1)] = decodeURIComponent(actual);
+      continue;
+    }
+    if (expected !== actual)
+      return null;
+  }
+  return params;
+}
+function parseQueryString(url) {
+  const queryStart = url.indexOf("?");
+  if (queryStart === -1)
+    return EMPTY_QUERY;
+  const hashStart = url.indexOf("#", queryStart + 1);
+  const queryEnd = hashStart === -1 ? url.length : hashStart;
+  if (queryEnd <= queryStart + 1)
+    return {};
+  const query = {};
+  let pairStart = queryStart + 1;
+  while (pairStart < queryEnd) {
+    const ampersand = url.indexOf("&", pairStart);
+    const pairEnd = ampersand === -1 || ampersand > queryEnd ? queryEnd : ampersand;
+    if (pairEnd === pairStart) {
+      pairStart = pairEnd + 1;
+      continue;
+    }
+    const separator = url.indexOf("=", pairStart);
+    const valueStart = separator === -1 || separator > pairEnd ? pairEnd : separator + 1;
+    const rawKey = separator === -1 || separator > pairEnd ? url.slice(pairStart, pairEnd) : url.slice(pairStart, separator);
+    const rawValue = valueStart === pairEnd ? "" : url.slice(valueStart, pairEnd);
+    const key = decodeQueryPart(rawKey);
+    const value = decodeQueryPart(rawValue);
+    const existing = query[key];
+    if (existing === undefined) {
+      query[key] = value;
+    } else if (Array.isArray(existing)) {
+      existing.push(value);
+    } else {
+      query[key] = [existing, value];
+    }
+    pairStart = pairEnd + 1;
+  }
+  return query;
+}
+function decodeQueryPart(value) {
+  if (!value.includes("+") && !value.includes("%"))
+    return value;
+  try {
+    return decodeURIComponent(value.replace(/\+/g, " "));
+  } catch {
+    return value;
+  }
+}
+function createFastObjectConverter(schema) {
+  if (schema.type !== "object")
+    return;
+  const properties = schema.properties;
+  if (!properties)
+    return;
+  const converters = [];
+  for (const [key, property] of Object.entries(properties)) {
+    if (property.type === "string") {
+      converters.push([key, (value) => typeof value === "string" || Array.isArray(value) ? value : String(value)]);
+      continue;
+    }
+    if (property.type === "number") {
+      converters.push([
+        key,
+        (value) => {
+          if (typeof value !== "string")
+            return value;
+          if (!/^[+-]?(?:(?:\d+\.?\d*)|(?:\.\d+))(?:e[+-]?\d+)?$/i.test(value))
+            return value;
+          return Number(value);
+        }
+      ]);
+      continue;
+    }
+    if (property.type === "boolean") {
+      converters.push([
+        key,
+        (value) => {
+          if (value === "true" || value === "1")
+            return true;
+          if (value === "false" || value === "0")
+            return false;
+          return value;
+        }
+      ]);
+      continue;
+    }
+    return;
+  }
+  return (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return value;
+    const converted = { ...value };
+    for (const [key, convert] of converters) {
+      if (key in converted)
+        converted[key] = convert(converted[key]);
+    }
+    return converted;
+  };
+}
+function createSchemaCoercer(schema, label) {
+  if (!schema)
+    return;
+  const check = TypeCompiler.Compile(schema);
+  const fastConvert = createFastObjectConverter(schema);
+  return (value) => {
+    if (check.Check(value))
+      return value;
+    const converted = fastConvert?.(value) ?? Value.Convert(schema, value);
+    if (check.Check(converted))
+      return converted;
+    const firstError = check.Errors(converted).First();
+    const path = firstError?.path ? ` at ${firstError.path}` : "";
+    throw CequreError.BadRequest(`${label} does not match route schema${path}`);
+  };
+}
+function resolveCorsHeaders(origin, cors) {
+  if (!cors || !origin)
+    return;
+  const allowed = cors.origin;
+  const allowAny = allowed === "*" || Array.isArray(allowed) && allowed.includes("*");
+  const allowedOrigins = Array.isArray(allowed) ? allowed : [allowed];
+  const allowOrigin = allowAny ? origin : allowedOrigins.includes(origin) ? origin : undefined;
+  if (!allowOrigin)
+    return;
+  return {
+    "Access-Control-Allow-Origin": allowOrigin,
+    ...cors.credentials ? { "Access-Control-Allow-Credentials": "true" } : {},
+    Vary: "Origin"
+  };
+}
+function createCorsPreflightResponse(request, cors, methods, baseHeaders) {
+  const corsHeaders = resolveCorsHeaders(request.headers.get("origin"), cors);
+  if (!corsHeaders)
+    return new Response(null, { status: 403, headers: baseHeaders });
+  const requestedHeaders = request.headers.get("access-control-request-headers");
+  return new Response(null, {
+    status: 204,
+    headers: {
+      ...baseHeaders,
+      ...corsHeaders,
+      "Access-Control-Allow-Methods": [...new Set([...methods, "OPTIONS"])].sort().join(", "),
+      "Access-Control-Allow-Headers": requestedHeaders || "Content-Type, Authorization, X-API-Key, X-CEQURE-CSRF, X-CSRF-Token, X-Requested-With",
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+function readBody(request, maxBodyBytes) {
+  if (!request.body)
+    return;
+  if (maxBodyBytes && maxBodyBytes > 0) {
+    const contentLength = parseInt(request.headers.get("content-length") ?? "0", 10);
+    if (contentLength > maxBodyBytes) {
+      throw CequreError.BadRequest("Request body too large");
+    }
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    try {
+      return request.json();
+    } catch {
+      throw CequreError.BadRequest("Invalid JSON body");
+    }
+  }
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return request.formData().then((formData) => {
+      const entries = {};
+      for (const [key, value] of formData) {
+        const existing = entries[key];
+        if (existing === undefined)
+          entries[key] = value;
+        else if (Array.isArray(existing))
+          existing.push(value);
+        else
+          entries[key] = [existing, value];
+      }
+      return entries;
+    });
+  }
+  return request.text();
+}
+function createRouteContext2(route, request, params, state, user, body, cequre) {
+  let url;
+  let parsedQuery;
+  let query;
+  if (route.queryCoercer) {
+    parsedQuery = parseQueryString(request.url);
+    query = route.queryCoercer(parsedQuery);
+  }
+  return {
+    request,
+    get url() {
+      return url ??= new URL(request.url);
+    },
+    params: route.paramsCoercer?.(params) ?? params,
+    get query() {
+      if (query !== undefined)
+        return query;
+      if (parsedQuery === undefined)
+        parsedQuery = parseQueryString(request.url);
+      query = parsedQuery;
+      return query;
+    },
+    body,
+    cequre,
+    user,
+    state,
+    async stream(chunk, options) {
+      if (!this._streamInitiated) {
+        this._streamInitiated = true;
+        const { readable, writable } = new TransformStream;
+        this._streamWriter = writable.getWriter();
+        if (this._streamResolver) {
+          const headers = new Headers;
+          if (options?.event) {
+            headers.set("Content-Type", "text/event-stream");
+            headers.set("Cache-Control", "no-cache");
+            headers.set("Connection", "keep-alive");
+          } else {
+            headers.set("Content-Type", "text/plain");
+          }
+          this._streamResolver(new Response(readable, { headers }));
+        }
+      }
+      if (!this._streamWriter)
+        return;
+      const encoder2 = new TextEncoder;
+      let data = chunk;
+      if (options?.event) {
+        if (typeof data !== "string" && !(data instanceof Uint8Array)) {
+          data = JSON.stringify(data);
+        }
+        data = `event: ${options.event}
+data: ${data}
+
+`;
+      } else if (typeof data !== "string" && !(data instanceof Uint8Array)) {
+        data = JSON.stringify(data) + `
+`;
+      }
+      if (typeof data === "string") {
+        data = encoder2.encode(data);
+      }
+      if (this.request.signal.aborted) {
+        throw new Error("ClientDisconnected: stream aborted by client");
+      }
+      try {
+        await this._streamWriter.write(data);
+      } catch (err) {
+        throw new Error("ClientDisconnected: stream write failed");
+      }
+      if (options?.delay) {
+        await new Promise((r) => setTimeout(r, options.delay));
+      }
+    }
+  };
+}
+
+class CequreRouter {
+  routes = [];
+  prefix;
+  constructor(prefix = "") {
+    this.prefix = prefix || "";
+  }
+  applyPrefix(path, options) {
+    if (options?.ignorePrefix)
+      return path;
+    if (!this.prefix)
+      return path;
+    const normalized = normalizePath(path);
+    if (normalized === "/")
+      return normalized;
+    if (normalized === this.prefix)
+      return normalized;
+    if (normalized.startsWith(this.prefix + "/"))
+      return normalized;
+    return `${this.prefix}${normalized}`;
+  }
+  matchRoute(method, pathname) {
+    for (const route of this.routes) {
+      if (route.method !== "ALL" && route.method !== method.toUpperCase())
+        continue;
+      const params = matchPath(route, pathname);
+      if (params !== null) {
+        return route;
+      }
+    }
+    return;
+  }
+  add(method, path, handler, options) {
+    const normalizedPath = this.applyPrefix(path, options);
+    this.routes.push({
+      method: method.toUpperCase(),
+      path: normalizedPath,
+      segments: splitPath(normalizedPath),
+      handler,
+      options,
+      bodyCoercer: createSchemaCoercer(options?.body, "Body"),
+      queryCoercer: createSchemaCoercer(options?.query, "Query"),
+      paramsCoercer: createSchemaCoercer(options?.params, "Params"),
+      shouldReadBody: Boolean(options?.body && BODY_METHODS.has(method.toUpperCase()))
+    });
+    return this;
+  }
+  get(path, handler, options) {
+    return this.add("GET", path, handler, options);
+  }
+  post(path, handler, options) {
+    return this.add("POST", path, handler, options);
+  }
+  put(path, handler, options) {
+    return this.add("PUT", path, handler, options);
+  }
+  patch(path, handler, options) {
+    return this.add("PATCH", path, handler, options);
+  }
+  delete(path, handler, options) {
+    return this.add("DELETE", path, handler, options);
+  }
+  all(path, handler, options) {
+    return this.add("ALL", path, handler, options);
+  }
+  list() {
+    return this.routes.map(({ method, path, handler, options }) => ({ method, path, handler, options }));
+  }
+  use(routes) {
+    if (!routes)
+      return this;
+    const routeList = routes instanceof CequreRouter ? routes.list() : routes;
+    for (const route of routeList) {
+      this.add(route.method, route.path, route.handler, route.options);
+    }
+    return this;
+  }
+  toNativeRoutes(options = {}) {
+    const nativeRoutes = {};
+    const grouped = new Map;
+    const headers = Object.entries(options.headers ?? {});
+    const hasMonitoring = options.monitoring?.hasHandlers?.() === true;
+    const shouldResolveUser = options.resolveUser !== undefined;
+    const maxBodyBytes = options.maxBodyBytes;
+    const withHeaders = (response, extraHeaders) => {
+      if (!response)
+        return response;
+      if (headers.length === 0 && !extraHeaders)
+        return response;
+      if (headers.length > 0) {
+        for (let i = 0;i < headers.length; i++) {
+          const header = headers[i];
+          if (!header)
+            continue;
+          const [key, value] = header;
+          if (!response.headers.has(key))
+            response.headers.set(key, value);
+        }
+      }
+      if (extraHeaders) {
+        for (const key in extraHeaders) {
+          const val = extraHeaders[key];
+          if (val !== undefined && !response.headers.has(key))
+            response.headers.set(key, val);
+        }
+      }
+      return response;
+    };
+    const requestResponseHeaders = options.cors ? (request, routeHeaders) => {
+      const origin = request.headers.get("origin");
+      const corsHeaders = origin ? resolveCorsHeaders(origin, options.cors) : undefined;
+      return corsHeaders ? { ...corsHeaders, ...routeHeaders } : routeHeaders;
+    } : (_request, routeHeaders) => routeHeaders;
+    const stateCache = new WeakMap;
+    let undefinedServerState;
+    let hasUndefinedServerState = false;
+    const resolveState = typeof options.state === "function" ? (server) => {
+      if (!server) {
+        if (!hasUndefinedServerState) {
+          undefinedServerState = options.state(server);
+          hasUndefinedServerState = true;
+        }
+        return undefinedServerState;
+      }
+      const cached = stateCache.get(server);
+      if (cached !== undefined)
+        return cached;
+      const state = options.state(server);
+      stateCache.set(server, state);
+      return state;
+    } : () => options.state;
+    for (const route of this.routes) {
+      const routes = grouped.get(route.path) ?? [];
+      routes.push(route);
+      grouped.set(route.path, routes);
+    }
+    const createHandler = (route) => {
+      const ctx = {
+        route,
+        options,
+        performance: globalThis.performance,
+        extractPathname,
+        ulid,
+        withHeaders,
+        requestResponseHeaders,
+        requestContextStorage,
+        CequreError,
+        toErrorResponse,
+        toResponse,
+        readBody,
+        createRouteContext: createRouteContext2,
+        EMPTY_PARAMS,
+        resolveState,
+        hasResponseHeaders: headers.length > 0 || !!options.cors,
+        hasState: typeof options.state === "function"
+      };
+      return compileRouteHandler(route, options, ctx);
+    };
+    for (const [path, routes] of grouped) {
+      const allRoute = routes.find((route) => route.method === "ALL");
+      if (allRoute) {
+        nativeRoutes[path] = createHandler(allRoute);
+        continue;
+      }
+      const methods = routes.map((route) => route.method);
+      nativeRoutes[path] = Object.fromEntries([...routes].reverse().map((route) => [route.method, createHandler(route)]));
+      if (options.cors && typeof nativeRoutes[path] === "object" && nativeRoutes[path] !== null) {
+        nativeRoutes[path].OPTIONS = (request) => createCorsPreflightResponse(request, options.cors, methods, Object.fromEntries(headers));
+      }
+    }
+    return nativeRoutes;
+  }
+  async handle(request, state, user = null, cequre) {
+    const url = new URL(request.url);
+    const method = request.method.toUpperCase();
+    const allowedMethods = new Set;
+    for (const route of this.routes) {
+      const params = matchPath(route, url.pathname);
+      if (!params)
+        continue;
+      if (route.method !== method && route.method !== "ALL") {
+        allowedMethods.add(route.method);
+        continue;
+      }
+      const body = route.shouldReadBody ? route.bodyCoercer?.(await readBody(request, cequre?.schema?.core?.api?.maxBodyBytes)) : undefined;
+      const context = createRouteContext2(route, request, params, state, user, body, cequre);
+      let resolveStream;
+      const streamPromise = new Promise((resolve) => {
+        resolveStream = resolve;
+      });
+      context._streamResolver = resolveStream;
+      let handlerResult;
+      try {
+        handlerResult = route.handler(context);
+      } catch (syncErr) {
+        throw syncErr;
+      }
+      if (handlerResult instanceof Promise) {
+        return Promise.race([
+          streamPromise,
+          handlerResult.then((res) => {
+            if (context._streamInitiated) {
+              context._streamWriter?.close();
+              return streamPromise;
+            }
+            return toResponse(res);
+          })
+        ]);
+      }
+      if (context._streamInitiated) {
+        context._streamWriter?.close();
+        return streamPromise;
+      }
+      return toResponse(handlerResult);
+    }
+    if (allowedMethods.size > 0) {
+      return methodNotAllowed([...allowedMethods].sort());
+    }
+    return notFound();
+  }
+}
+function createRouter() {
+  return new CequreRouter;
+}
+
+// shared/main/population.ts
+async function populateDocuments(schema, collectionSlug, docs, adapter, depth) {
+  let currentDepth = depth;
+  if (currentDepth > 2)
+    currentDepth = 2;
+  if (currentDepth <= 0 || !docs || docs.length === 0) {
+    return docs;
+  }
+  const collection = (schema.collections || []).concat(schema.globals || []).find((c) => c.slug === collectionSlug);
+  if (!collection)
+    return docs;
+  const relationFields = collection.fields.filter((f) => (f.type === "relation" || f.type === "relationship" || f.type === "link") && f.target);
+  if (relationFields.length === 0)
+    return docs;
+  const hydratedDocs = JSON.parse(JSON.stringify(docs));
+  for (const field of relationFields) {
+    const targetCollection = field.target;
+    const fieldName = field.name;
+    const isArray = !!field.isArray;
+    const isVirtualLink = field.type === "link";
+    const onField = field.on;
+    if (isVirtualLink && onField) {
+      const sourceIds = hydratedDocs.map((doc) => doc.id).filter(Boolean);
+      if (sourceIds.length === 0)
+        continue;
+      let relatedRecords = [];
+      try {
+        const result = await adapter.find(targetCollection, {
+          where: { [onField]: { in: sourceIds } },
+          limit: isArray ? 1000 : sourceIds.length
+        });
+        relatedRecords = result.docs;
+      } catch (e) {
+        console.error("VIRTUAL LINK FETCH ERROR:", e);
+        continue;
+      }
+      let fullyPopulatedRelatedRecords = relatedRecords;
+      if (currentDepth > 1) {
+        fullyPopulatedRelatedRecords = await populateDocuments(schema, targetCollection, relatedRecords, adapter, currentDepth - 1);
+      }
+      const relatedMap = new Map;
+      for (const record of fullyPopulatedRelatedRecords) {
+        const sourceId = typeof record[onField] === "string" ? record[onField] : record[onField]?.id;
+        if (sourceId) {
+          if (!relatedMap.has(sourceId))
+            relatedMap.set(sourceId, []);
+          relatedMap.get(sourceId).push(record);
+        }
+      }
+      for (const doc of hydratedDocs) {
+        if (!doc.id)
+          continue;
+        const matches = relatedMap.get(doc.id) || [];
+        if (isArray) {
+          doc[fieldName] = matches;
+        } else {
+          doc[fieldName] = matches.length > 0 ? matches[0] : null;
+        }
+      }
+    } else {
+      const uniqueIds = new Set;
+      for (const doc of hydratedDocs) {
+        const val = doc[fieldName];
+        if (val) {
+          if (isArray && Array.isArray(val)) {
+            for (const id of val) {
+              if (typeof id === "string")
+                uniqueIds.add(id);
+              else if (id && typeof id === "object" && typeof id.id === "string")
+                uniqueIds.add(id.id);
+            }
+          } else {
+            if (typeof val === "string")
+              uniqueIds.add(val);
+            else if (typeof val === "object" && typeof val.id === "string")
+              uniqueIds.add(val.id);
+          }
+        }
+      }
+      if (uniqueIds.size === 0)
+        continue;
+      const targetIds = Array.from(uniqueIds);
+      let relatedRecords = [];
+      try {
+        const result = await adapter.find(targetCollection, {
+          where: { id: { in: targetIds } },
+          limit: targetIds.length
+        });
+        relatedRecords = result.docs;
+      } catch (e) {
+        continue;
+      }
+      let fullyPopulatedRelatedRecords = relatedRecords;
+      if (currentDepth > 1) {
+        fullyPopulatedRelatedRecords = await populateDocuments(schema, targetCollection, relatedRecords, adapter, currentDepth - 1);
+      }
+      const relatedMap = new Map;
+      for (const record of fullyPopulatedRelatedRecords) {
+        relatedMap.set(record.id, record);
+      }
+      for (const doc of hydratedDocs) {
+        const val = doc[fieldName];
+        if (val) {
+          if (isArray && Array.isArray(val)) {
+            doc[fieldName] = val.map((id) => {
+              const rawId = typeof id === "string" ? id : id.id;
+              const hydrated = relatedMap.get(rawId);
+              return hydrated ? hydrated : id;
+            });
+          } else {
+            const rawId = typeof val === "string" ? val : val.id;
+            const hydrated = relatedMap.get(rawId);
+            if (hydrated) {
+              doc[fieldName] = hydrated;
+            }
+          }
+        }
+      }
+    }
+  }
+  return hydratedDocs;
+}
+
+// shared/main/runtime.ts
+init_openapi();
+init_kv();
+import { RateLimiter } from "@cequrebackends/cequre-plugin-security";
+init_logger();
+import path from "path";
+import { AsyncLocalStorage } from "async_hooks";
+import { computeAuditHmac, verifyAuditChain } from "@cequrebackends/cequre-plugin-security";
+import { encryptField, decryptField, isEncrypted } from "@cequrebackends/cequre-plugin-security";
+
+// shared/utils/crypto.ts
+async function sha256Hex(input) {
+  const data = new TextEncoder().encode(input);
+  const buf = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(buf)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+// shared/utils/durable-queue.ts
+init_logger();
+
+class CequreDurableQueue {
+  adapter;
+  storage;
+  intervalId;
+  constructor(adapter, storage) {
+    this.adapter = adapter;
+    this.storage = storage;
+  }
+  async enqueue(task, payload) {
+    try {
+      await this.adapter.create("cequre_jobs", {
+        task,
+        payload,
+        status: "pending",
+        retries: 0
+      });
+    } catch (e) {
+      logger.error(e, "[CequreQueue] Failed to enqueue task:");
+    }
+  }
+  startWorker(intervalMs = 60000) {
+    if (this.intervalId)
+      return;
+    this.intervalId = setInterval(async () => {
+      try {
+        await this.processNextBatch();
+      } catch (e) {
+        logger.error(e, "[CequreQueue] Worker error:");
+      }
+    }, intervalMs);
+  }
+  stopWorker() {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+      this.intervalId = undefined;
+    }
+  }
+  async processNextBatch() {
+    let result;
+    try {
+      result = await this.adapter.find("cequre_jobs", {
+        where: { status: "pending" },
+        limit: 10
+      });
+    } catch (e) {
+      return;
+    }
+    const jobs = result?.docs;
+    if (!jobs || jobs.length === 0)
+      return;
+    for (const job of jobs) {
+      try {
+        if (job.task === "DELETE_FILE" && this.storage) {
+          const payload = typeof job.payload === "string" ? JSON.parse(job.payload) : job.payload;
+          if (payload && payload.filename) {
+            await this.storage.deleteFile(payload.filename);
+          }
+        }
+        await this.adapter.delete("cequre_jobs", job.id);
+      } catch (e) {
+        try {
+          const retries = (job.retries || 0) + 1;
+          const status = retries > 3 ? "failed" : "pending";
+          await this.adapter.update("cequre_jobs", job.id, {
+            retries,
+            status,
+            error: String(e instanceof Error ? e.message : e)
+          });
+        } catch (updateError) {
+          logger.error(updateError, "[CequreQueue] Failed to update job status:");
+        }
+      }
+    }
+  }
+}
+
+// shared/main/runtime.ts
+var log = createLogger("runtime");
+var requestContextStorage = new AsyncLocalStorage;
+class MemoryCronProvider {
+  jobs = new Map;
+  async registerJob(name, cronExpression, handler) {
+    if (this.jobs.has(name))
+      throw new Error(`Cron job ${name} already registered`);
+    this.jobs.set(name, { interval: setInterval(handler, 60000) });
+  }
+  stop(name) {
+    const job = this.jobs.get(name);
+    if (!job)
+      return false;
+    clearInterval(job.interval);
+    this.jobs.delete(name);
+    return true;
+  }
+  async list() {
+    return Array.from(this.jobs.keys());
+  }
+  stopAll() {
+    for (const name of this.jobs.keys())
+      this.stop(name);
+  }
+  startAll() {}
+}
+
+class CequreRuntime {
+  schema;
+  adapter;
+  router;
+  rateLimiter;
+  storage;
+  cache;
+  queue;
+  plugins;
+  mailer;
+  streamStore;
+  serverProvider;
+  cronManager;
+  realtimeProvider;
+  monitoring;
+  auditEnabled = false;
+  auditKeyPromise;
+  auditRetentionTimer;
+  encryptionKeyPromise;
+  authEngine;
+  isTransaction = false;
+  inFlightRequests = 0;
+  shuttingDown = false;
+  idempotencyKV;
+  lockoutKV;
+  hooksMap = new Map;
+  _access = new Map;
+  _cacheKeyRegistry = new Map;
+  setAuthEngine(engine) {
+    this.authEngine = engine;
+  }
+  enableAudit(keyPromise, retentionDays) {
+    this.auditEnabled = true;
+    this.auditKeyPromise = keyPromise;
+    if (retentionDays && retentionDays > 0) {
+      this.auditRetentionTimer = setInterval(() => this.purgeOldAuditEntries(retentionDays).catch((err) => {
+        log.warn({ err }, "Audit retention cleanup failed");
+      }), 24 * 60 * 60 * 1000);
+      this.auditRetentionTimer.unref();
+    }
+  }
+  enableEncryption(keyPromise) {
+    this.encryptionKeyPromise = keyPromise;
+  }
+  setMonitoring(api) {
+    this.monitoring = api;
+  }
+  constructor(schema, config) {
+    this.schema = this.resolveEnvVariables(schema);
+    this.adapter = config.adapter;
+    const prefix = this.schema.core?.api?.prefix || "/api";
+    this.storage = config.storageProvider || {
+      async saveFile(file) {
+        return { filename: file.name || "test.txt", originalName: file.name || "test.txt", mimetype: file.type || "text/plain", size: file.size || 0, url: "http://localhost/uploads/test.txt" };
+      },
+      async deleteFile() {}
+    };
+    this.queue = new CequreDurableQueue(this.adapter, this.storage);
+    this.cache = config.cache || new MemoryCacheStore;
+    this.streamStore = config.streamStore || new MemoryStreamStore;
+    this.serverProvider = config.serverProvider;
+    this.cronManager = config.cronProvider || new MemoryCronProvider;
+    this.realtimeProvider = config.realtimeProvider;
+    this.plugins = config.plugins || [];
+    if (this.adapter.registerCollections) {
+      this.adapter.registerCollections(this.schema.collections);
+    }
+    this.router = new CequreRouter(prefix);
+    this.rateLimiter = new RateLimiter(this.schema, new CequreKV(config.kv ?? { driver: "memory" }), this.schema.core?.api?.trustedProxies);
+    this.idempotencyKV = new CequreKV(config.kv ?? { driver: "memory" });
+    this.lockoutKV = new CequreKV(config.kv ?? { driver: "memory" });
+    if (this.schema.email || config.email) {
+      this.mailer = createMailer({
+        ...this.schema.email,
+        ...config.email
+      });
+    }
+  }
+  get prefix() {
+    const base = this.schema.core?.api?.prefix || "/api";
+    const version = this.schema.core?.api?.version;
+    return version ? `${base}/v${version}` : base;
+  }
+  get rawPrefix() {
+    return this.schema.core?.api?.prefix || "/api";
+  }
+  get apiVersion() {
+    return this.schema.core?.api?.version ?? null;
+  }
+  get isDeprecatedVersion() {
+    const version = this.apiVersion;
+    if (!version)
+      return false;
+    const deprecated = this.schema.core?.api?.deprecatedVersions;
+    return Array.isArray(deprecated) && deprecated.includes(version);
+  }
+  access(collection, rules) {
+    this._access.set(collection, rules);
+  }
+  hooks(collection, hooks) {
+    this.hooksMap.set(collection, hooks);
+  }
+  async checkLockout(collection, email, lockoutConfig) {
+    if (!lockoutConfig?.maxAttempts)
+      return { locked: false };
+    const key = `lockout:${collection}:${email.toLowerCase()}`;
+    const entryStr = await this.lockoutKV.get(key);
+    if (!entryStr)
+      return { locked: false };
+    const entry = JSON.parse(entryStr);
+    if (entry.lockedUntil > 0 && Date.now() < entry.lockedUntil) {
+      return { locked: true, remainingMs: entry.lockedUntil - Date.now() };
+    }
+    return { locked: false };
+  }
+  async recordFailedLogin(collection, email, lockoutConfig) {
+    if (!lockoutConfig?.maxAttempts)
+      return;
+    const key = `lockout:${collection}:${email.toLowerCase()}`;
+    const entryStr = await this.lockoutKV.get(key);
+    const entry = entryStr ? JSON.parse(entryStr) : null;
+    const count = entry ? entry.count + 1 : 1;
+    const maxAttempts = lockoutConfig.maxAttempts;
+    const durationMs = (lockoutConfig.durationMinutes ?? 15) * 60 * 1000;
+    const ttlSeconds = Math.ceil(durationMs / 1000) * 2;
+    if (count >= maxAttempts) {
+      await this.lockoutKV.set(key, JSON.stringify({ count, lockedUntil: Date.now() + durationMs }), ttlSeconds);
+    } else {
+      await this.lockoutKV.set(key, JSON.stringify({ count, lockedUntil: 0 }), ttlSeconds);
+    }
+  }
+  async clearFailedLogins(collection, email) {
+    await this.lockoutKV.delete(`lockout:${collection}:${email.toLowerCase()}`);
+  }
+  resolveEnvVariables(obj) {
+    if (!obj)
+      return obj;
+    if (typeof obj === "object") {
+      if (Array.isArray(obj)) {
+        return obj.map((item) => this.resolveEnvVariables(item));
+      }
+      if (obj.$env !== undefined) {
+        const envValue = process.env[obj.$env];
+        let finalValue = envValue !== undefined ? envValue : obj.$default;
+        if (typeof obj.$default === "number" && typeof finalValue === "string") {
+          const parsed = Number(finalValue);
+          if (!isNaN(parsed))
+            finalValue = parsed;
+        } else if (typeof obj.$default === "boolean" && typeof finalValue === "string") {
+          if (finalValue.toLowerCase() === "true")
+            finalValue = true;
+          else if (finalValue.toLowerCase() === "false")
+            finalValue = false;
+        } else if (typeof finalValue === "string") {
+          if (finalValue.toLowerCase() === "true")
+            finalValue = true;
+          else if (finalValue.toLowerCase() === "false")
+            finalValue = false;
+        }
+        return finalValue;
+      }
+      const newObj = {};
+      for (const key in obj) {
+        newObj[key] = this.resolveEnvVariables(obj[key]);
+      }
+      return newObj;
+    }
+    return obj;
+  }
+  async getContext(req) {
+    let user = null;
+    let token = null;
+    const authHeader = req.headers.get("Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      token = authHeader.split(" ")[1] ?? null;
+    } else {
+      const cookiesConfig = this.schema.security?.auth?.jwt?.cookies;
+      if (cookiesConfig) {
+        const cookieName = cookiesConfig.name || "cequre_auth";
+        const cookieHeader = req.headers.get("cookie");
+        if (cookieHeader) {
+          const match = cookieHeader.match(new RegExp(`(^|;\\s*)${cookieName}=([^;]+)`));
+          if (match)
+            token = match[2] ?? null;
+        }
+      }
+    }
+    if (token && this.authEngine) {
+      user = await this.authEngine.verifyAccessToken(token);
+    }
+    if (!user && this.schema.security?.auth?.apiKey?.enabled) {
+      const apiKeyHeader = this.schema.security.auth.apiKey.header || "x-api-key";
+      const apiKeyValue = req.headers.get(apiKeyHeader);
+      if (apiKeyValue) {
+        try {
+          const hashedKey = await sha256Hex(apiKeyValue);
+          const result = await this.secureFind("cequre_api_keys", {
+            where: { keyHash: { eq: hashedKey } },
+            limit: 1
+          });
+          if (result.docs.length > 0) {
+            const keyDoc = result.docs[0];
+            user = { id: keyDoc.userId, role: keyDoc.role ?? "api", collection: keyDoc.collection };
+          }
+        } catch {}
+      }
+    }
+    return { request: req, user, cequre: this };
+  }
+  async checkAccess(collection, action, ctx) {
+    if (process.env.TEST_DISABLE_ACCESS === "1")
+      return;
+    const tsRules = this._access.get(collection);
+    const isAuthAction = ["register", "login", "refresh", "logout", "forgotPassword", "resetPassword", "mfaLogin", "mfaEnroll", "mfaVerify", "mfaDisable"].includes(action);
+    if (tsRules && tsRules[action]) {
+      const allowed = await tsRules[action](ctx);
+      if (!allowed) {
+        throw CequreError.Forbidden(`Unauthorized to ${action} on ${collection}`);
+      }
+      return typeof allowed === "object" ? allowed : undefined;
+    }
+    const schemaCollection = this.schema.collections.find((c) => c.slug === collection);
+    if (schemaCollection && schemaCollection.access && schemaCollection.access[action]) {
+      const expressions = schemaCollection.access[action];
+      if (Array.isArray(expressions) && expressions.length > 0) {
+        let anyAllowed = false;
+        let resultingWhereClause;
+        for (const exp of expressions) {
+          const result = evaluateAccessExpression(exp, ctx, action);
+          if (result) {
+            anyAllowed = true;
+            if (typeof result === "object") {
+              resultingWhereClause = result;
+            }
+            break;
+          }
+        }
+        if (!anyAllowed) {
+          throw CequreError.Forbidden(`Unauthorized to ${action} on ${collection} (DSL Denied)`);
+        }
+        return resultingWhereClause;
+      }
+    }
+    if (isAuthAction)
+      return;
+    throw CequreError.Forbidden(`Unauthorized to ${action} on ${collection} (Access denied by default)`);
+  }
+  async runBeforeHooks(collection, action, ctx, data) {
+    const h = this.hooksMap.get(collection);
+    const hookName = `before${action}`;
+    if (h && h[hookName]) {
+      const result = await h[hookName]({ ...ctx, collection, data });
+      return result !== undefined ? result : data;
+    }
+    return data;
+  }
+  async runAfterHooks(collection, action, ctx, data) {
+    const h = this.hooksMap.get(collection);
+    const hookName = `after${action}`;
+    if (h && h[hookName]) {
+      const result = await h[hookName]({ ...ctx, collection, data });
+      return result !== undefined ? result : data;
+    }
+    return data;
+  }
+  _registerCacheKey(collection, key) {
+    let keys = this._cacheKeyRegistry.get(collection);
+    if (!keys) {
+      keys = new Set;
+      this._cacheKeyRegistry.set(collection, keys);
+    }
+    keys.add(key);
+  }
+  async initPlugins() {
+    for (const plugin of this.plugins) {
+      if (plugin.onInit) {
+        await plugin.onInit(this);
+      }
+    }
+  }
+  async buildRoutes() {
+    await this.initPlugins();
+    const prefix = this.schema.core?.api?.prefix || "/api";
+    this.router.get(`${prefix}/sdk.ts`, async (ctx) => {
+      if (false) {}
+      const { generateTypeScriptClientSDK: generateTypeScriptClientSDK2 } = (init_sdk(), __toCommonJS(exports_sdk));
+      const code = generateTypeScriptClientSDK2(this.schema, this.router.list());
+      return new Response(code, {
+        headers: { "Content-Type": "application/typescript" }
+      });
+    }, { detail: { hide: true } });
+    const docsConfig = this.schema.core?.api?.docs;
+    this.router.get(`${prefix}/docs/openapi.json`, async (ctx) => {
+      const req = ctx.request;
+      if (docsConfig?.enabled === false)
+        return new Response("Not Found", { status: 404 });
+      if (docsConfig?.authRequired) {
+        const reqCtx = await this.getContext(req);
+        if (!reqCtx.user)
+          return new Response("Unauthorized", { status: 401 });
+      }
+      const url = new URL(req.url);
+      const proto = req.headers.get("x-forwarded-proto") ?? url.protocol.replace(/:$/, "");
+      const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? url.host;
+      const serverUrl = `${proto}://${host}`;
+      const mappedApp = {
+        routes: this.router.list().map((route) => ({
+          method: route.method,
+          path: route.path,
+          hooks: {
+            body: route.options?.body,
+            query: route.options?.query,
+            response: route.options?.response,
+            detail: route.options?.detail,
+            stream: route.options?.stream
+          }
+        }))
+      };
+      const spec = generateOpenAPISpec(this.schema, serverUrl, prefix, mappedApp);
+      return new Response(JSON.stringify(spec, null, 2), {
+        headers: { "Content-Type": "application/json" }
+      });
+    });
+    this.router.get(`${prefix}/docs`, async (ctx) => {
+      const req = ctx.request;
+      if (docsConfig?.enabled === false)
+        return new Response("Not Found", { status: 404 });
+      if (docsConfig?.authRequired) {
+        const reqCtx = await this.getContext(req);
+        if (!reqCtx.user)
+          return new Response("Unauthorized", { status: 401 });
+      }
+      const specUrl = `${prefix}/docs/openapi.json`;
+      const html = generateScalarHTML(specUrl);
+      return new Response(html, {
+        headers: { "Content-Type": "text/html" }
+      });
+    });
+    const checkPlatformAdmin = async (ctx) => {
+      const reqCtx = await this.getContext(ctx.request);
+      if (!reqCtx.user?.isPlatformAdmin) {
+        return new Response(JSON.stringify({ error: "Unauthorized. Platform Admin required." }), { status: 403, headers: { "Content-Type": "application/json" } });
+      }
+      return null;
+    };
+    this.router.get(`${prefix}/_collections`, async (ctx) => {
+      const authErr = await checkPlatformAdmin(ctx);
+      if (authErr)
+        return authErr;
+      const adminConfig = this.schema.adminUI || {};
+      const collectionsList = (this.schema.collections || []).filter((col) => !col.hidden).map((col, index) => {
+        return {
+          id: index + 1,
+          name: col.slug,
+          type: "collection",
+          items: 0
+        };
+      });
+      return new Response(JSON.stringify({ collections: collectionsList, config: adminConfig }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    });
+    this.router.get(`${prefix}/_collections/:collection/schema`, async (ctx) => {
+      const authErr = await checkPlatformAdmin(ctx);
+      if (authErr)
+        return authErr;
+      const params = ctx.params;
+      const col = this.schema.collections?.find((c) => c.slug === params.collection);
+      if (!col)
+        return new Response(JSON.stringify({ error: "Collection not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
+      return new Response(JSON.stringify({
+        name: col.slug,
+        fields: col.fields || [],
+        auth: col.auth || false
+      }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    });
+    this.router.get(`${prefix}/audit/export`, async (ctx) => {
+      const req = ctx.request;
+      if (!this.auditEnabled)
+        return new Response("Audit logging is not enabled", { status: 404 });
+      const reqCtx = await this.getContext(req);
+      if (!reqCtx.user)
+        return new Response("Unauthorized", { status: 401 });
+      try {
+        const result = await this.secureFind("cequre_audit_log", { limit: 1e4, sort: "createdAt" });
+        const entries = result.docs;
+        let chainStatus = null;
+        try {
+          const key = await this.auditKeyPromise;
+          chainStatus = await verifyAuditChain(key, entries);
+        } catch {}
+        const exportPayload = {
+          exportedAt: new Date().toISOString(),
+          totalEntries: entries.length,
+          chainStatus,
+          entries
+        };
+        return new Response(JSON.stringify(exportPayload, null, 2), {
+          headers: { "Content-Type": "application/json" }
+        });
+      } catch (err) {
+        log.warn({ err }, "Failed to export audit log");
+        return new Response(JSON.stringify({ error: "Failed to export audit log" }), {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    });
+    const isRealtimeGlobal = this.schema.collections.some((c) => c.realtime?.ws || c.realtime?.sse || c.realtime?.durableStream);
+    if (isRealtimeGlobal) {
+      const checkSecureChannel = async (channel, request, user) => {
+        const collection = this.schema.collections.find((c) => c.slug === channel);
+        if (!collection || !collection.realtime?.secure)
+          return true;
+        if (!user)
+          return false;
+        try {
+          const ctx = {
+            request,
+            user,
+            cequre: this
+          };
+          await this.checkAccess(collection.slug, "read", ctx);
+          return true;
+        } catch {
+          return false;
+        }
+      };
+      const onSubscribe = async (info) => {
+        return checkSecureChannel(info.channel, info.request, info.user);
+      };
+      const onJoinRoom = async (room, ws) => {
+        const req = ws.data.request;
+        const user = ws.data.user;
+        if (!req) {
+          const collection = this.schema.collections.find((c) => c.slug === room);
+          if (collection?.realtime?.secure)
+            return false;
+          return true;
+        }
+        return checkSecureChannel(room, req, user);
+      };
+      this.router.get(`${prefix}/ws`, async (ctx) => this.realtimeProvider?.websocket?.route?.({ path: `${prefix}/ws`, onJoinRoom })(ctx.request, undefined));
+      this.router.get(`${prefix}/sse`, async (ctx) => {
+        const resolveUser = async (request) => {
+          const reqCtx = await this.getContext(request);
+          return reqCtx.user;
+        };
+        return CequreSSE.route({ path: `${prefix}/sse`, onSubscribe, resolveUser })(ctx.request);
+      }, { detail: { hide: true } });
+    }
+    this.router.post(`${prefix}/uploads`, async (ctx) => {
+      const req = ctx.request;
+      const formData = await req.formData().catch(() => null);
+      if (!formData)
+        return new Response(JSON.stringify({ error: "Failed to parse form data" }), { status: 400 });
+      const file = formData.get("file");
+      if (!(file instanceof File))
+        return new Response(JSON.stringify({ error: "A 'file' field is required" }), { status: 400 });
+      const filename = formData.get("filename")?.toString();
+      const uploadedFile = await this.storage.saveFile(file, filename ? { filename } : undefined);
+      return new Response(JSON.stringify(uploadedFile), { status: 201, headers: { "Content-Type": "application/json" } });
+    }, {
+      detail: { tags: ["Uploads"], summary: "Upload a file" }
+    });
+    this.router.post(`${prefix}/uploads/multipart/init`, async (ctx) => {
+      const req = ctx.request;
+      const data = await req.json().catch(() => null);
+      if (!data || !data.filename || !data.mimetype || !data.size) {
+        return new Response(JSON.stringify({ error: "filename, mimetype, and size are required" }), { status: 400 });
+      }
+      if (this.storage.initMultipartUpload) {
+        try {
+          const result = await this.storage.initMultipartUpload(data);
+          return new Response(JSON.stringify(result), { status: 200, headers: { "Content-Type": "application/json" } });
+        } catch (err) {
+          return new Response(JSON.stringify({ error: err.message }), { status: 500 });
+        }
+      } else {
+        const uploadId = ulid();
+        const tmpDir = path.join(__require("os").tmpdir(), "cequre-uploads", uploadId);
+        await __require("fs/promises").mkdir(tmpDir, { recursive: true }).catch(() => {});
+        return new Response(JSON.stringify({ uploadId, parts: null }), { status: 200, headers: { "Content-Type": "application/json" } });
+      }
+    }, { detail: { tags: ["Uploads"], summary: "Initialize multipart upload" } });
+    this.router.post(`${prefix}/uploads/multipart/chunk`, async (ctx) => {
+      const req = ctx.request;
+      const url = new URL(req.url);
+      const uploadId = url.searchParams.get("uploadId");
+      const partNumber = url.searchParams.get("partNumber");
+      if (!uploadId || !partNumber) {
+        return new Response(JSON.stringify({ error: "uploadId and partNumber query params are required" }), { status: 400 });
+      }
+      const tmpFile = path.join(__require("os").tmpdir(), "cequre-uploads", uploadId, `part-${partNumber}`);
+      await __require("fs/promises").writeFile(tmpFile, Buffer.from(await req.arrayBuffer()));
+      return new Response(JSON.stringify({ etag: `local-${partNumber}` }), { status: 200, headers: { "Content-Type": "application/json" } });
+    }, { detail: { tags: ["Uploads"], summary: "Upload a file chunk (fallback)" } });
+    this.router.post(`${prefix}/uploads/multipart/complete`, async (ctx) => {
+      const req = ctx.request;
+      const data = await req.json().catch(() => null);
+      if (!data || !data.uploadId || !data.filename || !data.parts) {
+        return new Response(JSON.stringify({ error: "uploadId, filename, and parts are required" }), { status: 400 });
+      }
+      if (this.storage.completeMultipartUpload) {
+        try {
+          const result = await this.storage.completeMultipartUpload(data.uploadId, data.filename, data.parts);
+          return new Response(JSON.stringify(result), { status: 200, headers: { "Content-Type": "application/json" } });
+        } catch (err) {
+          return new Response(JSON.stringify({ error: err.message }), { status: 500 });
+        }
+      } else {
+        const tmpDir = path.join(__require("os").tmpdir(), "cequre-uploads", data.uploadId);
+        const stitchedPath = path.join(__require("os").tmpdir(), "cequre-uploads", `${data.uploadId}-${data.filename}`);
+        try {
+          const sortedParts = data.parts.sort((a, b) => a.partNumber - b.partNumber);
+          const writer = __require("fs").createWriteStream(stitchedPath);
+          for (const part of sortedParts) {
+            const partPath = path.join(tmpDir, `part-${part.partNumber}`);
+            const partBuffer = await __require("fs/promises").readFile(partPath);
+            writer.write(partBuffer);
+          }
+          await new Promise((resolve) => writer.end(resolve));
+          const stitchedBuffer = await __require("fs/promises").readFile(stitchedPath);
+          const finalFile = new File([stitchedBuffer], data.filename, { type: "application/octet-stream" });
+          const uploadedFile = await this.storage.saveFile(finalFile, { filename: data.filename });
+          const fs = __require("fs/promises");
+          fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+          fs.rm(stitchedPath, { force: true }).catch(() => {});
+          return new Response(JSON.stringify(uploadedFile), { status: 200, headers: { "Content-Type": "application/json" } });
+        } catch (err) {
+          return new Response(JSON.stringify({ error: `Stitching failed: ${err.message}` }), { status: 500 });
+        }
+      }
+    }, { detail: { tags: ["Uploads"], summary: "Complete multipart upload" } });
+    this.router.get(`${prefix}/uploads/:filename`, async (ctx) => {
+      const req = ctx.request;
+      const params = ctx.params;
+      const safeName = path.basename(params.filename);
+      if (safeName !== params.filename)
+        return new Response("Forbidden", { status: 403 });
+      if (this.storage.getFileUrl) {
+        try {
+          const url = await this.storage.getFileUrl(safeName);
+          if (url) {
+            return new Response(null, { status: 302, headers: { Location: url } });
+          }
+        } catch (err) {
+          return new Response("Not found in external storage", { status: 404 });
+        }
+      }
+      const uploadDir = path.resolve(process.cwd(), "uploads");
+      const filePath = path.join(uploadDir, safeName);
+      if (!filePath.startsWith(uploadDir + path.sep))
+        return new Response("Forbidden", { status: 403 });
+      try {
+        const fileBuffer = await __require("fs/promises").readFile(filePath);
+        return new Response(fileBuffer, {
+          headers: {
+            "Content-Type": "application/octet-stream"
+          }
+        });
+      } catch (err) {
+        if (err.code === "ENOENT") {
+          return new Response("Not found", { status: 404 });
+        }
+        throw err;
+      }
+    }, {
+      detail: { tags: ["Uploads"], summary: "Serve an uploaded file" }
+    });
+    for (const collection of this.schema.collections) {
+      const basePath = `${prefix}/${collection.slug}`;
+      const hasCache = !!collection.cache;
+      const cacheTTL = collection.cache?.ttl || 3600;
+      const isRealtime = !!collection.realtime;
+      this.router.get(basePath, async (ctx) => {
+        const req = ctx.request;
+        const accessWhere = await this.checkAccess(collection.slug, "read", ctx);
+        if (hasCache) {
+          const cacheKey = `list:${collection.slug}:${new URL(req.url).search}`;
+          const cached = await this.cache.get(cacheKey);
+          if (cached)
+            return new Response(JSON.stringify(cached), { headers: { "Content-Type": "application/json", "X-Cache": "HIT" } });
+        }
+        let queryArgs = {};
+        if (ctx.query.q) {
+          try {
+            queryArgs = typeof ctx.query.q === "string" ? JSON.parse(ctx.query.q) : ctx.query.q;
+          } catch (e) {}
+        }
+        queryArgs = await this.runBeforeHooks(collection.slug, "Read", ctx, queryArgs);
+        let finalWhere = queryArgs.where || {};
+        if (accessWhere) {
+          if (Object.keys(finalWhere).length > 0) {
+            finalWhere = { AND: [accessWhere, finalWhere] };
+          } else {
+            finalWhere = accessWhere;
+          }
+        }
+        queryArgs.where = Object.keys(finalWhere).length > 0 ? finalWhere : undefined;
+        const result = await this.secureFind(collection.slug, queryArgs);
+        const userRole = ctx.user?.role ?? null;
+        if (this.getRestrictedFields(collection.slug, "readRoles").size > 0) {
+          result.docs = result.docs.map((doc) => this.filterReadableFields(collection.slug, doc, userRole));
+        }
+        if (hasCache) {
+          const cacheKey = `list:${collection.slug}:${new URL(req.url).search}`;
+          await this.cache.set(cacheKey, result, Number(cacheTTL));
+          this._registerCacheKey(collection.slug, cacheKey);
+        }
+        const hookedResult = await this.runAfterHooks(collection.slug, "Read", ctx, result);
+        return new Response(JSON.stringify(hookedResult), { headers: { "Content-Type": "application/json", "X-Cache": "MISS" } });
+      });
+      if (collection.realtime?.durableStream) {
+        this.router.get(`${basePath}/stream`, async (ctx) => {
+          await this.checkAccess(collection.slug, "read", ctx);
+          const url = new URL(ctx.request.url);
+          const lastEventId = url.searchParams.get("lastEventId") || undefined;
+          const events = await this.streamStore.read(collection.slug, lastEventId);
+          return new Response(JSON.stringify(events), { headers: { "Content-Type": "application/json" } });
+        });
+      }
+      this.router.get(`${basePath}/:id`, async (ctx) => {
+        const req = ctx.request;
+        const params = ctx.params;
+        const accessWhere = await this.checkAccess(collection.slug, "read", { ...ctx, id: params.id });
+        if (hasCache) {
+          const cacheKey = `doc:${collection.slug}:${params.id}${new URL(req.url).search}`;
+          const cached = await this.cache.get(cacheKey);
+          if (cached)
+            return new Response(JSON.stringify(cached), { headers: { "Content-Type": "application/json", "X-Cache": "HIT" } });
+        }
+        let queryArgs = {};
+        if (ctx.query.q) {
+          try {
+            queryArgs = typeof ctx.query.q === "string" ? JSON.parse(ctx.query.q) : ctx.query.q;
+          } catch (e) {}
+        }
+        queryArgs = await this.runBeforeHooks(collection.slug, "Read", ctx, queryArgs);
+        const result = await this.secureFindById(collection.slug, params.id, queryArgs);
+        if (!result)
+          return new Response("Not found", { status: 404 });
+        if (accessWhere) {
+          const verification = await this.secureFind(collection.slug, { where: { ...accessWhere, id: { eq: params.id } }, limit: 1 });
+          if (!verification.docs.length)
+            return new Response("Not found", { status: 404 });
+        }
+        const userRole = ctx.user?.role ?? null;
+        const filteredResult = this.filterReadableFields(collection.slug, result, userRole);
+        if (hasCache) {
+          const cacheKey = `doc:${collection.slug}:${params.id}${new URL(req.url).search}`;
+          await this.cache.set(cacheKey, filteredResult, Number(cacheTTL));
+          this._registerCacheKey(collection.slug, cacheKey);
+        }
+        const hookedResult = await this.runAfterHooks(collection.slug, "Read", ctx, filteredResult);
+        return new Response(JSON.stringify(hookedResult), { headers: { "Content-Type": "application/json", "X-Cache": "MISS" } });
+      });
+      const invalidateCache = async (specificDocId) => {
+        if (specificDocId) {
+          await this.cache.del(`doc:${collection.slug}:${specificDocId}`);
+        }
+        const keys = this._cacheKeyRegistry.get(collection.slug);
+        if (keys && keys.size > 0) {
+          await this.cache.del(...keys);
+          keys.clear();
+        }
+      };
+      const broadcastChange = (action, data) => {
+        if (!isRealtime)
+          return;
+        const r = collection.realtime;
+        const payload = { event: `${collection.slug}:${action}`, data };
+        const isAllowed = (setting) => setting === true || Array.isArray(setting) && setting.includes(action);
+        if (isAllowed(r?.ws))
+          this.realtimeProvider?.websocket?.broadcastToRoom?.(collection.slug, payload);
+        if (isAllowed(r?.sse))
+          CequreSSE.broadcastToChannel(collection.slug, payload);
+        if (isAllowed(r?.durableStream) && this.streamStore) {
+          this.streamStore.publish(collection.slug, action, data).catch((e) => log.error({ err: e }, "Stream publish failed"));
+        }
+      };
+      this.router.post(basePath, async (ctx) => {
+        const req = ctx.request;
+        let data = await req.json();
+        await this.checkAccess(collection.slug, "create", { ...ctx, data });
+        data = this.stripForbiddenFields(collection.slug, data);
+        const userRole = ctx.user?.role ?? null;
+        data = this.filterWritableFields(collection.slug, data, userRole);
+        data = validateCreate(collection, data);
+        data = await this.runBeforeHooks(collection.slug, "Create", ctx, data);
+        const result = await this.secureCreate(collection.slug, data);
+        await this.runAfterHooks(collection.slug, "Create", ctx, result);
+        if (hasCache)
+          await invalidateCache();
+        if (isRealtime)
+          broadcastChange("created", result);
+        const responseResult = this.filterReadableFields(collection.slug, result, userRole);
+        return new Response(JSON.stringify(responseResult), { status: 201, headers: { "Content-Type": "application/json" } });
+      });
+      this.router.patch(`${basePath}/:id`, async (ctx) => {
+        const req = ctx.request;
+        const params = ctx.params;
+        let data = await req.json();
+        const accessWhere = await this.checkAccess(collection.slug, "update", { ...ctx, id: params.id, data });
+        if (accessWhere) {
+          const verification = await this.secureFind(collection.slug, { where: { ...accessWhere, id: { eq: params.id } }, limit: 1 });
+          if (!verification.docs.length)
+            return new Response("Not found", { status: 404 });
+        }
+        data = this.stripForbiddenFields(collection.slug, data);
+        const userRole = ctx.user?.role ?? null;
+        data = this.filterWritableFields(collection.slug, data, userRole);
+        data = validateUpdate(collection, data);
+        data = await this.runBeforeHooks(collection.slug, "Update", ctx, data);
+        const result = await this.secureUpdate(collection.slug, params.id, data);
+        await this.runAfterHooks(collection.slug, "Update", ctx, result);
+        if (hasCache)
+          await invalidateCache(params.id);
+        if (isRealtime)
+          broadcastChange("updated", result);
+        const responseResult = this.filterReadableFields(collection.slug, result, userRole);
+        return new Response(JSON.stringify(responseResult), { headers: { "Content-Type": "application/json" } });
+      });
+      this.router.delete(`${basePath}/:id`, async (ctx) => {
+        const req = ctx.request;
+        const params = ctx.params;
+        const accessWhere = await this.checkAccess(collection.slug, "delete", { ...ctx, id: params.id });
+        let record = null;
+        if (accessWhere) {
+          const verification = await this.secureFind(collection.slug, { where: { ...accessWhere, id: { eq: params.id } }, limit: 1 });
+          if (!verification.docs.length)
+            return new Response("Not found", { status: 404 });
+          record = verification.docs[0];
+        } else {
+          const verification = await this.secureFind(collection.slug, { where: { id: { eq: params.id } }, limit: 1 });
+          if (!verification.docs.length)
+            return new Response("Not found", { status: 404 });
+          record = verification.docs[0];
+        }
+        await this.runBeforeHooks(collection.slug, "Delete", ctx, { id: params.id });
+        await this.adapter.delete(collection.slug, params.id);
+        if (collection.fields && record) {
+          for (const field of collection.fields) {
+            if (field.type === "upload" || field.type === "media" || field.type === "file") {
+              const fileData = record[field.name];
+              if (fileData) {
+                const files = Array.isArray(fileData) ? fileData : [fileData];
+                for (const f of files) {
+                  let filename = null;
+                  if (typeof f === "string") {
+                    try {
+                      const parsed = JSON.parse(f);
+                      filename = parsed.filename || f;
+                    } catch {
+                      filename = f;
+                    }
+                  } else if (f && typeof f === "object" && f.filename) {
+                    filename = f.filename;
+                  }
+                  if (filename) {
+                    this.queue.enqueue("DELETE_FILE", { filename }).catch((e) => log.error("Queue enqueue error", e));
+                  }
+                }
+              }
+            }
+          }
+        }
+        await this.runAfterHooks(collection.slug, "Delete", ctx, { id: params.id });
+        if (hasCache)
+          await invalidateCache(params.id);
+        if (isRealtime)
+          broadcastChange("deleted", { id: params.id });
+        return new Response(JSON.stringify({ deleted: true }), { headers: { "Content-Type": "application/json" } });
+      });
+    }
+    if (this.schema.globals) {
+      for (const glob of this.schema.globals) {
+        const basePath = `${prefix}/globals/${glob.slug}`;
+        this.router.get(basePath, async (ctx) => {
+          try {
+            await this.checkAccess(glob.slug, "read", ctx);
+            const data = await this.secureFindById("cequre_globals", glob.slug);
+            return new Response(JSON.stringify(data || {}), { status: 200, headers: { "Content-Type": "application/json" } });
+          } catch (e) {
+            return toErrorResponse(e, ctx.request, this.adapter);
+          }
+        });
+        const updateHandler = async (ctx) => {
+          try {
+            await this.checkAccess(glob.slug, "update", ctx);
+            let body = await ctx.request.json();
+            body = await this.runBeforeHooks(glob.slug, "Update", ctx, body);
+            const existing = await this.secureFindById("cequre_globals", glob.slug);
+            let result;
+            if (existing) {
+              result = await this.secureUpdate("cequre_globals", glob.slug, body);
+            } else {
+              result = await this.secureCreate("cequre_globals", { id: glob.slug, ...body });
+            }
+            await this.runAfterHooks(glob.slug, "Update", ctx, result);
+            return new Response(JSON.stringify(result), { status: 200, headers: { "Content-Type": "application/json" } });
+          } catch (e) {
+            return toErrorResponse(e, ctx.request, this.adapter);
+          }
+        };
+        this.router.post(basePath, updateHandler);
+        this.router.patch(basePath, updateHandler);
+      }
+    }
+  }
+  auditLock = Promise.resolve();
+  async purgeOldAuditEntries(retentionDays) {
+    const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString();
+    try {
+      const oldEntries = await this.secureFind("cequre_audit_log", {
+        where: { createdAt: { lt: cutoff } },
+        limit: 1000
+      });
+      let deleted = 0;
+      for (const doc of oldEntries.docs) {
+        try {
+          await this.adapter.delete("cequre_audit_log", doc.id);
+          deleted++;
+        } catch {}
+      }
+      if (deleted > 0) {
+        log.info({ deleted, retentionDays }, "Purged old audit entries");
+      }
+      return deleted;
+    } catch (err) {
+      log.warn({ err }, "Failed to purge old audit entries \u2014 table may not exist yet");
+      return 0;
+    }
+  }
+  async audit(event) {
+    if (!this.auditEnabled)
+      return;
+    this.auditLock = this.auditLock.then(() => this._doAudit(event)).catch(() => this._doAudit(event));
+    return this.auditLock;
+  }
+  async _doAudit(event) {
+    try {
+      const key = await this.auditKeyPromise;
+      const recent = await this.secureFind("cequre_audit_log", { limit: 1, sort: "-createdAt" });
+      const prevHmac = recent.docs.length > 0 ? recent.docs[0].hmac ?? null : null;
+      const hmac = await computeAuditHmac(key, event, prevHmac);
+      const now = new Date().toISOString();
+      await this.secureCreate("cequre_audit_log", {
+        id: ulid(),
+        action: event.action,
+        collection: event.collection,
+        recordId: event.recordId,
+        userId: event.userId,
+        requestId: event.requestId,
+        metadata: event.metadata ?? {},
+        hmac,
+        prevHmac,
+        createdAt: now,
+        updatedAt: now
+      });
+    } catch (err) {
+      log.error({ err }, "Audit persistence failed");
+    }
+  }
+  getRestrictedFields(collection, roleType) {
+    const col = this.schema.collections.find((c) => c.slug === collection);
+    if (!col?.fields)
+      return new Map;
+    const result = new Map;
+    for (const f of col.fields) {
+      const roles = f[roleType];
+      if (roles && roles.length > 0) {
+        result.set(f.name, roles);
+      }
+    }
+    return result;
+  }
+  filterFields(collection, data, roleType, userRole) {
+    if (!data || typeof data !== "object")
+      return data;
+    const restricted = this.getRestrictedFields(collection, roleType);
+    if (restricted.size === 0)
+      return data;
+    const result = { ...data };
+    for (const [field, allowedRoles] of restricted) {
+      if (!allowedRoles.includes(userRole ?? "")) {
+        delete result[field];
+      }
+    }
+    return result;
+  }
+  filterReadableFields(collection, doc, userRole) {
+    return this.filterFields(collection, doc, "readRoles", userRole);
+  }
+  filterWritableFields(collection, data, userRole) {
+    return this.filterFields(collection, data, "writeRoles", userRole);
+  }
+  stripForbiddenFields(collection, data) {
+    if (!data || typeof data !== "object")
+      return data;
+    const col = this.schema.collections.find((c) => c.slug === collection);
+    if (!col?.fields)
+      return data;
+    const result = { ...data };
+    for (const field of col.fields) {
+      if (field.type === "password" || field.omit || field.type === "link") {
+        delete result[field.name];
+      }
+    }
+    return result;
+  }
+  getEncryptedFields(collection, globalSlug) {
+    if (!this.encryptionKeyPromise)
+      return new Set;
+    let fieldsArray = undefined;
+    if (collection === "cequre_globals" && globalSlug) {
+      const glob = this.schema.globals?.find((g) => g.slug === globalSlug);
+      fieldsArray = glob?.fields;
+    } else {
+      const col = this.schema.collections.find((c) => c.slug === collection);
+      fieldsArray = col?.fields;
+    }
+    if (!fieldsArray)
+      return new Set;
+    const fields = new Set;
+    for (const f of fieldsArray) {
+      if (f.encrypt)
+        fields.add(f.name);
+    }
+    return fields;
+  }
+  async encryptDataFields(collection, data, isCreate, globalSlug) {
+    let fieldsArray = undefined;
+    if (collection === "cequre_globals" && (globalSlug || data.id)) {
+      const glob = this.schema.globals?.find((g) => g.slug === (globalSlug || data.id));
+      fieldsArray = glob?.fields;
+    } else {
+      const col = this.schema.collections.find((c) => c.slug === collection);
+      fieldsArray = col?.fields;
+    }
+    if (!fieldsArray)
+      return data;
+    const key = await this.encryptionKeyPromise;
+    if (!key)
+      return data;
+    const result = { ...data };
+    for (const f of fieldsArray) {
+      if (f.encrypt) {
+        if (isCreate && result[f.name] === undefined && f.default !== undefined) {
+          result[f.name] = f.default;
+        }
+        const v = result[f.name];
+        if (v !== undefined && typeof v === "string" && !isEncrypted(v)) {
+          result[f.name] = await encryptField(key, v);
+        }
+      }
+    }
+    return result;
+  }
+  async decryptDataFields(collection, docs) {
+    const key = await this.encryptionKeyPromise;
+    if (!key)
+      return docs;
+    const decryptDoc = async (doc) => {
+      if (!doc || typeof doc !== "object")
+        return doc;
+      const encFields = this.getEncryptedFields(collection, doc.id);
+      if (encFields.size === 0)
+        return doc;
+      const result = { ...doc };
+      for (const [k, v] of Object.entries(result)) {
+        if (encFields.has(k) && typeof v === "string" && isEncrypted(v)) {
+          const decrypted = await decryptField(key, v);
+          if (decrypted !== null)
+            result[k] = decrypted;
+        }
+      }
+      return result;
+    };
+    if (Array.isArray(docs)) {
+      return Promise.all(docs.map(decryptDoc));
+    }
+    return decryptDoc(docs);
+  }
+  async secureCreate(collection, data) {
+    const encData = await this.encryptDataFields(collection, data, true);
+    const result = await this.adapter.create(collection, encData);
+    if (this.encryptionKeyPromise) {
+      return await this.decryptDataFields(collection, result);
+    }
+    return result;
+  }
+  async secureUpdate(collection, id, data) {
+    const encData = await this.encryptDataFields(collection, data, false, id);
+    const result = await this.adapter.update(collection, id, encData);
+    if (this.encryptionKeyPromise) {
+      return await this.decryptDataFields(collection, result);
+    }
+    return result;
+  }
+  async secureFind(collection, query) {
+    const depth = query?.depth ? parseInt(query.depth, 10) : 0;
+    const safeQuery = { ...query };
+    delete safeQuery.depth;
+    const result = await this.adapter.find(collection, safeQuery);
+    if (this.encryptionKeyPromise && result?.docs) {
+      result.docs = await this.decryptDataFields(collection, result.docs);
+    }
+    if (depth > 0 && result?.docs?.length > 0) {
+      result.docs = await populateDocuments(this.schema, collection, result.docs, this.adapter, depth);
+    }
+    return result;
+  }
+  async secureFindById(collection, id, query) {
+    const depth = query?.depth ? parseInt(query.depth, 10) : 0;
+    let doc = await this.adapter.findById(collection, id);
+    if (this.encryptionKeyPromise && doc) {
+      doc = await this.decryptDataFields(collection, doc);
+    }
+    if (depth > 0 && doc) {
+      const populated = await populateDocuments(this.schema, collection, [doc], this.adapter, depth);
+      if (populated.length > 0)
+        doc = populated[0];
+    }
+    return doc;
+  }
+  async transaction(callback) {
+    if (this.isTransaction) {
+      throw new CequreError("Please refactor your code. Nested transactions not supported.", "NESTED_TRANSACTION", 500);
+    }
+    if (!this.adapter.transaction) {
+      throw new CequreError(`The configured database adapter (${this.adapter.adapterType || "unknown"}) does not support transactions.`, "NOT_SUPPORTED", 500);
+    }
+    return this.adapter.transaction(async (trxAdapter) => {
+      const trxRuntime = Object.create(this);
+      trxRuntime.adapter = trxAdapter;
+      trxRuntime.isTransaction = true;
+      return callback(trxRuntime);
+    });
+  }
+  async find(collection, query) {
+    return this.secureFind(collection, query);
+  }
+  async findById(collection, id, query) {
+    return this.secureFindById(collection, id, query);
+  }
+  async create(collection, data) {
+    const result = await this.secureCreate(collection, data);
+    if (collection !== "cequre_audit_log" && collection !== "cequre_refresh_tokens") {
+      const requestId = requestContextStorage.getStore();
+      this.audit({ action: "create", collection, recordId: result.id, requestId, metadata: { data } }).catch((e) => log.error({ err: e }, "Audit write failed"));
+    }
+    return result;
+  }
+  async update(collection, id, data) {
+    const result = await this.secureUpdate(collection, id, data);
+    if (collection !== "cequre_audit_log" && collection !== "cequre_refresh_tokens") {
+      const requestId = requestContextStorage.getStore();
+      this.audit({ action: "update", collection, recordId: id, requestId, metadata: { data } }).catch((e) => log.error({ err: e }, "Audit write failed"));
+    }
+    return result;
+  }
+  async delete(collection, id) {
+    await this.adapter.delete(collection, id);
+    if (collection !== "cequre_audit_log" && collection !== "cequre_refresh_tokens") {
+      const requestId = requestContextStorage.getStore();
+      this.audit({ action: "delete", collection, recordId: id, requestId }).catch((e) => log.error({ err: e }, "Audit write failed"));
+    }
+  }
+  async eraseUser(collection, userId) {
+    const colName = String(collection);
+    const conf = this.schema.collections.find((c) => c.slug === colName);
+    if (!conf || !conf.auth) {
+      throw new CequreError(`Collection ${colName} is not an auth-enabled collection.`, "BAD_REQUEST", 400);
+    }
+    this.audit({
+      action: "eraseUser",
+      collection: colName,
+      recordId: userId,
+      requestId: "internal_erasure",
+      userId: "system"
+    }).catch((err) => log.error({ err }, "Failed to log eraseUser audit event"));
+    await this.adapter.delete(colName, userId);
+    try {
+      const result = await this.adapter.find("cequre_refresh_tokens", {
+        where: { userId: { eq: userId } },
+        limit: 1000
+      });
+      for (const doc of result.docs) {
+        await this.adapter.delete("cequre_refresh_tokens", doc.id);
+      }
+    } catch (e) {
+      if (e?.message !== "Database not connected") {
+        log.warn({ err: e }, "Failed to purge refresh tokens during user erasure");
+      }
+    }
+  }
+  async count(collection, query) {
+    return this.adapter.count(collection, query);
+  }
+  async syncDatabaseSchema() {
+    if (!this.adapter)
+      return;
+    const syncLog = createLogger("schema-sync");
+    if (this.adapter.getSystemTableStatements && this.adapter.raw) {
+      const stmts = this.adapter.getSystemTableStatements();
+      for (const stmt of stmts) {
+        try {
+          await this.adapter.raw(stmt);
+        } catch (e) {
+          const msg = e?.message || String(e);
+          if (!msg.toLowerCase().includes("already exists")) {
+            throw e;
+          }
+        }
+      }
+    }
+    if (!this.adapter.getCurrentSchema || !this.adapter.createTableDDL || !this.adapter.addColumnDDL || !this.adapter.raw) {
+      return;
+    }
+    const currentSchema = await this.adapter.getCurrentSchema();
+    const existingTables = new Set(currentSchema.tables);
+    const configuredTables = new Set(this.schema.collections.map((c) => c.slug));
+    const isProduction = false;
+    const dropOrphan = !isProduction && this.schema.migrate?.dropOrphan === true;
+    for (const existingTable of existingTables) {
+      if (existingTable !== "cequre_migrations" && existingTable !== "cequre_refresh_tokens" && !configuredTables.has(existingTable)) {
+        if (dropOrphan) {
+          if (this.adapter.dropTableDDL) {
+            syncLog.info(`Dropping orphaned table: ${existingTable}`);
+            await this.adapter.raw(this.adapter.dropTableDDL(existingTable));
+          }
+        } else {
+          syncLog.warn(`Orphaned table detected but not dropped: ${existingTable}`);
+        }
+      }
+    }
+    const sortedCollections = [];
+    const visited = new Set;
+    const visiting = new Set;
+    const visit = (col) => {
+      if (visited.has(col.slug) || visiting.has(col.slug))
+        return;
+      visiting.add(col.slug);
+      for (const field of col.fields) {
+        if (field.type === "relationship" && field.target) {
+          const targetCol = this.schema.collections.find((c) => c.slug === field.target);
+          if (targetCol)
+            visit(targetCol);
+        }
+      }
+      visiting.delete(col.slug);
+      visited.add(col.slug);
+      sortedCollections.push(col);
+    };
+    for (const col of this.schema.collections)
+      visit(col);
+    for (const collection of sortedCollections) {
+      const tableName = collection.slug;
+      if (!existingTables.has(tableName)) {
+        const ddl = this.adapter.createTableDDL(collection);
+        syncLog.info(`Creating table: ${tableName}`);
+        await this.adapter.raw(ddl);
+      } else {
+        const existingColumnsArray = currentSchema.columns[tableName] || [];
+        const existingColumnNames = new Set(existingColumnsArray.map((c) => c.split(" ")[0]?.replace(/"/g, "") || ""));
+        const configuredFields = new Set(collection.fields.map((f) => f.name));
+        for (const field of collection.fields) {
+          if (!existingColumnNames.has(field.name)) {
+            const ddl = this.adapter.addColumnDDL(tableName, field);
+            if (ddl) {
+              syncLog.info(`Adding column: ${tableName}.${field.name}`);
+              await this.adapter.raw(ddl);
+            }
+          }
+        }
+        for (const colName of existingColumnNames) {
+          if (colName === "id" || colName === "createdAt" || colName === "updatedAt")
+            continue;
+          if (!configuredFields.has(colName)) {
+            if (dropOrphan) {
+              if (this.adapter.dropColumnDDL) {
+                syncLog.info(`Dropping orphaned column: ${tableName}.${colName}`);
+                await this.adapter.raw(this.adapter.dropColumnDDL(tableName, colName));
+              }
+            } else {
+              syncLog.warn(`Orphaned column detected but not dropped: ${tableName}.${colName}`);
+            }
+          }
+        }
+      }
+    }
+  }
+  cron(name, schedule, handler) {
+    return this.cronManager?.registerJob?.(name, schedule, () => {
+      handler(this);
+    });
+  }
+  async fetch(req) {
+    const rateLimitResponse = await this.rateLimiter.check(req);
+    if (rateLimitResponse)
+      return rateLimitResponse;
+    let ctx;
+    try {
+      ctx = await this.getContext(req);
+      for (const plugin of this.plugins) {
+        if (plugin.beforeRequest) {
+          await plugin.beforeRequest(ctx);
+        }
+      }
+      let executionPromise = this.router.handle(req, undefined, ctx.user, this).then((r) => r || new Response("Not found", { status: 404 }));
+      const timeoutMs = this.schema.core?.api?.requestTimeoutMs;
+      console.log(`[TEST DEBUG] fetch url=${req.url}, timeoutMs=${timeoutMs}`);
+      if (timeoutMs) {
+        let timeoutHandle;
+        const timeoutPromise = new Promise((_, reject) => {
+          timeoutHandle = setTimeout(() => reject(new CequreError("Request Timeout", "TIMEOUT", 408)), timeoutMs);
+        });
+        executionPromise = Promise.race([
+          executionPromise.finally(() => clearTimeout(timeoutHandle)),
+          timeoutPromise
+        ]);
+      }
+      let res = await executionPromise;
+      for (const plugin of this.plugins) {
+        if (plugin.afterRequest) {
+          await plugin.afterRequest(ctx, res);
+        }
+      }
+      return res;
+    } catch (err) {
+      if (!ctx)
+        ctx = { request: req, user: null, cequre: this };
+      for (const plugin of this.plugins) {
+        if (plugin.onError) {
+          const customRes = await plugin.onError(ctx, err);
+          if (customRes instanceof Response)
+            return customRes;
+        }
+      }
+      if (!(err instanceof CequreError)) {
+        log.error({ err }, "Unhandled error in request pipeline");
+      }
+      return toErrorResponse(err, req, this.adapter);
+    }
+  }
+  async start(options = {}) {
+    if (false) {}
+    for (const plugin of this.plugins) {
+      if (plugin.onInit) {
+        await plugin.onInit(this);
+      }
+    }
+    if (process.env.CEQURE_DEV) {
+      log.info("Connecting to database...");
+      const g = globalThis;
+      if (g.__cequre_active_adapter && g.__cequre_active_adapter !== this.adapter) {
+        try {
+          await g.__cequre_active_adapter.disconnect();
+        } catch (e) {}
+      }
+      g.__cequre_active_adapter = this.adapter;
+    }
+    await this.adapter.connect();
+    if (this.adapter.configureCollections) {
+      await this.adapter.configureCollections(this.schema.collections);
+    }
+    if (process.env.CEQURE_DEV) {
+      log.info("Connected to database.");
+    }
+    await this.syncDatabaseSchema();
+    await this.buildRoutes();
+    this.queue.startWorker();
+    if (process.env.CEQURE_CLI_GENERATE) {
+      const { generateTypeScriptClientSDK: generateTypeScriptClientSDK2 } = (init_sdk(), __toCommonJS(exports_sdk));
+      const sdkCode = generateTypeScriptClientSDK2(this.schema, this.router.list());
+      process.stdout.write(`---CEQURE_SDK_START---
+` + sdkCode + `
+---CEQURE_SDK_END---
+`);
+      if (this.adapter?.disconnect) {
+        try {
+          await this.adapter.disconnect();
+        } catch {}
+      }
+      process.exit(0);
+    }
+    const nativeRoutes = this.router.toNativeRoutes({
+      cequre: this,
+      plugins: this.plugins,
+      monitoring: this.monitoring,
+      requestId: this.schema.monitoring?.requestId,
+      cors: this.schema.security?.cors,
+      csrfTrustedOrigins: this.schema.security?.csrfTrustedOrigins,
+      rateLimiter: this.rateLimiter,
+      resolveUser: async (request) => {
+        const ctx = await this.getContext(request);
+        return ctx.user;
+      },
+      maxBodyBytes: this.schema.core?.api?.maxBodyBytes,
+      idempotencyKV: this.idempotencyKV,
+      headers: {
+        ...this.schema.security?.headers?.enabled ? {
+          "X-Content-Type-Options": "nosniff",
+          "X-Frame-Options": "DENY",
+          "X-XSS-Protection": "1; mode=block",
+          "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+          "Referrer-Policy": "strict-origin-when-cross-origin",
+          "Permissions-Policy": "geolocation=(), microphone=(), camera=()",
+          ...this.schema.security.headers.contentSecurityPolicy === false ? {} : { "Content-Security-Policy": this.schema.security.headers.contentSecurityPolicy ?? "default-src 'self'" }
+        } : {},
+        ...this.isDeprecatedVersion ? {
+          Deprecation: "true",
+          ...this.schema.core?.api?.sunsetDate ? { Sunset: this.schema.core.api.sunsetDate } : {}
+        } : {}
+      }
+    });
+    const hasPlugins = this.plugins.length > 0;
+    let maxRequestBodySize;
+    const bodyLimitStr = this.schema.core?.bodyLimit;
+    if (typeof bodyLimitStr === "string") {
+      const match = bodyLimitStr.match(/^(\d+)(kb|mb|gb|b)?$/i);
+      if (match) {
+        const val = parseInt(match[1]);
+        const unit = match[2]?.toLowerCase() || "b";
+        if (unit === "b")
+          maxRequestBodySize = val;
+        if (unit === "kb")
+          maxRequestBodySize = val * 1024;
+        if (unit === "mb")
+          maxRequestBodySize = val * 1024 * 1024;
+        if (unit === "gb")
+          maxRequestBodySize = val * 1024 * 1024 * 1024;
+      }
+    } else if (typeof bodyLimitStr === "number") {
+      maxRequestBodySize = bodyLimitStr;
+    }
+    let finalTls = options.tls;
+    if (!finalTls && this.schema.security?.tls) {
+      const dslTls = this.schema.security.tls;
+      if (dslTls.cert && dslTls.key) {
+        finalTls = {
+          cert: dslTls.cert,
+          key: dslTls.key,
+          passphrase: dslTls.passphrase,
+          serverName: dslTls.serverName
+        };
+      }
+    }
+    let server;
+    if (!this.serverProvider) {
+      console.warn("\u26A0\uFE0F No ServerProvider configured in CequreRuntime. The HTTP server will not start automatically.");
+      server = { port: options.port || 3000, stop: () => {} };
+    } else {
+      server = this.serverProvider.start({
+        port: options.port ?? (process.env.PORT ? parseInt(process.env.PORT, 10) : 3000),
+        tls: finalTls,
+        ...maxRequestBodySize ? { maxRequestBodySize } : {},
+        routes: nativeRoutes,
+        fetch: async (req) => {
+          if (this.shuttingDown) {
+            return new Response("Service Unavailable", { status: 503, headers: { Connection: "close" } });
+          }
+          const method = req.method;
+          const idempotencyKey = req.headers.get("idempotency-key");
+          if (idempotencyKey && (method === "POST" || method === "PUT" || method === "PATCH") && this.idempotencyKV) {
+            const cacheKey = `idempotency:${idempotencyKey}`;
+            const cached = await this.idempotencyKV.get(cacheKey);
+            if (cached) {
+              const { status, body, contentType } = JSON.parse(cached);
+              return new Response(body, { status, headers: { "Content-Type": contentType || "application/json", "X-Idempotent-Replay": "true" } });
+            }
+          }
+          this.inFlightRequests++;
+          try {
+            const rateLimitResponse = await this.rateLimiter.check(req);
+            if (rateLimitResponse)
+              return rateLimitResponse;
+            if (!hasPlugins)
+              return new Response("Not found", { status: 404 });
+            let ctx;
+            try {
+              ctx = await this.getContext(req);
+              for (const plugin of this.plugins) {
+                if (plugin.beforeRequest)
+                  await plugin.beforeRequest(ctx);
+              }
+              let executionPromise = (async () => {
+                let r2 = await this.router.handle(req, undefined, ctx.user, this);
+                return r2 || new Response("Not found", { status: 404 });
+              })();
+              const timeoutMs = this.schema.core?.api?.requestTimeoutMs;
+              let timeoutHandle;
+              if (timeoutMs) {
+                const timeoutPromise = new Promise((_, reject) => {
+                  timeoutHandle = setTimeout(() => reject(new CequreError("Request Timeout", "TIMEOUT", 408)), timeoutMs);
+                });
+                executionPromise = Promise.race([
+                  executionPromise.finally(() => clearTimeout(timeoutHandle)),
+                  timeoutPromise
+                ]);
+              }
+              let res = await executionPromise;
+              for (const plugin of this.plugins) {
+                if (plugin.afterRequest)
+                  await plugin.afterRequest(ctx, res);
+              }
+              return res;
+            } catch (err) {
+              if (!ctx)
+                ctx = { request: req, user: null, cequre: this };
+              for (const plugin of this.plugins) {
+                if (plugin.onError) {
+                  const customRes = await plugin.onError(ctx, err);
+                  if (customRes instanceof Response)
+                    return customRes;
+                }
+              }
+              if (!(err instanceof CequreError)) {
+                log.error({ err }, "Unhandled error in request pipeline");
+              }
+              return toErrorResponse(err, req, this.adapter);
+            }
+          } finally {
+            this.inFlightRequests--;
+          }
+        },
+        websocket: this.realtimeProvider?.websocket?.handlers?.()
+      });
+    }
+    const originalStop = server.stop.bind(server);
+    const drainTimeoutMs = options.drainTimeoutMs ?? (process.env.CEQURE_DEV ? 0 : 30000);
+    server.stop = (closeActiveConnections) => {
+      this.shuttingDown = true;
+      this.cronManager?.stopAll?.();
+      this.queue.stopWorker();
+      if (this.auditRetentionTimer)
+        clearInterval(this.auditRetentionTimer);
+      if (this.monitoring)
+        this.monitoring.stop().catch(() => {});
+      const drainPromise = new Promise((resolve) => {
+        const start = Date.now();
+        const checkInterval = setInterval(() => {
+          if (this.inFlightRequests === 0 || Date.now() - start > drainTimeoutMs) {
+            clearInterval(checkInterval);
+            if (this.inFlightRequests > 0) {
+              log.warn({ inFlight: this.inFlightRequests, drainTimeoutMs }, "Drain timeout reached \u2014 closing with in-flight requests");
+            }
+            resolve();
+          }
+        }, 50);
+      });
+      drainPromise.then(async () => {
+        if (this.adapter?.disconnect) {
+          try {
+            await this.adapter.disconnect();
+          } catch {}
+        }
+        log.info("Graceful shutdown complete");
+        originalStop(closeActiveConnections);
+      });
+      return drainPromise;
+    };
+    process.on("SIGTERM", () => {
+      log.info("SIGTERM received \u2014 initiating graceful shutdown");
+      server.stop(true);
+    });
+    const r = "\x1B[38;2;34;211;238m";
+    const w = "\x1B[38;2;255;255;255m";
+    const d = "\x1B[38;2;161;161;170m";
+    const b = "\x1B[1m";
+    const reset = "\x1B[0m";
+    const banner = `
+${r}${b}    ____                          ${reset}
+${r}${b}   / ___|___  __ _ _   _ _ __ ___ ${reset}
+${r}${b}  | |   / _ \\/ _\` | | | | '__/ _ \\${reset}
+${r}${b}  | |__|  __/ (_| | |_| | | |  __/${reset}
+${r}${b}   \\____\\___|\\__, |\\__,_|_|  \\___|${reset}
+${r}${b}                |_|               ${reset}
+ 
+ ${w}\u2728 Cequre Engine Online${reset}
+ ${d}\uD83C\uDF0D http://localhost:${server?.port}${reset}
+`;
+    if (!process.env.CEQURE_DEV) {
+      console.log(banner);
+    } else {
+      const p = server ? server.port : options.port;
+      console.log(`\uD83D\uDE80 Cequre API Framework started gracefully on port ${p}`);
+    }
+    return server;
+  }
+}
+
+// index.ts
+init_kv();
+init_logger();
+
+// shared/utils/duration.ts
+function parseDuration(duration) {
+  const match = duration.match(/^(\d+)([smhd])$/);
+  if (!match) {
+    return 86400;
+  }
+  const value = parseInt(match[1] || "0", 10);
+  switch (match[2]) {
+    case "s":
+      return value;
+    case "m":
+      return value * 60;
+    case "h":
+      return value * 3600;
+    case "d":
+      return value * 86400;
+    default:
+      return 86400;
+  }
+}
+
+// index.ts
+import { Type } from "@sinclair/typebox";
+export {
+  validateUpdate,
+  validateCreate,
+  ulid,
+  toErrorResponse,
+  timingSafeEqual,
+  Type as t,
+  sseManager,
+  sqlLiteral,
+  sqlIdentifier,
+  sortPlugins,
+  sha256Hex,
+  requestContextStorage,
+  populateDocuments,
+  parseQuery,
+  parseDuration,
+  parseConstraintError,
+  logger,
+  getConstraintErrorStatus,
+  getConstraintErrorMessage,
+  generateTypeScriptClientSDK,
+  generateSharedModels,
+  generateScalarHTML,
+  generateOpenAPISpec,
+  generateBackendSchemas,
+  extractPathname,
+  createRouter,
+  createRouteContext,
+  createMailer,
+  createLogger,
+  createBunSSERoute,
+  compileRouteHandler,
+  buildErrorResponse,
+  buildCollectionUpdateSchema,
+  buildCollectionCreateSchema,
+  SSEManager,
+  MemoryStreamStore,
+  MemoryCacheStore,
+  CequreStreamMedia,
+  CequreSSE,
+  CequreRuntime,
+  CequreRouter,
+  CequreQueueManager,
+  CequreMailer,
+  CequreKV,
+  CequreErrorLogs,
+  CequreError,
+  CequreDurableQueue,
+  BaseSqlAdapter
+};