@edgebasejs/worker 0.1.8

package/dist/worker/src/index.js

@@ -0,0 +1,2470 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { ServerSyncEngine, hashPassword, verifyPassword, createJWT, parseJWT, SubscriptionManager, ChangeNotifier, TransactionManager, BatchProcessor, CSVProcessor, FileStorageManager, WebhookManager, SearchManager, AuditManager, EncryptionManager, } from '@edgebasejs/core';
+import { D1SyncDatabase, initializeDatabase } from '@edgebasejs/adapter-d1';
+function jsonError(c, status, error, code) {
+    return c.json({ error, ...(code ? { code } : {}) }, status);
+}
+function getBearerToken(c) {
+    const auth = c.req.header('Authorization');
+    if (!auth) {
+        return null;
+    }
+    return auth.replace(/^Bearer\s+/i, '').trim() || null;
+}
+export function createEdgeBaseWorker(options) {
+    const { schema, getDb, getJwtSecret, getEnvironment, cors: corsOptions, apiVersion = '0.1.0', autoInitialize = false, } = options;
+    const app = new Hono();
+    app.use('*', cors(corsOptions));
+    let dbInitialized = false;
+    let subscriptionManager = null;
+    let changeNotifier = null;
+    let transactionManager = null;
+    let webhookManager = null;
+    let searchManager = null;
+    let auditManager = null;
+    let encryptionManager = null;
+    app.use('*', async (c, next) => {
+        const shouldAutoInit = typeof autoInitialize === 'function' ? autoInitialize(c) : autoInitialize;
+        if (shouldAutoInit && !dbInitialized) {
+            try {
+                await initializeDatabase(getDb(c), schema);
+                dbInitialized = true;
+                // Initialize managers
+                const db = new D1SyncDatabase(getDb(c));
+                subscriptionManager = new SubscriptionManager(db);
+                changeNotifier = new ChangeNotifier(subscriptionManager);
+                transactionManager = new TransactionManager(db);
+                webhookManager = new WebhookManager(db);
+                searchManager = new SearchManager(db);
+                auditManager = new AuditManager(db);
+                encryptionManager = new EncryptionManager();
+                // Initialize encryption key if provided
+                const getEncryptionKey = options.getEncryptionKey;
+                if (getEncryptionKey) {
+                    const encryptionKey = getEncryptionKey(c);
+                    if (encryptionKey) {
+                        await encryptionManager.initializeKey(encryptionKey);
+                    }
+                }
+                // Load existing subscriptions from database
+                await subscriptionManager.loadFromDatabase();
+            }
+            catch (error) {
+                console.error('Database initialization error:', error);
+            }
+        }
+        await next();
+    });
+    async function requireAccessUser(c) {
+        const token = getBearerToken(c);
+        if (!token) {
+            return jsonError(c, 401, 'Unauthorized', 'UNAUTHORIZED');
+        }
+        const payload = parseJWT(token);
+        if (!payload || payload.type !== 'access') {
+            return jsonError(c, 401, 'Invalid token', 'UNAUTHORIZED');
+        }
+        const db = getDb(c);
+        const userRow = await db
+            .prepare('SELECT id, email, created_at, updated_at FROM users WHERE id = ?')
+            .bind(payload.userId)
+            .first();
+        if (!userRow) {
+            return jsonError(c, 401, 'User not found', 'UNAUTHORIZED');
+        }
+        const user = {
+            id: userRow.id,
+            email: userRow.email,
+            createdAt: userRow.created_at,
+            updatedAt: userRow.updated_at,
+        };
+        return { user, payload };
+    }
+    async function requireAccessAdmin(c) {
+        const token = getBearerToken(c);
+        if (!token) {
+            return jsonError(c, 401, 'Unauthorized', 'UNAUTHORIZED');
+        }
+        const payload = parseJWT(token);
+        if (!payload || payload.type !== 'access') {
+            return jsonError(c, 401, 'Invalid token', 'UNAUTHORIZED');
+        }
+        const db = getDb(c);
+        const adminRow = await db
+            .prepare('SELECT id, email, role, is_active, created_at, updated_at FROM admins WHERE id = ?')
+            .bind(payload.userId)
+            .first();
+        if (!adminRow || !adminRow.is_active) {
+            return jsonError(c, 401, 'Admin not found', 'UNAUTHORIZED');
+        }
+        const admin = {
+            id: adminRow.id,
+            email: adminRow.email,
+            role: adminRow.role,
+            isActive: adminRow.is_active === 1,
+            createdAt: adminRow.created_at,
+            updatedAt: adminRow.updated_at,
+        };
+        return { admin, payload };
+    }
+    async function hasAnyAdmin(db) {
+        const row = await db.prepare('SELECT id FROM admins LIMIT 1').first();
+        return !!row;
+    }
+    async function hasUserId(db, userId) {
+        const row = await db.prepare('SELECT id FROM users WHERE id = ?').bind(userId).first();
+        return !!row;
+    }
+    async function listTables(db) {
+        const tablesResult = await db
+            .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name")
+            .all();
+        return (tablesResult?.results || []).map((row) => row.name);
+    }
+    function requireValidTableName(tableName, allowed) {
+        if (!allowed.includes(tableName)) {
+            return null;
+        }
+        return tableName.replace(/"/g, '""');
+    }
+    function isEntityTable(tableName) {
+        return !!schema.entities[tableName];
+    }
+    function getEntityPrimaryKey(tableName) {
+        const entity = schema.entities[tableName];
+        if (!entity)
+            return null;
+        const primary = Object.entries(entity.fields).find(([, field]) => field.primary);
+        return primary ? primary[0] : 'id';
+    }
+    async function updateSyncMetadata(db, entity, recordId, deletedAt) {
+        const now = Date.now();
+        const existing = await db
+            .prepare('SELECT version FROM sync_metadata WHERE entity = ? AND record_id = ?')
+            .bind(entity, recordId)
+            .first();
+        const currentVersion = existing?.version || 0;
+        const nextVersion = currentVersion + 1;
+        if (deletedAt) {
+            await db
+                .prepare('INSERT OR REPLACE INTO sync_metadata (entity, record_id, version, updated_at, deleted_at) VALUES (?, ?, ?, ?, ?)')
+                .bind(entity, recordId, nextVersion, now, deletedAt)
+                .run();
+        }
+        else {
+            await db
+                .prepare('INSERT OR REPLACE INTO sync_metadata (entity, record_id, version, updated_at) VALUES (?, ?, ?, ?)')
+                .bind(entity, recordId, nextVersion, now)
+                .run();
+        }
+        return nextVersion;
+    }
+    async function notifyAdminChange(entity, operation, record, recordId, version) {
+        if (!subscriptionManager || !changeNotifier) {
+            return;
+        }
+        const subscriptions = subscriptionManager.getSubscriptionsForEntity(entity);
+        if (subscriptions.length === 0) {
+            return;
+        }
+        const message = {
+            type: 'change',
+            entity,
+            operation,
+            record: operation !== 'delete' ? record : undefined,
+            recordId,
+            timestamp: Date.now(),
+            version,
+        };
+        changeNotifier.broadcastToAll(message, subscriptions.map((sub) => sub.subscriptionId));
+    }
+    /**
+     * GET /health
+     */
+    app.get('/health', (c) => {
+        return c.json({ status: 'ok', version: apiVersion });
+    });
+    /**
+     * GET /info
+     */
+    app.get('/info', (c) => {
+        return c.json({
+            name: 'EdgeBase Worker',
+            version: apiVersion,
+            environment: getEnvironment ? getEnvironment(c) || 'unknown' : 'unknown',
+        });
+    });
+    /**
+     * POST /auth/register
+     */
+    app.post('/auth/register', async (c) => {
+        try {
+            const { email, password } = await c.req.json();
+            if (!email || !password) {
+                return jsonError(c, 400, 'Email and password are required', 'VALIDATION_ERROR');
+            }
+            const db = getDb(c);
+            const jwtSecret = getJwtSecret(c);
+            // Check if user already exists
+            const existing = await db.prepare('SELECT id FROM users WHERE email = ?').bind(email).first();
+            if (existing) {
+                return jsonError(c, 409, 'User already exists', 'CONFLICT');
+            }
+            // Hash password
+            const passwordHash = await hashPassword(password);
+            // Create user
+            const userId = `user_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+            const now = Date.now();
+            await db
+                .prepare('INSERT INTO users (id, email, password_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?)')
+                .bind(userId, email, passwordHash, now, now)
+                .run();
+            // Generate tokens
+            const accessToken = createJWT({ userId, email, type: 'access' }, jwtSecret, 3600);
+            const refreshToken = createJWT({ userId, email, type: 'refresh' }, jwtSecret, 604800);
+            // Store refresh token
+            const refreshTokenId = `rt_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+            await db
+                .prepare('INSERT INTO refresh_tokens (id, user_id, token, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+                .bind(refreshTokenId, userId, refreshToken, now + 604800000, now)
+                .run();
+            const user = {
+                id: userId,
+                email,
+                createdAt: now,
+                updatedAt: now,
+            };
+            const response = {
+                user,
+                tokens: {
+                    accessToken,
+                    refreshToken,
+                    expiresIn: 3600,
+                },
+            };
+            return c.json(response, 201);
+        }
+        catch (error) {
+            console.error('Register error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Registration failed', 'VALIDATION_ERROR');
+        }
+    });
+    /**
+     * POST /auth/login
+     */
+    app.post('/auth/login', async (c) => {
+        try {
+            const { email, password } = await c.req.json();
+            if (!email || !password) {
+                return jsonError(c, 400, 'Email and password are required', 'VALIDATION_ERROR');
+            }
+            const db = getDb(c);
+            const jwtSecret = getJwtSecret(c);
+            // Get user from DB
+            const userRow = await db
+                .prepare('SELECT id, email, password_hash, created_at, updated_at FROM users WHERE email = ?')
+                .bind(email)
+                .first();
+            if (!userRow) {
+                return jsonError(c, 401, 'Invalid credentials', 'UNAUTHORIZED');
+            }
+            // Verify password
+            const passwordValid = await verifyPassword(password, userRow.password_hash);
+            if (!passwordValid) {
+                return jsonError(c, 401, 'Invalid credentials', 'UNAUTHORIZED');
+            }
+            // Generate tokens
+            const accessToken = createJWT({ userId: userRow.id, email: userRow.email, type: 'access' }, jwtSecret, 3600);
+            const refreshToken = createJWT({ userId: userRow.id, email: userRow.email, type: 'refresh' }, jwtSecret, 604800);
+            // Store refresh token
+            const now = Date.now();
+            const refreshTokenId = `rt_${now}_${Math.random().toString(36).substr(2, 9)}`;
+            await db
+                .prepare('INSERT INTO refresh_tokens (id, user_id, token, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+                .bind(refreshTokenId, userRow.id, refreshToken, now + 604800000, now)
+                .run();
+            const user = {
+                id: userRow.id,
+                email: userRow.email,
+                createdAt: userRow.created_at,
+                updatedAt: userRow.updated_at,
+            };
+            const response = {
+                user,
+                tokens: {
+                    accessToken,
+                    refreshToken,
+                    expiresIn: 3600,
+                },
+            };
+            return c.json(response);
+        }
+        catch (error) {
+            console.error('Login error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Login failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /admin/auth/login
+     */
+    app.post('/admin/auth/login', async (c) => {
+        try {
+            const body = await c.req.json();
+            const { email, password } = body || {};
+            if (!email || !password) {
+                return jsonError(c, 400, 'Email and password are required', 'VALIDATION_ERROR');
+            }
+            const db = getDb(c);
+            const jwtSecret = getJwtSecret(c);
+            const adminRow = await db
+                .prepare('SELECT id, email, password_hash, role, is_active, created_at, updated_at FROM admins WHERE email = ?')
+                .bind(email)
+                .first();
+            if (!adminRow || !adminRow.is_active) {
+                return jsonError(c, 401, 'Invalid credentials', 'UNAUTHORIZED');
+            }
+            const passwordValid = await verifyPassword(password, adminRow.password_hash);
+            if (!passwordValid) {
+                return jsonError(c, 401, 'Invalid credentials', 'UNAUTHORIZED');
+            }
+            const accessToken = createJWT({ userId: adminRow.id, email: adminRow.email, type: 'access' }, jwtSecret, 3600);
+            const refreshToken = createJWT({ userId: adminRow.id, email: adminRow.email, type: 'refresh' }, jwtSecret, 604800);
+            const now = Date.now();
+            const refreshTokenId = `art_${now}_${Math.random().toString(36).substr(2, 9)}`;
+            await db
+                .prepare('INSERT INTO admin_refresh_tokens (id, admin_id, token, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
+                .bind(refreshTokenId, adminRow.id, refreshToken, now + 604800000, now)
+                .run();
+            const admin = {
+                id: adminRow.id,
+                email: adminRow.email,
+                role: adminRow.role,
+                isActive: adminRow.is_active === 1,
+                createdAt: adminRow.created_at,
+                updatedAt: adminRow.updated_at,
+            };
+            const response = {
+                admin,
+                accessToken,
+                refreshToken,
+                expiresIn: 3600,
+            };
+            return c.json(response);
+        }
+        catch (error) {
+            console.error('Admin login error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Login failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /admin/auth/refresh
+     */
+    app.post('/admin/auth/refresh', async (c) => {
+        try {
+            const body = await c.req.json();
+            const refreshToken = body?.refreshToken;
+            if (!refreshToken) {
+                return jsonError(c, 400, 'Refresh token is required', 'VALIDATION_ERROR');
+            }
+            const payload = parseJWT(refreshToken);
+            if (!payload || payload.type !== 'refresh') {
+                return jsonError(c, 401, 'Invalid refresh token', 'UNAUTHORIZED');
+            }
+            const db = getDb(c);
+            const jwtSecret = getJwtSecret(c);
+            const tokenRow = await db
+                .prepare(`SELECT r.admin_id, r.expires_at, a.email
+           FROM admin_refresh_tokens r
+           JOIN admins a ON a.id = r.admin_id
+           WHERE r.token = ?`)
+                .bind(refreshToken)
+                .first();
+            if (!tokenRow) {
+                return jsonError(c, 401, 'Invalid refresh token', 'UNAUTHORIZED');
+            }
+            if (tokenRow.expires_at < Date.now()) {
+                await db
+                    .prepare('DELETE FROM admin_refresh_tokens WHERE token = ?')
+                    .bind(refreshToken)
+                    .run();
+                return jsonError(c, 401, 'Refresh token expired', 'UNAUTHORIZED');
+            }
+            const accessToken = createJWT({ userId: tokenRow.admin_id, email: tokenRow.email, type: 'access' }, jwtSecret, 3600);
+            return c.json({ accessToken, expiresIn: 3600 });
+        }
+        catch (error) {
+            console.error('Admin refresh token error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Token refresh failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /admin/auth/logout
+     */
+    app.post('/admin/auth/logout', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            await db
+                .prepare('DELETE FROM admin_refresh_tokens WHERE admin_id = ?')
+                .bind(auth.admin.id)
+                .run();
+            return c.json({ message: 'Logged out successfully', adminId: auth.admin.id });
+        }
+        catch (error) {
+            console.error('Admin logout error:', error);
+            return jsonError(c, 500, 'Logout failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/admins
+     */
+    app.get('/admin/admins', async (c) => {
+        try {
+            const db = getDb(c);
+            const anyAdmin = await hasAnyAdmin(db);
+            if (!anyAdmin) {
+                return c.json([]);
+            }
+            const auth = await requireAccessAdmin(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const rows = await db
+                .prepare('SELECT id, email, role, is_active, created_at, updated_at FROM admins')
+                .all();
+            const admins = (rows?.results || []).map((row) => ({
+                id: row.id,
+                email: row.email,
+                role: row.role,
+                isActive: row.is_active === 1,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            }));
+            return c.json(admins);
+        }
+        catch (error) {
+            console.error('Admin list error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch admins', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /admin/admins
+     */
+    app.post('/admin/admins', async (c) => {
+        try {
+            const db = getDb(c);
+            const anyAdmin = await hasAnyAdmin(db);
+            if (anyAdmin) {
+                const auth = await requireAccessAdmin(c);
+                if (auth instanceof Response) {
+                    return auth;
+                }
+                if (auth.admin.role !== 'super_admin') {
+                    return jsonError(c, 403, 'Insufficient permissions', 'FORBIDDEN');
+                }
+            }
+            const body = await c.req.json();
+            const { email, password, role } = body || {};
+            if (!email || !password || !role) {
+                return jsonError(c, 400, 'Email, password, and role are required', 'VALIDATION_ERROR');
+            }
+            const existing = await db.prepare('SELECT id FROM admins WHERE email = ?').bind(email).first();
+            if (existing) {
+                return jsonError(c, 409, 'Admin already exists', 'CONFLICT');
+            }
+            const passwordHash = await hashPassword(password);
+            const adminId = `admin_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+            const now = Date.now();
+            await db
+                .prepare('INSERT INTO admins (id, email, password_hash, role, is_active, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)')
+                .bind(adminId, email, passwordHash, role, 1, now, now)
+                .run();
+            const admin = {
+                id: adminId,
+                email,
+                role,
+                isActive: true,
+                createdAt: now,
+                updatedAt: now,
+            };
+            return c.json(admin, 201);
+        }
+        catch (error) {
+            console.error('Admin create error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Admin creation failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/users
+     */
+    app.get('/admin/users', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const page = Math.max(parseInt(c.req.query('page') || '1', 10), 1);
+            const pageSize = Math.min(Math.max(parseInt(c.req.query('pageSize') || '20', 10), 1), 100);
+            const search = c.req.query('search');
+            const offset = (page - 1) * pageSize;
+            const params = [];
+            let whereClause = '';
+            if (search) {
+                whereClause = 'WHERE email LIKE ?';
+                params.push(`%${search}%`);
+            }
+            const countRow = await db
+                .prepare(`SELECT COUNT(*) as total FROM users ${whereClause}`)
+                .bind(...params)
+                .first();
+            const total = countRow?.total || 0;
+            const usersResult = await db
+                .prepare(`SELECT id, email, created_at, updated_at FROM users ${whereClause} ORDER BY created_at DESC LIMIT ? OFFSET ?`)
+                .bind(...params, pageSize, offset)
+                .all();
+            const data = (usersResult?.results || []).map((row) => ({
+                id: row.id,
+                email: row.email,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            }));
+            return c.json({
+                data,
+                pagination: {
+                    page,
+                    pageSize,
+                    total,
+                    totalPages: Math.ceil(total / pageSize) || 1,
+                },
+            });
+        }
+        catch (error) {
+            console.error('Admin users list error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch users', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/users/:id
+     */
+    app.get('/admin/users/:id', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const userId = c.req.param('id');
+            const row = await db
+                .prepare('SELECT id, email, created_at, updated_at FROM users WHERE id = ?')
+                .bind(userId)
+                .first();
+            if (!row) {
+                return jsonError(c, 404, 'User not found', 'NOT_FOUND');
+            }
+            return c.json({
+                id: row.id,
+                email: row.email,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            });
+        }
+        catch (error) {
+            console.error('Admin get user error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch user', 'API_ERROR');
+        }
+    });
+    /**
+     * PATCH /admin/users/:id
+     */
+    app.patch('/admin/users/:id', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const userId = c.req.param('id');
+            const updates = await c.req.json();
+            const fields = [];
+            const values = [];
+            if (typeof updates.email === 'string' && updates.email.trim()) {
+                fields.push('email = ?');
+                values.push(updates.email.trim());
+            }
+            if (fields.length === 0) {
+                return jsonError(c, 400, 'No valid fields to update', 'VALIDATION_ERROR');
+            }
+            fields.push('updated_at = ?');
+            values.push(Date.now());
+            await db
+                .prepare(`UPDATE users SET ${fields.join(', ')} WHERE id = ?`)
+                .bind(...values, userId)
+                .run();
+            const row = await db
+                .prepare('SELECT id, email, created_at, updated_at FROM users WHERE id = ?')
+                .bind(userId)
+                .first();
+            if (!row) {
+                return jsonError(c, 404, 'User not found', 'NOT_FOUND');
+            }
+            return c.json({
+                id: row.id,
+                email: row.email,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+            });
+        }
+        catch (error) {
+            console.error('Admin update user error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to update user', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /admin/users/:id
+     */
+    app.delete('/admin/users/:id', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const userId = c.req.param('id');
+            const existing = await db.prepare('SELECT id FROM users WHERE id = ?').bind(userId).first();
+            if (!existing) {
+                return jsonError(c, 404, 'User not found', 'NOT_FOUND');
+            }
+            await db.prepare('DELETE FROM users WHERE id = ?').bind(userId).run();
+            return c.json({ success: true, message: 'User deleted' });
+        }
+        catch (error) {
+            console.error('Admin delete user error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to delete user', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/database/tables
+     */
+    app.get('/admin/database/tables', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const tableNames = await listTables(db);
+            const tables = [];
+            for (const name of tableNames) {
+                const safeName = requireValidTableName(name, tableNames);
+                if (!safeName)
+                    continue;
+                const countRow = await db
+                    .prepare(`SELECT COUNT(*) as count FROM "${safeName}"`)
+                    .first();
+                tables.push({ name, rowCount: countRow?.count || 0 });
+            }
+            return c.json(tables);
+        }
+        catch (error) {
+            console.error('Admin tables error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch tables', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/database/tables/:name/schema
+     */
+    app.get('/admin/database/tables/:name/schema', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const tableName = c.req.param('name');
+            const tableNames = await listTables(db);
+            const safeName = requireValidTableName(tableName, tableNames);
+            if (!safeName) {
+                return jsonError(c, 404, 'Table not found', 'NOT_FOUND');
+            }
+            const columnsResult = await db.prepare(`PRAGMA table_info("${safeName}")`).all();
+            const columns = (columnsResult?.results || []).map((row) => ({
+                name: row.name,
+                type: row.type,
+                nullable: row.notnull === 0,
+                primaryKey: row.pk === 1,
+                defaultValue: row.dflt_value,
+            }));
+            const primaryKey = columns.filter((col) => col.primaryKey).map((col) => col.name);
+            return c.json({
+                name: tableName,
+                columns,
+                primaryKey,
+            });
+        }
+        catch (error) {
+            console.error('Admin table schema error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch schema', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/database/tables/:name/data
+     */
+    app.get('/admin/database/tables/:name/data', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const tableName = c.req.param('name');
+            const tableNames = await listTables(db);
+            const safeName = requireValidTableName(tableName, tableNames);
+            if (!safeName) {
+                return jsonError(c, 404, 'Table not found', 'NOT_FOUND');
+            }
+            const page = Math.max(parseInt(c.req.query('page') || '1', 10), 1);
+            const pageSize = Math.min(Math.max(parseInt(c.req.query('pageSize') || '20', 10), 1), 200);
+            const offset = (page - 1) * pageSize;
+            const columnsResult = await db.prepare(`PRAGMA table_info("${safeName}")`).all();
+            const columns = (columnsResult?.results || []).map((row) => ({
+                name: row.name,
+                type: row.type,
+                nullable: row.notnull === 0,
+                primaryKey: row.pk === 1,
+                defaultValue: row.dflt_value,
+            }));
+            const countRow = await db
+                .prepare(`SELECT COUNT(*) as count FROM "${safeName}"`)
+                .first();
+            const total = countRow?.count || 0;
+            const dataResult = await db
+                .prepare(`SELECT * FROM "${safeName}" LIMIT ? OFFSET ?`)
+                .bind(pageSize, offset)
+                .all();
+            return c.json({
+                tableName,
+                data: dataResult?.results || [],
+                columns,
+                pagination: {
+                    page,
+                    pageSize,
+                    total,
+                    totalPages: Math.ceil(total / pageSize) || 1,
+                },
+            });
+        }
+        catch (error) {
+            console.error('Admin table data error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch table data', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /admin/database/tables/:name/rows
+     */
+    app.post('/admin/database/tables/:name/rows', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        const tableName = c.req.param('name');
+        if (!isEntityTable(tableName)) {
+            return jsonError(c, 403, 'Table is not editable via admin API', 'FORBIDDEN');
+        }
+        const primaryKey = getEntityPrimaryKey(tableName);
+        if (!primaryKey || primaryKey !== 'id') {
+            return jsonError(c, 400, 'Unsupported primary key for sync', 'VALIDATION_ERROR');
+        }
+        try {
+            const db = getDb(c);
+            const tableNames = await listTables(db);
+            const safeName = requireValidTableName(tableName, tableNames);
+            if (!safeName) {
+                return jsonError(c, 404, 'Table not found', 'NOT_FOUND');
+            }
+            const data = (await c.req.json());
+            const columnsResult = await db.prepare(`PRAGMA table_info("${safeName}")`).all();
+            const columns = (columnsResult?.results || []).map((row) => row.name);
+            if (!data.id) {
+                data.id = `${tableName}_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            }
+            if (columns.includes('createdAt') && data.createdAt == null)
+                data.createdAt = Date.now();
+            if (columns.includes('updatedAt') && data.updatedAt == null)
+                data.updatedAt = Date.now();
+            if (columns.includes('created_at') && data.created_at == null)
+                data.created_at = Date.now();
+            if (columns.includes('updated_at') && data.updated_at == null)
+                data.updated_at = Date.now();
+            const insertColumns = Object.keys(data).filter((key) => columns.includes(key));
+            if (!insertColumns.includes('id')) {
+                insertColumns.unshift('id');
+                data.id = data.id || `${tableName}_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            }
+            const placeholders = insertColumns.map(() => '?').join(', ');
+            const values = insertColumns.map((key) => data[key]);
+            await db
+                .prepare(`INSERT INTO "${safeName}" (${insertColumns.join(', ')}) VALUES (${placeholders})`)
+                .bind(...values)
+                .run();
+            const version = await updateSyncMetadata(db, tableName, data.id);
+            const row = await db
+                .prepare(`SELECT * FROM "${safeName}" WHERE id = ?`)
+                .bind(data.id)
+                .first();
+            await notifyAdminChange(tableName, 'create', row || data, data.id, version);
+            if (webhookManager) {
+                await webhookManager.triggerEvent({
+                    eventType: 'sync.create',
+                    entity: tableName,
+                    recordId: data.id,
+                    operation: 'create',
+                    data: row || data,
+                    userId: auth.admin.id,
+                });
+            }
+            if (auditManager && (await hasUserId(db, auth.admin.id))) {
+                await auditManager.logChange({
+                    id: auth.admin.id,
+                    email: auth.admin.email,
+                    createdAt: Date.now(),
+                    updatedAt: Date.now(),
+                }, tableName, data.id, 'create', undefined, row || data);
+            }
+            return c.json(row || data, 201);
+        }
+        catch (error) {
+            console.error('Admin create row error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to create row', 'API_ERROR');
+        }
+    });
+    /**
+     * PATCH /admin/database/tables/:name/rows/:id
+     */
+    app.patch('/admin/database/tables/:name/rows/:id', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        const tableName = c.req.param('name');
+        if (!isEntityTable(tableName)) {
+            return jsonError(c, 403, 'Table is not editable via admin API', 'FORBIDDEN');
+        }
+        const primaryKey = getEntityPrimaryKey(tableName);
+        if (!primaryKey || primaryKey !== 'id') {
+            return jsonError(c, 400, 'Unsupported primary key for sync', 'VALIDATION_ERROR');
+        }
+        try {
+            const db = getDb(c);
+            const tableNames = await listTables(db);
+            const safeName = requireValidTableName(tableName, tableNames);
+            if (!safeName) {
+                return jsonError(c, 404, 'Table not found', 'NOT_FOUND');
+            }
+            const recordId = c.req.param('id');
+            const updates = (await c.req.json());
+            const existing = await db
+                .prepare(`SELECT * FROM "${safeName}" WHERE id = ?`)
+                .bind(recordId)
+                .first();
+            if (!existing) {
+                return jsonError(c, 404, 'Record not found', 'NOT_FOUND');
+            }
+            const columnsResult = await db.prepare(`PRAGMA table_info("${safeName}")`).all();
+            const columns = (columnsResult?.results || []).map((row) => row.name);
+            if (columns.includes('updatedAt') && updates.updatedAt == null)
+                updates.updatedAt = Date.now();
+            if (columns.includes('updated_at') && updates.updated_at == null)
+                updates.updated_at = Date.now();
+            const updateColumns = Object.keys(updates).filter((key) => key !== 'id' && columns.includes(key));
+            if (updateColumns.length === 0) {
+                return jsonError(c, 400, 'No valid fields to update', 'VALIDATION_ERROR');
+            }
+            const assignments = updateColumns.map((key) => `${key} = ?`).join(', ');
+            const values = updateColumns.map((key) => updates[key]);
+            await db
+                .prepare(`UPDATE "${safeName}" SET ${assignments} WHERE id = ?`)
+                .bind(...values, recordId)
+                .run();
+            const version = await updateSyncMetadata(db, tableName, recordId);
+            const row = await db
+                .prepare(`SELECT * FROM "${safeName}" WHERE id = ?`)
+                .bind(recordId)
+                .first();
+            await notifyAdminChange(tableName, 'update', row || updates, recordId, version);
+            if (webhookManager) {
+                await webhookManager.triggerEvent({
+                    eventType: 'sync.update',
+                    entity: tableName,
+                    recordId,
+                    operation: 'update',
+                    data: row || updates,
+                    userId: auth.admin.id,
+                });
+            }
+            if (auditManager && (await hasUserId(db, auth.admin.id))) {
+                await auditManager.logChange({
+                    id: auth.admin.id,
+                    email: auth.admin.email,
+                    createdAt: Date.now(),
+                    updatedAt: Date.now(),
+                }, tableName, recordId, 'update', existing, row || updates);
+            }
+            return c.json(row || updates);
+        }
+        catch (error) {
+            console.error('Admin update row error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to update row', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /admin/database/tables/:name/rows/:id
+     */
+    app.delete('/admin/database/tables/:name/rows/:id', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        const tableName = c.req.param('name');
+        if (!isEntityTable(tableName)) {
+            return jsonError(c, 403, 'Table is not editable via admin API', 'FORBIDDEN');
+        }
+        const primaryKey = getEntityPrimaryKey(tableName);
+        if (!primaryKey || primaryKey !== 'id') {
+            return jsonError(c, 400, 'Unsupported primary key for sync', 'VALIDATION_ERROR');
+        }
+        try {
+            const db = getDb(c);
+            const tableNames = await listTables(db);
+            const safeName = requireValidTableName(tableName, tableNames);
+            if (!safeName) {
+                return jsonError(c, 404, 'Table not found', 'NOT_FOUND');
+            }
+            const recordId = c.req.param('id');
+            const existing = await db
+                .prepare(`SELECT * FROM "${safeName}" WHERE id = ?`)
+                .bind(recordId)
+                .first();
+            if (!existing) {
+                return jsonError(c, 404, 'Record not found', 'NOT_FOUND');
+            }
+            await db
+                .prepare(`DELETE FROM "${safeName}" WHERE id = ?`)
+                .bind(recordId)
+                .run();
+            const version = await updateSyncMetadata(db, tableName, recordId, Date.now());
+            await notifyAdminChange(tableName, 'delete', {}, recordId, version);
+            if (webhookManager) {
+                await webhookManager.triggerEvent({
+                    eventType: 'sync.delete',
+                    entity: tableName,
+                    recordId,
+                    operation: 'delete',
+                    data: {},
+                    userId: auth.admin.id,
+                });
+            }
+            if (auditManager && (await hasUserId(db, auth.admin.id))) {
+                await auditManager.logChange({
+                    id: auth.admin.id,
+                    email: auth.admin.email,
+                    createdAt: Date.now(),
+                    updatedAt: Date.now(),
+                }, tableName, recordId, 'delete', existing, undefined);
+            }
+            return c.json({ success: true });
+        }
+        catch (error) {
+            console.error('Admin delete row error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to delete row', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /admin/schemas
+     */
+    app.get('/admin/schemas', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        return c.json({
+            version: 1,
+            timestamp: Date.now(),
+            schemas: schema.entities,
+        });
+    });
+    /**
+     * GET /admin/activity
+     */
+    app.get('/admin/activity', async (c) => {
+        const auth = await requireAccessAdmin(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            const page = Math.max(parseInt(c.req.query('page') || '1', 10), 1);
+            const pageSize = Math.min(Math.max(parseInt(c.req.query('pageSize') || '20', 10), 1), 100);
+            const offset = (page - 1) * pageSize;
+            const conditions = [];
+            const params = [];
+            const adminId = c.req.query('adminId');
+            if (adminId) {
+                conditions.push('user_id = ?');
+                params.push(adminId);
+            }
+            const entityType = c.req.query('entityType');
+            if (entityType) {
+                conditions.push('entity = ?');
+                params.push(entityType);
+            }
+            const action = c.req.query('action');
+            if (action) {
+                conditions.push('operation = ?');
+                params.push(action);
+            }
+            const dateFrom = c.req.query('dateFrom');
+            if (dateFrom) {
+                conditions.push('created_at >= ?');
+                params.push(Number(dateFrom));
+            }
+            const dateTo = c.req.query('dateTo');
+            if (dateTo) {
+                conditions.push('created_at <= ?');
+                params.push(Number(dateTo));
+            }
+            const whereClause = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+            const countRow = await db
+                .prepare(`SELECT COUNT(*) as total FROM audit_logs ${whereClause}`)
+                .bind(...params)
+                .first();
+            const total = countRow?.total || 0;
+            const rows = await db
+                .prepare(`SELECT * FROM audit_logs ${whereClause} ORDER BY created_at DESC LIMIT ? OFFSET ?`)
+                .bind(...params, pageSize, offset)
+                .all();
+            const entries = [];
+            for (const row of rows?.results || []) {
+                const entity = row.entity;
+                const entityTypeValue = entity === 'admins' ? 'admin' : entity === 'users' ? 'user' : 'database';
+                entries.push({
+                    id: row.id,
+                    adminId: row.user_id,
+                    adminEmail: undefined,
+                    action: row.operation,
+                    entityType: entityTypeValue,
+                    entityId: row.record_id,
+                    details: row.changes ? JSON.parse(row.changes) : {},
+                    ipAddress: '',
+                    createdAt: row.created_at,
+                });
+            }
+            return c.json({
+                data: entries,
+                pagination: {
+                    page,
+                    pageSize,
+                    total,
+                    totalPages: Math.ceil(total / pageSize) || 1,
+                },
+            });
+        }
+        catch (error) {
+            console.error('Admin activity error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to fetch activity log', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /auth/refresh
+     */
+    app.post('/auth/refresh', async (c) => {
+        try {
+            const body = await c.req.json();
+            const refreshToken = body?.refreshToken;
+            if (!refreshToken) {
+                return jsonError(c, 400, 'Refresh token is required', 'VALIDATION_ERROR');
+            }
+            const payload = parseJWT(refreshToken);
+            if (!payload || payload.type !== 'refresh') {
+                return jsonError(c, 401, 'Invalid refresh token', 'UNAUTHORIZED');
+            }
+            const db = getDb(c);
+            const jwtSecret = getJwtSecret(c);
+            const tokenRow = await db
+                .prepare(`SELECT r.user_id, r.expires_at, u.email
+           FROM refresh_tokens r
+           JOIN users u ON u.id = r.user_id
+           WHERE r.token = ?`)
+                .bind(refreshToken)
+                .first();
+            if (!tokenRow) {
+                return jsonError(c, 401, 'Invalid refresh token', 'UNAUTHORIZED');
+            }
+            if (tokenRow.expires_at < Date.now()) {
+                await db.prepare('DELETE FROM refresh_tokens WHERE token = ?').bind(refreshToken).run();
+                return jsonError(c, 401, 'Refresh token expired', 'UNAUTHORIZED');
+            }
+            const accessToken = createJWT({ userId: tokenRow.user_id, email: tokenRow.email, type: 'access' }, jwtSecret, 3600);
+            return c.json({ accessToken, expiresIn: 3600 });
+        }
+        catch (error) {
+            console.error('Refresh token error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Token refresh failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /auth/logout
+     */
+    app.post('/auth/logout', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        try {
+            const db = getDb(c);
+            await db.prepare('DELETE FROM refresh_tokens WHERE user_id = ?').bind(auth.user.id).run();
+            return c.json({ message: 'Logged out successfully', userId: auth.user.id });
+        }
+        catch (error) {
+            console.error('Logout error:', error);
+            return jsonError(c, 500, 'Logout failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /sync
+     */
+    app.post('/sync', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            // Create sync database adapter
+            const db = new D1SyncDatabase(getDb(c));
+            // Create schemas map for ServerSyncEngine
+            const schemas = new Map();
+            for (const [entityName, entitySchema] of Object.entries(schema.entities)) {
+                schemas.set(entityName, entitySchema);
+            }
+            // Create sync engine
+            const syncEngine = new ServerSyncEngine({
+                schemas,
+                db,
+                user: auth.user,
+                encryption: encryptionManager || undefined,
+            });
+            // Process sync request
+            const request = await c.req.json();
+            const response = await syncEngine.sync(request);
+            // Broadcast changes to subscribed clients in real-time
+            if (changeNotifier && subscriptionManager) {
+                for (const change of response.changes) {
+                    // For each applied change, notify subscribed clients
+                    if (change.operation !== 'delete') {
+                        // For create/update, we have the full record
+                        await changeNotifier.notifyChange(change.entity, change.operation, change.data || {}, change.id, auth.user, change.version);
+                    }
+                    else {
+                        // For delete, notify with just the ID
+                        await changeNotifier.notifyChange(change.entity, 'delete', {}, change.id, auth.user, change.version);
+                    }
+                }
+            }
+            // Trigger webhooks for applied changes
+            if (webhookManager) {
+                for (const change of response.changes) {
+                    await webhookManager.triggerEvent({
+                        eventType: `sync.${change.operation}`,
+                        entity: change.entity,
+                        recordId: change.id,
+                        operation: change.operation,
+                        data: change.data,
+                        userId: auth.user.id,
+                    });
+                }
+            }
+            // Log changes for audit trail
+            if (auditManager) {
+                for (const change of response.changes) {
+                    const before = change.operation === 'update' || change.operation === 'delete' ? change.data : undefined;
+                    const after = change.operation === 'create' || change.operation === 'update' ? change.data : undefined;
+                    await auditManager.logChange(auth.user, change.entity, change.id, change.operation, before, after);
+                }
+            }
+            return c.json(response);
+        }
+        catch (error) {
+            console.error('Sync error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Sync failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /sync/:entity
+     */
+    app.get('/sync/:entity', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        const entity = c.req.param('entity');
+        if (!schema.entities[entity]) {
+            return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+        }
+        try {
+            const db = getDb(c);
+            const result = await db
+                .prepare('SELECT entity, record_id, version, updated_at, deleted_at FROM sync_metadata WHERE entity = ?')
+                .bind(entity)
+                .all();
+            return c.json({
+                entity,
+                metadata: result.results || [],
+                timestamp: Date.now(),
+            });
+        }
+        catch (error) {
+            console.error('Sync metadata error:', error);
+            return jsonError(c, 500, 'Failed to load sync metadata', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /sync/batch
+     * Batch process multiple CRUD operations
+     */
+    app.post('/sync/batch', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            // Create sync database adapter
+            const db = new D1SyncDatabase(getDb(c));
+            // Create schemas map for BatchProcessor
+            const schemas = new Map();
+            for (const [entityName, entitySchema] of Object.entries(schema.entities)) {
+                schemas.set(entityName, entitySchema);
+            }
+            // Create batch processor
+            const batchProcessor = new BatchProcessor({
+                schemas,
+                db,
+                user: auth.user,
+                maxBatchSize: 1000,
+                encryption: encryptionManager || undefined,
+            });
+            // Process batch request
+            const request = await c.req.json();
+            const response = await batchProcessor.processBatch(request);
+            // Broadcast changes to subscribed clients in real-time
+            if (changeNotifier && subscriptionManager) {
+                for (const change of response.applied) {
+                    // For each applied change, notify subscribed clients
+                    if (change.operation !== 'delete') {
+                        // For create/update, we have the full record
+                        await changeNotifier.notifyChange(change.entity, change.operation, change.data || {}, change.id, auth.user, change.version);
+                    }
+                    else {
+                        // For delete, notify with just the ID
+                        await changeNotifier.notifyChange(change.entity, 'delete', {}, change.id, auth.user, change.version);
+                    }
+                }
+            }
+            // Trigger webhooks for applied changes
+            if (webhookManager) {
+                for (const change of response.applied) {
+                    await webhookManager.triggerEvent({
+                        eventType: `sync.${change.operation}`,
+                        entity: change.entity,
+                        recordId: change.id,
+                        operation: change.operation,
+                        data: change.data,
+                        userId: auth.user.id,
+                    });
+                }
+            }
+            // Log changes for audit trail
+            if (auditManager) {
+                for (const change of response.applied) {
+                    const before = change.operation === 'update' || change.operation === 'delete' ? change.data : undefined;
+                    const after = change.operation === 'create' || change.operation === 'update' ? change.data : undefined;
+                    await auditManager.logChange(auth.user, change.entity, change.id, change.operation, before, after);
+                }
+            }
+            return c.json(response);
+        }
+        catch (error) {
+            console.error('Batch error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Batch processing failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /import/csv
+     * Import data from CSV file
+     */
+    app.post('/import/csv', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const formData = await c.req.formData();
+            const entity = formData.get('entity');
+            const file = formData.get('file');
+            if (!entity) {
+                return jsonError(c, 400, 'Missing entity parameter', 'VALIDATION_ERROR');
+            }
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            if (!file || !(file instanceof Blob)) {
+                return jsonError(c, 400, 'Missing or invalid file', 'VALIDATION_ERROR');
+            }
+            // Read CSV file
+            const csvContent = await file.text();
+            // Parse CSV
+            const importResult = await CSVProcessor.importFromCSV({
+                entity,
+                data: csvContent,
+                hasHeader: true,
+            });
+            return c.json(importResult);
+        }
+        catch (error) {
+            console.error('CSV import error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'CSV import failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /export/csv
+     * Export data to CSV format
+     */
+    app.post('/export/csv', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const { entity, filter, columns } = await c.req.json();
+            if (!entity) {
+                return jsonError(c, 400, 'Missing entity parameter', 'VALIDATION_ERROR');
+            }
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            try {
+                const db = getDb(c);
+                let query = `SELECT * FROM ${entity}`;
+                // Apply filter if provided
+                if (filter && typeof filter === 'object') {
+                    const whereConditions = [];
+                    const params = [];
+                    for (const [key, value] of Object.entries(filter)) {
+                        whereConditions.push(`${key} = ?`);
+                        params.push(value);
+                    }
+                    if (whereConditions.length > 0) {
+                        query += ` WHERE ${whereConditions.join(' AND ')}`;
+                    }
+                    // Execute with parameters
+                    const result = await db.prepare(query).bind(...params).all();
+                    const data = result.results || [];
+                    // Export to CSV
+                    const exportResult = CSVProcessor.exportToCSV({
+                        entity,
+                        data,
+                        columns,
+                        includeMetadata: false,
+                    });
+                    // Return as downloadable CSV
+                    return new Response(exportResult.csv, {
+                        headers: {
+                            'Content-Type': 'text/csv',
+                            'Content-Disposition': `attachment; filename="${entity}.csv"`,
+                        },
+                    });
+                }
+                else {
+                    // No filter, get all records
+                    const result = await db.prepare(query).all();
+                    const data = result.results || [];
+                    // Export to CSV
+                    const exportResult = CSVProcessor.exportToCSV({
+                        entity,
+                        data,
+                        columns,
+                        includeMetadata: false,
+                    });
+                    // Return as downloadable CSV
+                    return new Response(exportResult.csv, {
+                        headers: {
+                            'Content-Type': 'text/csv',
+                            'Content-Disposition': `attachment; filename="${entity}.csv"`,
+                        },
+                    });
+                }
+            }
+            catch (error) {
+                return jsonError(c, 400, error instanceof Error ? error.message : 'Export failed', 'API_ERROR');
+            }
+        }
+        catch (error) {
+            console.error('CSV export error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'CSV export failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /column-permissions/:entity
+     * Get column permissions for an entity
+     */
+    app.get('/column-permissions/:entity', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const entity = c.req.param('entity');
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            const db = getDb(c);
+            const result = await db
+                .prepare('SELECT * FROM column_permissions WHERE entity = ? ORDER BY column_name')
+                .bind(entity)
+                .all();
+            return c.json({
+                entity,
+                permissions: result.results || [],
+            });
+        }
+        catch (error) {
+            console.error('Column permissions fetch error:', error);
+            return jsonError(c, 500, 'Failed to fetch column permissions', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /column-permissions
+     * Create or update column permission
+     */
+    app.post('/column-permissions', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const { entity, columnName, role, visible, readable, writable, encrypted, maskValue } = await c.req.json();
+            if (!entity || !columnName) {
+                return jsonError(c, 400, 'Missing entity or columnName', 'VALIDATION_ERROR');
+            }
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            const db = getDb(c);
+            const now = Date.now();
+            const permissionId = `${entity}_${columnName}_${role || 'default'}_${now}`;
+            // Check if permission already exists
+            const existing = await db
+                .prepare('SELECT id FROM column_permissions WHERE entity = ? AND column_name = ? AND role IS ?')
+                .bind(entity, columnName, role || null)
+                .first();
+            if (existing) {
+                // Update existing permission
+                await db
+                    .prepare(`
+            UPDATE column_permissions
+            SET visible = ?, readable = ?, writable = ?, encrypted = ?, mask_value = ?, updated_at = ?
+            WHERE entity = ? AND column_name = ? AND role IS ?
+          `)
+                    .bind(visible ? 1 : 0, readable ? 1 : 0, writable ? 1 : 0, encrypted ? 1 : 0, maskValue || null, now, entity, columnName, role || null)
+                    .run();
+            }
+            else {
+                // Create new permission
+                await db
+                    .prepare(`
+            INSERT INTO column_permissions (id, entity, column_name, role, visible, readable, writable, encrypted, mask_value, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          `)
+                    .bind(permissionId, entity, columnName, role || null, visible ? 1 : 0, readable ? 1 : 0, writable ? 1 : 0, encrypted ? 1 : 0, maskValue || null, now, now)
+                    .run();
+            }
+            return c.json({ success: true, id: existing?.id || permissionId });
+        }
+        catch (error) {
+            console.error('Column permission update error:', error);
+            return jsonError(c, 500, 'Failed to update column permission', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /column-permissions/:id
+     * Delete a column permission
+     */
+    app.delete('/column-permissions/:id', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const id = c.req.param('id');
+            const db = getDb(c);
+            await db
+                .prepare('DELETE FROM column_permissions WHERE id = ?')
+                .bind(id)
+                .run();
+            return c.json({ success: true });
+        }
+        catch (error) {
+            console.error('Column permission delete error:', error);
+            return jsonError(c, 500, 'Failed to delete column permission', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /files/upload
+     * Upload a file to R2 storage
+     */
+    app.post('/files/upload', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const getR2Bucket = options.getR2Bucket;
+            if (!getR2Bucket) {
+                return jsonError(c, 501, 'File storage not configured', 'NOT_CONFIGURED');
+            }
+            const formData = await c.req.formData();
+            const file = formData.get('file');
+            const entityType = formData.get('entityType');
+            const entityId = formData.get('entityId');
+            const isPublic = formData.get('isPublic') === 'true';
+            if (!file || !(file instanceof Blob)) {
+                return jsonError(c, 400, 'Missing or invalid file', 'VALIDATION_ERROR');
+            }
+            const bucket = getR2Bucket(c);
+            const db = new D1SyncDatabase(getDb(c));
+            const fileManager = new FileStorageManager(bucket, db, {
+                maxFileSize: 100 * 1024 * 1024, // 100MB
+            });
+            const arrayBuffer = await file.arrayBuffer();
+            const metadata = await fileManager.uploadFile(auth.user, arrayBuffer, {
+                fileName: file.name || 'unnamed',
+                mimeType: file.type || 'application/octet-stream',
+                size: file.size,
+                entityType: entityType || undefined,
+                entityId: entityId || undefined,
+                isPublic,
+            });
+            return c.json(metadata);
+        }
+        catch (error) {
+            console.error('File upload error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Upload failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /files/download/:fileId
+     * Download a file from R2 storage
+     */
+    app.get('/files/download/:fileId', async (c) => {
+        try {
+            const fileId = c.req.param('fileId');
+            const token = c.req.query('token');
+            const getR2Bucket = options.getR2Bucket;
+            if (!getR2Bucket) {
+                return jsonError(c, 501, 'File storage not configured', 'NOT_CONFIGURED');
+            }
+            const bucket = getR2Bucket(c);
+            const db = new D1SyncDatabase(getDb(c));
+            const fileManager = new FileStorageManager(bucket, db);
+            // If token is provided, verify it
+            if (token) {
+                const isValid = await fileManager.verifyToken(fileId, token);
+                if (!isValid) {
+                    return jsonError(c, 401, 'Invalid or expired token', 'UNAUTHORIZED');
+                }
+                // Get file and return
+                const metadata = await fileManager.getFileMetadata(fileId);
+                if (!metadata) {
+                    return jsonError(c, 404, 'File not found', 'NOT_FOUND');
+                }
+                const file = await bucket.get(metadata.key);
+                if (!file) {
+                    return jsonError(c, 404, 'File not found in storage', 'NOT_FOUND');
+                }
+                return new Response(file.body, {
+                    headers: {
+                        'Content-Type': metadata.mimeType,
+                        'Content-Disposition': `attachment; filename="${metadata.fileName}"`,
+                        'Content-Length': metadata.size.toString(),
+                    },
+                });
+            }
+            // Otherwise, require authentication
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const file = await fileManager.downloadFile(fileId, auth.user);
+            if (!file) {
+                return jsonError(c, 404, 'File not found', 'NOT_FOUND');
+            }
+            const metadata = await fileManager.getFileMetadata(fileId);
+            if (!metadata) {
+                return jsonError(c, 404, 'File metadata not found', 'NOT_FOUND');
+            }
+            return new Response(file.body, {
+                headers: {
+                    'Content-Type': metadata.mimeType,
+                    'Content-Disposition': `attachment; filename="${metadata.fileName}"`,
+                    'Content-Length': metadata.size.toString(),
+                },
+            });
+        }
+        catch (error) {
+            console.error('File download error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Download failed', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /files/:fileId
+     * Delete a file from R2 storage
+     */
+    app.delete('/files/:fileId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const getR2Bucket = options.getR2Bucket;
+            if (!getR2Bucket) {
+                return jsonError(c, 501, 'File storage not configured', 'NOT_CONFIGURED');
+            }
+            const fileId = c.req.param('fileId');
+            const bucket = getR2Bucket(c);
+            const db = new D1SyncDatabase(getDb(c));
+            const fileManager = new FileStorageManager(bucket, db);
+            await fileManager.deleteFile(fileId, auth.user);
+            return c.json({ success: true });
+        }
+        catch (error) {
+            console.error('File delete error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Delete failed', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /files
+     * List files for the authenticated user
+     */
+    app.get('/files', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const getR2Bucket = options.getR2Bucket;
+            if (!getR2Bucket) {
+                return jsonError(c, 501, 'File storage not configured', 'NOT_CONFIGURED');
+            }
+            const entityType = c.req.query('entityType');
+            const entityId = c.req.query('entityId');
+            const limit = c.req.query('limit') ? parseInt(c.req.query('limit')) : undefined;
+            const offset = c.req.query('offset') ? parseInt(c.req.query('offset')) : undefined;
+            const bucket = getR2Bucket(c);
+            const db = new D1SyncDatabase(getDb(c));
+            const fileManager = new FileStorageManager(bucket, db);
+            const files = await fileManager.listFiles(auth.user, {
+                entityType: entityType || undefined,
+                entityId: entityId || undefined,
+                limit,
+                offset,
+            });
+            return c.json({ files });
+        }
+        catch (error) {
+            console.error('File list error:', error);
+            return jsonError(c, 500, 'Failed to list files', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /files/:fileId/signed-url
+     * Generate a signed URL for temporary access to a file
+     */
+    app.post('/files/:fileId/signed-url', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            const getR2Bucket = options.getR2Bucket;
+            if (!getR2Bucket) {
+                return jsonError(c, 501, 'File storage not configured', 'NOT_CONFIGURED');
+            }
+            const fileId = c.req.param('fileId');
+            const { expiresIn } = await c.req.json();
+            const bucket = getR2Bucket(c);
+            const db = new D1SyncDatabase(getDb(c));
+            const fileManager = new FileStorageManager(bucket, db);
+            const url = await fileManager.generateSignedUrl(fileId, auth.user, expiresIn || 3600);
+            return c.json({ url, expiresIn: expiresIn || 3600 });
+        }
+        catch (error) {
+            console.error('Signed URL generation error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to generate signed URL', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /webhooks
+     * Register a new webhook
+     */
+    app.post('/webhooks', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!webhookManager) {
+                return jsonError(c, 501, 'Webhooks not configured', 'NOT_CONFIGURED');
+            }
+            const { url, events, description, headers } = await c.req.json();
+            const webhook = await webhookManager.registerWebhook(auth.user, {
+                url,
+                events,
+                description,
+                headers,
+            });
+            // Don't expose the secret in the response for security
+            return c.json({ ...webhook, secret: undefined });
+        }
+        catch (error) {
+            console.error('Webhook registration error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to register webhook', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /webhooks
+     * List user's webhooks
+     */
+    app.get('/webhooks', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!webhookManager) {
+                return jsonError(c, 501, 'Webhooks not configured', 'NOT_CONFIGURED');
+            }
+            const webhooks = await webhookManager.listWebhooks(auth.user.id);
+            // Don't expose secrets
+            const safeWebhooks = webhooks.map((wh) => ({ ...wh, secret: undefined }));
+            return c.json({ webhooks: safeWebhooks });
+        }
+        catch (error) {
+            console.error('Webhook list error:', error);
+            return jsonError(c, 500, 'Failed to list webhooks', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /webhooks/:webhookId
+     * Get a specific webhook
+     */
+    app.get('/webhooks/:webhookId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!webhookManager) {
+                return jsonError(c, 501, 'Webhooks not configured', 'NOT_CONFIGURED');
+            }
+            const webhookId = c.req.param('webhookId');
+            const webhook = await webhookManager.getWebhook(webhookId, auth.user.id);
+            if (!webhook) {
+                return jsonError(c, 404, 'Webhook not found', 'NOT_FOUND');
+            }
+            return c.json({ ...webhook, secret: undefined });
+        }
+        catch (error) {
+            console.error('Webhook fetch error:', error);
+            return jsonError(c, 500, 'Failed to fetch webhook', 'API_ERROR');
+        }
+    });
+    /**
+     * PATCH /webhooks/:webhookId
+     * Update a webhook
+     */
+    app.patch('/webhooks/:webhookId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!webhookManager) {
+                return jsonError(c, 501, 'Webhooks not configured', 'NOT_CONFIGURED');
+            }
+            const webhookId = c.req.param('webhookId');
+            const updates = await c.req.json();
+            const webhook = await webhookManager.updateWebhook(webhookId, auth.user.id, updates);
+            return c.json({ ...webhook, secret: undefined });
+        }
+        catch (error) {
+            console.error('Webhook update error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to update webhook', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /webhooks/:webhookId
+     * Delete a webhook
+     */
+    app.delete('/webhooks/:webhookId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!webhookManager) {
+                return jsonError(c, 501, 'Webhooks not configured', 'NOT_CONFIGURED');
+            }
+            const webhookId = c.req.param('webhookId');
+            await webhookManager.deleteWebhook(webhookId, auth.user.id);
+            return c.json({ success: true });
+        }
+        catch (error) {
+            console.error('Webhook delete error:', error);
+            return jsonError(c, 500, 'Failed to delete webhook', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /search/:entity
+     * Full-text search for an entity
+     */
+    app.post('/search/:entity', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!searchManager) {
+                return jsonError(c, 501, 'Search not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            if (!searchManager.hasIndex(entity)) {
+                return jsonError(c, 404, `No search index for entity: ${entity}`, 'NOT_FOUND');
+            }
+            const { query, columns, limit, offset, highlight, rank } = await c.req.json();
+            if (!query || typeof query !== 'string') {
+                return jsonError(c, 400, 'Missing or invalid query', 'VALIDATION_ERROR');
+            }
+            const results = await searchManager.search({
+                entity,
+                query,
+                columns,
+                limit,
+                offset,
+                highlight: highlight !== false, // Default true
+                rank: rank !== false, // Default true
+            });
+            return c.json(results);
+        }
+        catch (error) {
+            console.error('Search error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Search failed', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /search/:entity/index
+     * Create or rebuild search index for an entity
+     */
+    app.post('/search/:entity/index', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!searchManager) {
+                return jsonError(c, 501, 'Search not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            const { columns, tokenize, prefix, rebuild } = await c.req.json();
+            if (!columns || !Array.isArray(columns) || columns.length === 0) {
+                return jsonError(c, 400, 'Missing or invalid columns', 'VALIDATION_ERROR');
+            }
+            // Register index configuration
+            searchManager.registerIndex({
+                entity,
+                columns,
+                tokenize,
+                prefix,
+            });
+            // Create or rebuild index
+            if (rebuild) {
+                const count = await searchManager.rebuildIndex(entity);
+                return c.json({ success: true, documentCount: count, rebuilt: true });
+            }
+            else {
+                await searchManager.createSearchIndex(entity);
+                return c.json({ success: true, created: true });
+            }
+        }
+        catch (error) {
+            console.error('Search index creation error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to create search index', 'API_ERROR');
+        }
+    });
+    /**
+     * DELETE /search/:entity/index
+     * Delete search index for an entity
+     */
+    app.delete('/search/:entity/index', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!searchManager) {
+                return jsonError(c, 501, 'Search not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            await searchManager.deleteSearchIndex(entity);
+            return c.json({ success: true });
+        }
+        catch (error) {
+            console.error('Search index deletion error:', error);
+            return jsonError(c, 500, 'Failed to delete search index', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /search/:entity/stats
+     * Get search index statistics
+     */
+    app.get('/search/:entity/stats', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!searchManager) {
+                return jsonError(c, 501, 'Search not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            const stats = await searchManager.getIndexStats(entity);
+            return c.json(stats);
+        }
+        catch (error) {
+            console.error('Search stats error:', error);
+            return jsonError(c, 500, 'Failed to get search stats', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /audit/query
+     * Query audit logs with filters
+     */
+    app.post('/audit/query', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!auditManager) {
+                return jsonError(c, 501, 'Audit not configured', 'NOT_CONFIGURED');
+            }
+            const query = await c.req.json();
+            const result = await auditManager.queryLogs(query);
+            return c.json(result);
+        }
+        catch (error) {
+            console.error('Audit query error:', error);
+            return jsonError(c, 500, 'Failed to query audit logs', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /audit/:auditId
+     * Get a specific audit log
+     */
+    app.get('/audit/:auditId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!auditManager) {
+                return jsonError(c, 501, 'Audit not configured', 'NOT_CONFIGURED');
+            }
+            const auditId = c.req.param('auditId');
+            const log = await auditManager.getLog(auditId);
+            if (!log) {
+                return jsonError(c, 404, 'Audit log not found', 'NOT_FOUND');
+            }
+            return c.json(log);
+        }
+        catch (error) {
+            console.error('Audit log fetch error:', error);
+            return jsonError(c, 500, 'Failed to fetch audit log', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /audit/record/:entity/:recordId
+     * Get audit history for a specific record
+     */
+    app.get('/audit/record/:entity/:recordId', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!auditManager) {
+                return jsonError(c, 501, 'Audit not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            const recordId = c.req.param('recordId');
+            const history = await auditManager.getRecordHistory(entity, recordId);
+            return c.json({ history });
+        }
+        catch (error) {
+            console.error('Record history error:', error);
+            return jsonError(c, 500, 'Failed to get record history', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /audit/stats
+     * Get audit statistics
+     */
+    app.get('/audit/stats', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!auditManager) {
+                return jsonError(c, 501, 'Audit not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.query('entity');
+            const userId = c.req.query('userId');
+            const startDate = c.req.query('startDate') ? parseInt(c.req.query('startDate')) : undefined;
+            const endDate = c.req.query('endDate') ? parseInt(c.req.query('endDate')) : undefined;
+            const stats = await auditManager.getStatistics({
+                entity: entity || undefined,
+                userId: userId || undefined,
+                startDate,
+                endDate,
+            });
+            return c.json(stats);
+        }
+        catch (error) {
+            console.error('Audit stats error:', error);
+            return jsonError(c, 500, 'Failed to get audit stats', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /encryption/config
+     * Register encryption configuration for an entity
+     */
+    app.post('/encryption/config', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!encryptionManager) {
+                return jsonError(c, 501, 'Encryption not configured', 'NOT_CONFIGURED');
+            }
+            const { entity, fields, algorithm, keyRotation } = await c.req.json();
+            if (!entity || !fields || !Array.isArray(fields)) {
+                return jsonError(c, 400, 'Missing or invalid entity or fields', 'VALIDATION_ERROR');
+            }
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            encryptionManager.registerConfig({
+                entity,
+                fields,
+                algorithm: algorithm || 'AES-GCM',
+                keyRotation: keyRotation !== false,
+            });
+            return c.json({
+                success: true,
+                entity,
+                fields,
+                algorithm: algorithm || 'AES-GCM',
+                keyRotation: keyRotation !== false,
+            });
+        }
+        catch (error) {
+            console.error('Encryption config error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to configure encryption', 'API_ERROR');
+        }
+    });
+    /**
+     * GET /encryption/config/:entity
+     * Get encryption configuration for an entity
+     */
+    app.get('/encryption/config/:entity', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!encryptionManager) {
+                return jsonError(c, 501, 'Encryption not configured', 'NOT_CONFIGURED');
+            }
+            const entity = c.req.param('entity');
+            if (!schema.entities[entity]) {
+                return jsonError(c, 404, `Entity not found: ${entity}`, 'NOT_FOUND');
+            }
+            const config = encryptionManager.getConfig(entity);
+            if (!config) {
+                return c.json({
+                    entity,
+                    enabled: false,
+                    fields: [],
+                });
+            }
+            return c.json({
+                entity,
+                enabled: true,
+                fields: config.fields,
+                algorithm: config.algorithm || 'AES-GCM',
+                keyRotation: config.keyRotation !== false,
+            });
+        }
+        catch (error) {
+            console.error('Encryption config fetch error:', error);
+            return jsonError(c, 500, 'Failed to fetch encryption config', 'API_ERROR');
+        }
+    });
+    /**
+     * POST /encryption/rotate-key
+     * Rotate encryption key (requires master key)
+     */
+    app.post('/encryption/rotate-key', async (c) => {
+        try {
+            const auth = await requireAccessUser(c);
+            if (auth instanceof Response) {
+                return auth;
+            }
+            if (!encryptionManager) {
+                return jsonError(c, 501, 'Encryption not configured', 'NOT_CONFIGURED');
+            }
+            const { newMasterKey } = await c.req.json();
+            if (!newMasterKey || typeof newMasterKey !== 'string') {
+                return jsonError(c, 400, 'Missing or invalid newMasterKey', 'VALIDATION_ERROR');
+            }
+            await encryptionManager.rotateKey(newMasterKey);
+            return c.json({
+                success: true,
+                message: 'Encryption key rotated successfully',
+                timestamp: Date.now(),
+            });
+        }
+        catch (error) {
+            console.error('Key rotation error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to rotate key', 'API_ERROR');
+        }
+    });
+    /**
+     * WebSocket upgrade endpoint for real-time subscriptions
+     * GET /realtime
+     */
+    app.get('/realtime', async (c) => {
+        if (!c.req.header('upgrade')?.toLowerCase().includes('websocket')) {
+            return jsonError(c, 400, 'WebSocket upgrade required', 'INVALID_UPGRADE');
+        }
+        // Authenticate the connection
+        const token = getBearerToken(c);
+        if (!token) {
+            return jsonError(c, 401, 'Unauthorized', 'UNAUTHORIZED');
+        }
+        const payload = parseJWT(token);
+        if (!payload || payload.type !== 'access') {
+            return jsonError(c, 401, 'Invalid token', 'UNAUTHORIZED');
+        }
+        const db = getDb(c);
+        const userRow = await db
+            .prepare('SELECT id, email, created_at, updated_at FROM users WHERE id = ?')
+            .bind(payload.userId)
+            .first();
+        if (!userRow) {
+            return jsonError(c, 401, 'User not found', 'UNAUTHORIZED');
+        }
+        const user = {
+            id: userRow.id,
+            email: userRow.email,
+            createdAt: userRow.created_at,
+            updatedAt: userRow.updated_at,
+        };
+        // Initialize managers if not done yet (fallback for non-auto-init)
+        if (!subscriptionManager) {
+            const syncDb = new D1SyncDatabase(db);
+            subscriptionManager = new SubscriptionManager(syncDb);
+            changeNotifier = new ChangeNotifier(subscriptionManager);
+            await subscriptionManager.loadFromDatabase();
+        }
+        const connectionId = `conn_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+        try {
+            // In Cloudflare Workers, WebSocketPair is available globally
+            const upgradeHeader = c.req.header('upgrade');
+            if (!upgradeHeader?.toLowerCase().includes('websocket')) {
+                return jsonError(c, 400, 'WebSocket upgrade required', 'INVALID_UPGRADE');
+            }
+            // Create WebSocket pair (client/server)
+            // @ts-ignore - WebSocketPair is available in Cloudflare Workers runtime
+            const { 0: client, 1: server } = new WebSocketPair();
+            // Register the WebSocket client
+            const wsClient = {
+                send(message) {
+                    server.send(message);
+                },
+                close() {
+                    server.close();
+                },
+                isOpen() {
+                    return server.readyState === 1; // OPEN
+                },
+            };
+            changeNotifier.registerClient(connectionId, wsClient);
+            // Handle incoming messages using addEventListener (Cloudflare Workers API)
+            server.addEventListener('message', async (event) => {
+                try {
+                    const message = JSON.parse(event.data);
+                    switch (message.type) {
+                        case 'subscribe':
+                            await subscriptionManager.subscribe(user.id, connectionId, message.entity, message.filters);
+                            server.send(JSON.stringify({
+                                type: 'subscribed',
+                                subscriptionId: `${message.entity}:${connectionId}`,
+                                entity: message.entity,
+                                timestamp: Date.now(),
+                            }));
+                            break;
+                        case 'unsubscribe':
+                            const subs = subscriptionManager.getSubscriptionsForConnection(connectionId);
+                            for (const sub of subs) {
+                                if (sub.entity === message.entity && sub.userId === user.id) {
+                                    await subscriptionManager.unsubscribe(sub.subscriptionId);
+                                }
+                            }
+                            server.send(JSON.stringify({
+                                type: 'unsubscribed',
+                                entity: message.entity,
+                                timestamp: Date.now(),
+                            }));
+                            break;
+                        case 'heartbeat':
+                            const userSubs = subscriptionManager.getSubscriptionsForConnection(connectionId);
+                            for (const sub of userSubs) {
+                                await subscriptionManager.updateHeartbeat(sub.subscriptionId);
+                            }
+                            break;
+                        default:
+                            server.send(JSON.stringify({
+                                type: 'error',
+                                code: 'UNKNOWN_MESSAGE_TYPE',
+                                message: `Unknown message type: ${message.type}`,
+                            }));
+                    }
+                }
+                catch (error) {
+                    console.error('WebSocket message error:', error);
+                    server.send(JSON.stringify({
+                        type: 'error',
+                        code: 'MESSAGE_ERROR',
+                        message: 'Failed to process message',
+                    }));
+                }
+            });
+            // Handle disconnect using addEventListener
+            server.addEventListener('close', async () => {
+                console.log(`Client ${connectionId} disconnected`);
+                await subscriptionManager.disconnectClient(connectionId);
+                changeNotifier.unregisterClient(connectionId);
+            });
+            // Handle errors using addEventListener
+            server.addEventListener('error', (error) => {
+                console.error(`WebSocket error for client ${connectionId}:`, error);
+                changeNotifier.unregisterClient(connectionId);
+            });
+            // Send initial greeting
+            server.send(JSON.stringify({
+                type: 'connected',
+                connectionId,
+                timestamp: Date.now(),
+            }));
+            return new Response(client, {
+                status: 101,
+                statusText: 'Switching Protocols',
+                headers: {
+                    'Upgrade': 'websocket',
+                    'Connection': 'Upgrade',
+                },
+            });
+        }
+        catch (error) {
+            console.error('WebSocket connection error:', error);
+            return jsonError(c, 500, 'Failed to establish WebSocket connection', 'CONNECTION_ERROR');
+        }
+    });
+    /**
+     * Get real-time statistics
+     * GET /realtime/stats
+     */
+    app.get('/realtime/stats', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        if (!subscriptionManager || !changeNotifier) {
+            return c.json({
+                connectedClients: 0,
+                subscriptions: { totalSubscriptions: 0, activeConnections: 0, entitiesWithSubscriptions: 0 },
+            });
+        }
+        return c.json({
+            connectedClients: changeNotifier.getConnectedClientsCount(),
+            subscriptions: subscriptionManager.getStats(),
+            timestamp: Date.now(),
+        });
+    });
+    /**
+     * POST /transactions/begin
+     * Begin a new transaction
+     */
+    app.post('/transactions/begin', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        if (!transactionManager) {
+            return jsonError(c, 503, 'Transaction manager not available', 'SERVICE_UNAVAILABLE');
+        }
+        try {
+            const body = await c.req.json();
+            const isolationLevel = body.isolationLevel || 'READ_COMMITTED';
+            const transactionId = await transactionManager.begin(auth.user, isolationLevel);
+            return c.json({
+                transactionId,
+                userId: auth.user.id,
+                isolationLevel,
+                createdAt: Date.now(),
+            });
+        }
+        catch (error) {
+            console.error('Transaction begin error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to begin transaction', 'TRANSACTION_ERROR');
+        }
+    });
+    /**
+     * POST /transactions/:txnId/commit
+     * Commit a transaction
+     */
+    app.post('/transactions/:txnId/commit', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        if (!transactionManager) {
+            return jsonError(c, 503, 'Transaction manager not available', 'SERVICE_UNAVAILABLE');
+        }
+        try {
+            const transactionId = c.req.param('txnId');
+            const transaction = transactionManager.getTransaction(transactionId);
+            if (!transaction) {
+                return jsonError(c, 404, 'Transaction not found', 'NOT_FOUND');
+            }
+            if (transaction.userId !== auth.user.id) {
+                return jsonError(c, 403, 'Cannot commit transaction of another user', 'FORBIDDEN');
+            }
+            const result = await transactionManager.commit(transactionId);
+            return c.json({
+                transactionId,
+                status: 'committed',
+                appliedCount: result.appliedCount,
+                errors: result.errors,
+                timestamp: Date.now(),
+            });
+        }
+        catch (error) {
+            console.error('Transaction commit error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to commit transaction', 'TRANSACTION_ERROR');
+        }
+    });
+    /**
+     * POST /transactions/:txnId/rollback
+     * Rollback a transaction
+     */
+    app.post('/transactions/:txnId/rollback', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        if (!transactionManager) {
+            return jsonError(c, 503, 'Transaction manager not available', 'SERVICE_UNAVAILABLE');
+        }
+        try {
+            const transactionId = c.req.param('txnId');
+            const transaction = transactionManager.getTransaction(transactionId);
+            if (!transaction) {
+                return jsonError(c, 404, 'Transaction not found', 'NOT_FOUND');
+            }
+            if (transaction.userId !== auth.user.id) {
+                return jsonError(c, 403, 'Cannot rollback transaction of another user', 'FORBIDDEN');
+            }
+            await transactionManager.rollback(transactionId);
+            return c.json({
+                transactionId,
+                status: 'rolled_back',
+                timestamp: Date.now(),
+            });
+        }
+        catch (error) {
+            console.error('Transaction rollback error:', error);
+            return jsonError(c, 400, error instanceof Error ? error.message : 'Failed to rollback transaction', 'TRANSACTION_ERROR');
+        }
+    });
+    /**
+     * GET /transactions/:txnId
+     * Get transaction status
+     */
+    app.get('/transactions/:txnId', async (c) => {
+        const auth = await requireAccessUser(c);
+        if (auth instanceof Response) {
+            return auth;
+        }
+        if (!transactionManager) {
+            return jsonError(c, 503, 'Transaction manager not available', 'SERVICE_UNAVAILABLE');
+        }
+        try {
+            const transactionId = c.req.param('txnId');
+            const transaction = transactionManager.getTransaction(transactionId);
+            if (!transaction) {
+                return jsonError(c, 404, 'Transaction not found', 'NOT_FOUND');
+            }
+            if (transaction.userId !== auth.user.id) {
+                return jsonError(c, 403, 'Cannot access transaction of another user', 'FORBIDDEN');
+            }
+            return c.json({
+                transactionId: transaction.id,
+                status: transaction.status,
+                isolationLevel: transaction.isolationLevel,
+                changeCount: transaction.changes.length,
+                createdAt: transaction.createdAt,
+                expiresAt: transaction.expiresAt,
+                completedAt: transaction.completedAt,
+            });
+        }
+        catch (error) {
+            console.error('Transaction status error:', error);
+            return jsonError(c, 500, 'Failed to get transaction status', 'TRANSACTION_ERROR');
+        }
+    });
+    return app;
+}
+export default createEdgeBaseWorker;
+//# sourceMappingURL=index.js.map