crudora 0.1.0 → 0.2.0

package/dist/cli.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import 'reflect-metadata';
+import { Command } from 'commander';
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { createRequire } from 'module';
+import path from 'path';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const _require = createRequire(import.meta.url);
+const pkg = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf-8'));
+const program = new Command();
+program
+    .name('crudora')
+    .description('Crudora CLI — tools for Crudora projects')
+    .version(pkg.version ?? '0.0.0');
+program
+    .command('generate-schema')
+    .description('Generate a Drizzle TypeScript schema file from registered Crudora models')
+    .option('-e, --entry <file>', 'Entry file (JS/TS) that exports a CrudoraServer or Crudora instance', 'src/server.ts')
+    .option('-o, --output <file>', 'Output path for the generated schema', 'src/db/schema.ts')
+    .action(async (opts) => {
+    const entryPath = resolve(process.cwd(), opts.entry);
+    if (!existsSync(entryPath)) {
+        console.error(`Error: entry file not found — ${entryPath}`);
+        process.exit(1);
+    }
+    try {
+        let mod;
+        try {
+            // ESM dynamic import — works for compiled .js / .mjs entry files
+            mod = await import(pathToFileURL(entryPath).href);
+        }
+        catch {
+            // Fallback: CJS require — for pre-compiled CommonJS output
+            try {
+                _require('ts-node/register');
+            }
+            catch {
+                // ts-node not installed — entry must be pre-compiled JS
+            }
+            mod = _require(entryPath);
+        }
+        const instance = mod.default ?? mod.server ?? mod.crudora;
+        if (!instance) {
+            console.error('Error: entry file must export a CrudoraServer or Crudora instance as default, "server", or "crudora".');
+            process.exit(1);
+        }
+        const crudora = typeof instance.getCrudora === 'function' ? instance.getCrudora() : instance;
+        if (typeof crudora.generateDrizzleSchema !== 'function') {
+            console.error('Error: could not find generateDrizzleSchema() on the exported instance.');
+            process.exit(1);
+        }
+        const schema = crudora.generateDrizzleSchema();
+        const outputPath = resolve(process.cwd(), opts.output);
+        const cwd = process.cwd() + path.sep;
+        if (!outputPath.startsWith(cwd)) {
+            console.error('Error: output path must be within the project directory.');
+            process.exit(1);
+        }
+        writeFileSync(outputPath, schema, 'utf-8');
+        console.log(`Schema written to ${outputPath}`);
+        console.log('Run: npx drizzle-kit push  — to apply the schema to your database.');
+    }
+    catch (err) {
+        console.error('Error generating schema:', err.message);
+        process.exit(1);
+    }
+});
+program.parse();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC;KACvD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AAEnC,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,oBAAoB,EAAE,qEAAqE,EAAE,eAAe,CAAC;KACpH,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,EAAE,kBAAkB,CAAC;KACzF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,iEAAiE;YACjE,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC;gBACH,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CACX,uGAAuG,CACxG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE7F,IAAI,OAAO,OAAO,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAW,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/core/crudora.d.ts

@@ -1,24 +1,49 @@
-import { PrismaClient } from '@prisma/client';
 import { Express } from 'express';
 import { z } from 'zod';
 import { Repository } from './repository';
 import { Model, ModelConstructor } from './model';
+import { Dialect } from '../types/model.type';
+import { CrudoraLogger } from '../types/logger.type';
 export declare class Crudora {
-    private prisma;
+    private db;
+    private dialect;
+    private logger;
     private models;
+    private tables;
     private repositories;
     private customRoutes;
-    constructor(prisma?: PrismaClient);
+    constructor(db: any, dialect: Dialect, logger?: CrudoraLogger);
     registerModel(...modelClasses: ModelConstructor[]): this;
+    /**
+     * Register a model against a pre-built Drizzle table object (e.g. from `drizzle-kit introspect`).
+     * Skips `DrizzleTableBuilder` — useful when the database already exists and the schema
+     * was generated via introspection rather than Crudora decorators.
+     *
+     * Validation works if the model defines `@Field()` decorators matching the table columns.
+     * Without decorators, POST/PUT bodies pass through without Zod validation.
+     */
+    registerTable<T extends Model>(modelClass: ModelConstructor<T>, table: any): this;
     getRepository<T extends Model>(modelClass: ModelConstructor<T>): Repository<T>;
-    generatePrismaSchema(databaseProvider?: string): string;
+    /**
+     * Returns the Drizzle table object for a registered model.
+     * Useful for raw queries that need access to columns excluded by `hidden`
+     * (e.g. fetching a password hash for authentication).
+     *
+     * @example
+     * const usersTable = crudora.getTable(User);
+     * const [row] = await db.select().from(usersTable).where(eq(usersTable.email, email)).limit(1);
+     */
+    getTable<T extends Model>(modelClass: ModelConstructor<T>): any;
+    generateDrizzleSchema(): string;
     getValidationSchema<T extends Model>(modelClass: ModelConstructor<T>): z.ZodType<Partial<T>>;
     getStrictValidationSchema<T extends Model>(modelClass: ModelConstructor<T>): z.ZodType<T>;
-    get(path: string, handler: (req: any, res: any) => void): this;
-    post(path: string, handler: (req: any, res: any) => void): this;
-    put(path: string, handler: (req: any, res: any) => void): this;
-    delete(path: string, handler: (req: any, res: any) => void): this;
-    patch(path: string, handler: (req: any, res: any) => void): this;
+    get(path: string, ...handlers: Array<(req: any, res: any, next?: any) => void>): this;
+    post(path: string, ...handlers: Array<(req: any, res: any, next?: any) => void>): this;
+    put(path: string, ...handlers: Array<(req: any, res: any, next?: any) => void>): this;
+    delete(path: string, ...handlers: Array<(req: any, res: any, next?: any) => void>): this;
+    patch(path: string, ...handlers: Array<(req: any, res: any, next?: any) => void>): this;
+    /** Runs `fn` inside a database transaction and returns its result. */
+    transaction<R>(fn: (db: any) => Promise<R>): Promise<R>;
     generateRoutes(app: Express, basePath?: string): void;
 }
 //# sourceMappingURL=crudora.d.ts.map

package/dist/core/crudora.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crudora.d.ts","sourceRoot":"","sources":["../../src/core/crudora.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAElD,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,MAAM,CAA4C;IAC1D,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,YAAY,CAIZ;gBAEI,MAAM,CAAC,EAAE,YAAY;IAQjC,aAAa,CAAC,GAAG,YAAY,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAWxD,aAAa,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAQ9E,oBAAoB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;IAKvD,mBAAmB,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAI5F,yBAAyB,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAKzF,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAK9D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAK/D,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAK9D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAKjE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI;IAOhE,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAe,GAAG,IAAI;CAsK9D"}
+{"version":3,"file":"crudora.d.ts","sourceRoot":"","sources":["../../src/core/crudora.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAiB,MAAM,cAAc,CAAC;AAGzD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA0BrD,qBAAa,OAAO;IAClB,OAAO,CAAC,EAAE,CAAM;IAChB,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAA4C;IAC1D,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,YAAY,CAIZ;gBAEI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;IAqB7D,aAAa,CAAC,GAAG,YAAY,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAYxD;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAQjF,aAAa,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAQ9E;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,GAAG;IAQ/D,qBAAqB,IAAI,MAAM;IAK/B,mBAAmB,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAI5F,yBAAyB,CAAC,CAAC,SAAS,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAIzF,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI;IAKrF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI;IAKtF,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI;IAKrF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI;IAKxF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI;IAKvF,sEAAsE;IAChE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI7D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAe,GAAG,IAAI;CAwP9D"}

package/dist/core/crudora.js

@@ -5,26 +5,74 @@ const zod_1 = require("zod");
 const repository_1 = require("./repository");
 const schemaGenerator_1 = require("./schemaGenerator");
 const validation_1 = require("../utils/validation");
+const drizzleTableBuilder_1 = require("./drizzleTableBuilder");
+const MAX_LIMIT = 1000;
+const MAX_RELATIONS = 5;
+/** Validates a query-param key: alphanumeric/underscore with optional operator suffix. */
+const SAFE_KEY_RE = /^[a-zA-Z_][a-zA-Z0-9_]*(_gt|_gte|_lt|_lte|_ne|_like|_in)?$/;
+// ─── Response helpers ─────────────────────────────────────────────────────────
+function ok(data, meta) {
+    return meta !== undefined ? { success: true, data, meta } : { success: true, data };
+}
+function fail(code, message, details) {
+    const error = { code, message };
+    if (details !== undefined)
+        error.details = details;
+    return { success: false, error };
+}
+function zodDetails(issues) {
+    return issues.map((issue) => ({
+        field: issue.path.length ? issue.path.join('.') : '_root',
+        message: issue.message,
+    }));
+}
 class Crudora {
-    constructor(prisma) {
+    constructor(db, dialect, logger) {
         this.models = new Map();
+        this.tables = new Map();
         this.repositories = new Map();
         this.customRoutes = [];
-        if (!prisma) {
-            console.warn('⚠️  No Prisma client provided. Make sure to install @prisma/client and prisma, then initialize PrismaClient.');
-            throw new Error('PrismaClient is required. Please provide a PrismaClient instance.');
+        if (!db) {
+            throw new Error('Crudora: db is required. Provide a Drizzle db instance:\n' +
+                '  import { drizzle } from "drizzle-orm/node-postgres";\n' +
+                '  import { Pool } from "pg";\n' +
+                '  const db = drizzle(new Pool({ connectionString: process.env.DATABASE_URL }));');
         }
-        this.prisma = prisma;
+        if (typeof db.select !== 'function' || typeof db.insert !== 'function') {
+            throw new Error('Crudora: the provided db object does not look like a Drizzle ORM instance. ' +
+                'Make sure drizzle-orm is installed (npm install drizzle-orm) and that you are ' +
+                'passing the result of drizzle(pool) or drizzle(client), not a raw pool/connection.');
+        }
+        this.db = db;
+        this.dialect = dialect;
+        this.logger = logger;
     }
     registerModel(...modelClasses) {
         for (const modelClass of modelClasses) {
-            const modelName = modelClass.name;
-            this.models.set(modelName, modelClass);
-            const repository = new repository_1.Repository(modelClass, this.prisma);
-            this.repositories.set(modelName, repository);
+            const table = drizzleTableBuilder_1.DrizzleTableBuilder.build(modelClass, this.dialect);
+            // Pass the shared repositories Map so each repo can resolve siblings lazily
+            const repository = new repository_1.Repository(modelClass, this.db, table, this.repositories);
+            this.models.set(modelClass.name, modelClass);
+            this.tables.set(modelClass.name, table);
+            this.repositories.set(modelClass.name, repository);
         }
         return this;
     }
+    /**
+     * Register a model against a pre-built Drizzle table object (e.g. from `drizzle-kit introspect`).
+     * Skips `DrizzleTableBuilder` — useful when the database already exists and the schema
+     * was generated via introspection rather than Crudora decorators.
+     *
+     * Validation works if the model defines `@Field()` decorators matching the table columns.
+     * Without decorators, POST/PUT bodies pass through without Zod validation.
+     */
+    registerTable(modelClass, table) {
+        const repository = new repository_1.Repository(modelClass, this.db, table, this.repositories);
+        this.models.set(modelClass.name, modelClass);
+        this.tables.set(modelClass.name, table);
+        this.repositories.set(modelClass.name, repository);
+        return this;
+    }
     getRepository(modelClass) {
         const repository = this.repositories.get(modelClass.name);
         if (!repository) {
@@ -32,9 +80,25 @@ class Crudora {
         }
         return repository;
     }
-    generatePrismaSchema(databaseProvider) {
+    /**
+     * Returns the Drizzle table object for a registered model.
+     * Useful for raw queries that need access to columns excluded by `hidden`
+     * (e.g. fetching a password hash for authentication).
+     *
+     * @example
+     * const usersTable = crudora.getTable(User);
+     * const [row] = await db.select().from(usersTable).where(eq(usersTable.email, email)).limit(1);
+     */
+    getTable(modelClass) {
+        const table = this.tables.get(modelClass.name);
+        if (!table) {
+            throw new Error(`Table for ${modelClass.name} not found. Did you register the model?`);
+        }
+        return table;
+    }
+    generateDrizzleSchema() {
         const modelClasses = Array.from(this.models.values());
-        return schemaGenerator_1.SchemaGenerator.generatePrismaSchema(modelClasses, databaseProvider);
+        return schemaGenerator_1.SchemaGenerator.generateDrizzleSchema(modelClasses, this.dialect);
     }
     getValidationSchema(modelClass) {
         return validation_1.ValidationGenerator.generateZodSchema(modelClass);
@@ -42,176 +106,261 @@ class Crudora {
     getStrictValidationSchema(modelClass) {
         return validation_1.ValidationGenerator.generateStrictZodSchema(modelClass);
     }
-    // Custom route methods
-    get(path, handler) {
-        this.customRoutes.push({ method: 'GET', path, handler });
+    get(path, ...handlers) {
+        this.customRoutes.push({ method: 'GET', path, handlers });
         return this;
     }
-    post(path, handler) {
-        this.customRoutes.push({ method: 'POST', path, handler });
+    post(path, ...handlers) {
+        this.customRoutes.push({ method: 'POST', path, handlers });
         return this;
     }
-    put(path, handler) {
-        this.customRoutes.push({ method: 'PUT', path, handler });
+    put(path, ...handlers) {
+        this.customRoutes.push({ method: 'PUT', path, handlers });
         return this;
     }
-    delete(path, handler) {
-        this.customRoutes.push({ method: 'DELETE', path, handler });
+    delete(path, ...handlers) {
+        this.customRoutes.push({ method: 'DELETE', path, handlers });
         return this;
     }
-    patch(path, handler) {
-        this.customRoutes.push({ method: 'PATCH', path, handler });
+    patch(path, ...handlers) {
+        this.customRoutes.push({ method: 'PATCH', path, handlers });
         return this;
     }
-    // Auto-generate REST API routes
-    // Auto-generate REST API routes
+    /** Runs `fn` inside a database transaction and returns its result. */
+    async transaction(fn) {
+        return this.db.transaction(fn);
+    }
     generateRoutes(app, basePath = '/api') {
-        // Add API documentation endpoint
-        app.get(basePath, (req, res) => {
+        // Route discovery endpoint
+        app.get(basePath, (_req, res) => {
             const routes = [];
-            // Add CRUD routes for each model
-            for (const [modelName, modelClass] of this.models) {
+            for (const [, modelClass] of this.models) {
                 const routePath = `${basePath}/${modelClass.getTableName()}`;
-                routes.push({
-                    method: 'GET',
-                    path: routePath,
-                    description: `List all ${modelClass.getTableName()}`,
-                    type: 'CRUD'
-                }, {
-                    method: 'GET',
-                    path: `${routePath}/:id`,
-                    description: `Get ${modelClass.getTableName()} by ID`,
-                    type: 'CRUD'
-                }, {
-                    method: 'POST',
-                    path: routePath,
-                    description: `Create new ${modelClass.getTableName()}`,
-                    type: 'CRUD'
-                }, {
-                    method: 'PUT',
-                    path: `${routePath}/:id`,
-                    description: `Update ${modelClass.getTableName()} by ID`,
-                    type: 'CRUD'
-                }, {
-                    method: 'DELETE',
-                    path: `${routePath}/:id`,
-                    description: `Delete ${modelClass.getTableName()} by ID`,
-                    type: 'CRUD'
-                });
+                routes.push({ method: 'GET', path: routePath, description: `List all ${modelClass.getTableName()}`, type: 'CRUD' }, { method: 'GET', path: `${routePath}/:id`, description: `Get ${modelClass.getTableName()} by ID`, type: 'CRUD' }, { method: 'POST', path: routePath, description: `Create new ${modelClass.getTableName()}`, type: 'CRUD' }, { method: 'PUT', path: `${routePath}/:id`, description: `Replace ${modelClass.getTableName()} by ID`, type: 'CRUD' }, { method: 'PATCH', path: `${routePath}/:id`, description: `Partial update ${modelClass.getTableName()} by ID`, type: 'CRUD' }, { method: 'DELETE', path: `${routePath}/:id`, description: `Delete ${modelClass.getTableName()} by ID`, type: 'CRUD' });
             }
-            // Add custom routes
             for (const route of this.customRoutes) {
                 routes.push({
                     method: route.method,
                     path: `${basePath}${route.path}`,
                     description: `Custom ${route.method} route`,
-                    type: 'Custom'
+                    type: 'Custom',
                 });
             }
-            res.json({ routes });
+            res.json(ok({ routes }));
         });
-        // Generate CRUD routes for models
-        for (const [modelName, modelClass] of this.models) {
+        // CRUD routes per model
+        for (const [, modelClass] of this.models) {
             const repository = this.getRepository(modelClass);
             const validationSchema = this.getValidationSchema(modelClass);
+            const strictValidationSchema = this.getStrictValidationSchema(modelClass);
             const routePath = `${basePath}/${modelClass.getTableName()}`;
-            // GET /api/model - List all
+            // ── GET /resource ──────────────────────────────────────────────────────
             app.get(routePath, async (req, res) => {
                 try {
-                    const { page = 1, limit = 10, ...filters } = req.query;
-                    const skip = (Number(page) - 1) * Number(limit);
+                    const { page, limit = '10', orderBy, order, cursor, // presence triggers cursor mode
+                    cursorField, select, // comma-separated field names
+                    with: withStr, // comma-separated relation names
+                    withDeleted, ...filters } = req.query;
+                    const selectFields = select
+                        ? select.split(',').map((f) => f.trim()).filter((f) => SAFE_KEY_RE.test(f))
+                        : undefined;
+                    const withRelations = withStr
+                        ? withStr.split(',').map((r) => r.trim()).filter((r) => SAFE_KEY_RE.test(r)).slice(0, MAX_RELATIONS)
+                        : undefined;
+                    // Sanitize filter keys to prevent prototype pollution
+                    const safeFilters = {};
+                    for (const [k, v] of Object.entries(filters)) {
+                        if (SAFE_KEY_RE.test(k))
+                            safeFilters[k] = v;
+                    }
+                    const whereFilters = Object.keys(safeFilters).length ? safeFilters : undefined;
+                    // Clamp limit: reject NaN, 0, negatives; cap at MAX_LIMIT
+                    const rawLimit = Number(limit);
+                    const limitNum = Number.isFinite(rawLimit) && rawLimit > 0
+                        ? Math.min(rawLimit, MAX_LIMIT)
+                        : 10;
+                    const includeDeleted = withDeleted === 'true';
+                    // Multiple orderBy: ?orderBy=createdAt,name&order=desc,asc
+                    const orderByFields = orderBy ? orderBy.split(',').map((f) => f.trim()).filter(Boolean) : undefined;
+                    const orderValues = order
+                        ? order.split(',').map((o) => o.trim()).filter(Boolean)
+                        : undefined;
+                    const orderByArg = orderByFields && orderByFields.length === 1 ? orderByFields[0] : orderByFields;
+                    const orderArg = orderValues && orderValues.length === 1 ? orderValues[0] : orderValues;
+                    if (cursor !== undefined) {
+                        // ── Cursor-based pagination ────────────────────────────────────
+                        const result = await repository.findWithCursor({
+                            take: limitNum,
+                            cursor: cursor || null,
+                            cursorField,
+                            order: (orderValues?.[0]) ?? (order === 'desc' ? 'desc' : 'asc'),
+                            where: whereFilters,
+                            select: selectFields,
+                            with: withRelations,
+                            withDeleted: includeDeleted,
+                        });
+                        return res.json(ok(result.data, {
+                            cursor: { next: result.nextCursor, hasMore: result.hasMore },
+                        }));
+                    }
+                    // ── Offset-based pagination ────────────────────────────────────
+                    const rawPage = Number(page ?? 1);
+                    const pageNum = Number.isFinite(rawPage) && rawPage > 0 ? Math.floor(rawPage) : 1;
+                    const skip = (pageNum - 1) * limitNum;
                     const items = await repository.findAll({
                         skip,
-                        take: Number(limit),
-                        where: filters
-                    });
-                    const total = await repository.count(filters);
-                    res.json({
-                        data: items,
-                        pagination: {
-                            page: Number(page),
-                            limit: Number(limit),
-                            total,
-                            pages: Math.ceil(total / Number(limit))
-                        }
+                        take: limitNum,
+                        where: whereFilters,
+                        orderBy: orderByArg,
+                        order: orderArg,
+                        select: selectFields,
+                        with: withRelations,
+                        withDeleted: includeDeleted,
                     });
+                    const total = await repository.count(whereFilters, includeDeleted);
+                    return res.json(ok(items, {
+                        pagination: { page: pageNum, limit: limitNum, total, pages: total === 0 ? 0 : Math.ceil(total / limitNum) },
+                    }));
                 }
-                catch (error) {
-                    res.status(500).json({ error: 'Internal server error' });
+                catch (err) {
+                    this.logger?.error('GET request failed', {
+                        path: routePath,
+                        correlationId: req.correlationId,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
                 }
             });
-            // GET /api/model/:id - Get by ID
+            // ── GET /resource/:id ──────────────────────────────────────────────────
             app.get(`${routePath}/:id`, async (req, res) => {
                 try {
-                    const item = await repository.findById(req.params.id);
-                    if (!item) {
-                        return res.status(404).json({ error: 'Not found' });
-                    }
-                    res.json(item);
+                    const { select, with: withStr, withDeleted } = req.query;
+                    const selectFields = select
+                        ? select.split(',').map((f) => f.trim()).filter((f) => SAFE_KEY_RE.test(f))
+                        : undefined;
+                    const withRelations = withStr
+                        ? withStr.split(',').map((r) => r.trim()).filter((r) => SAFE_KEY_RE.test(r)).slice(0, MAX_RELATIONS)
+                        : undefined;
+                    const item = await repository.findById(req.params.id, {
+                        select: selectFields,
+                        with: withRelations,
+                        withDeleted: withDeleted === 'true',
+                    });
+                    if (!item)
+                        return res.status(404).json(fail('NOT_FOUND', 'Resource not found'));
+                    return res.json(ok(item));
                 }
-                catch (error) {
-                    res.status(500).json({ error: 'Internal server error' });
+                catch (err) {
+                    this.logger?.error('GET by ID request failed', {
+                        path: `${routePath}/:id`,
+                        id: req.params.id,
+                        correlationId: req.correlationId,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
                 }
             });
-            // POST /api/model - Create
+            // ── POST /resource ─────────────────────────────────────────────────────
             app.post(routePath, async (req, res) => {
                 try {
-                    // Gunakan partial validation schema instead of strict
-                    const validatedData = validationSchema.parse(req.body);
+                    const validatedData = strictValidationSchema.parse(req.body);
                     const item = await repository.create(validatedData);
-                    res.status(201).json(item);
+                    return res.status(201).json(ok(item));
                 }
                 catch (error) {
                     if (error instanceof zod_1.z.ZodError) {
-                        return res.status(400).json({ error: 'Validation error', details: error.issues });
+                        return res.status(422).json(fail('VALIDATION_ERROR', 'Validation failed', zodDetails(error.issues)));
                     }
-                    res.status(500).json({ error: 'Internal server error' });
+                    this.logger?.error('POST request failed', {
+                        path: routePath,
+                        correlationId: req.correlationId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
                 }
             });
-            // PUT /api/model/:id - Update (gunakan partial validation)
+            // ── PUT /resource/:id ──────────────────────────────────────────────────
             app.put(`${routePath}/:id`, async (req, res) => {
                 try {
-                    const validationSchema = this.getValidationSchema(modelClass);
+                    const validatedData = strictValidationSchema.parse(req.body);
+                    const item = await repository.update(req.params.id, validatedData);
+                    return res.json(ok(item));
+                }
+                catch (error) {
+                    if (error instanceof repository_1.NotFoundError)
+                        return res.status(404).json(fail('NOT_FOUND', error.message));
+                    if (error instanceof zod_1.z.ZodError) {
+                        return res.status(422).json(fail('VALIDATION_ERROR', 'Validation failed', zodDetails(error.issues)));
+                    }
+                    this.logger?.error('PUT request failed', {
+                        path: `${routePath}/:id`,
+                        id: req.params.id,
+                        correlationId: req.correlationId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
+                }
+            });
+            // ── PATCH /resource/:id ── partial update ─────────────────────────────
+            app.patch(`${routePath}/:id`, async (req, res) => {
+                try {
                     const validatedData = validationSchema.parse(req.body);
                     const item = await repository.update(req.params.id, validatedData);
-                    res.json(item);
+                    return res.json(ok(item));
                 }
                 catch (error) {
+                    if (error instanceof repository_1.NotFoundError)
+                        return res.status(404).json(fail('NOT_FOUND', error.message));
                     if (error instanceof zod_1.z.ZodError) {
-                        return res.status(400).json({ error: 'Validation error', details: error.issues });
+                        return res.status(422).json(fail('VALIDATION_ERROR', 'Validation failed', zodDetails(error.issues)));
                     }
-                    res.status(500).json({ error: 'Internal server error' });
+                    this.logger?.error('PATCH request failed', {
+                        path: `${routePath}/:id`,
+                        id: req.params.id,
+                        correlationId: req.correlationId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
                 }
             });
-            // DELETE /api/model/:id - Delete
+            // ── DELETE /resource/:id ───────────────────────────────────────────────
             app.delete(`${routePath}/:id`, async (req, res) => {
                 try {
                     await repository.delete(req.params.id);
-                    res.status(204).send();
+                    return res.status(204).send();
                 }
                 catch (error) {
-                    res.status(500).json({ error: 'Internal server error' });
+                    if (error instanceof repository_1.NotFoundError)
+                        return res.status(404).json(fail('NOT_FOUND', error.message));
+                    this.logger?.error('DELETE request failed', {
+                        path: `${routePath}/:id`,
+                        id: req.params.id,
+                        correlationId: req.correlationId,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    res.status(500).json(fail('INTERNAL_ERROR', 'Internal server error'));
                 }
             });
         }
-        // Generate custom routes
+        // Custom routes
         for (const route of this.customRoutes) {
             const fullPath = `${basePath}${route.path}`;
-            switch (route.method.toLowerCase()) {
+            const { method, handlers } = route;
+            switch (method.toLowerCase()) {
                 case 'get':
-                    app.get(fullPath, route.handler);
+                    app.get(fullPath, ...handlers);
                     break;
                 case 'post':
-                    app.post(fullPath, route.handler);
+                    app.post(fullPath, ...handlers);
                     break;
                 case 'put':
-                    app.put(fullPath, route.handler);
+                    app.put(fullPath, ...handlers);
                     break;
                 case 'delete':
-                    app.delete(fullPath, route.handler);
+                    app.delete(fullPath, ...handlers);
                     break;
                 case 'patch':
-                    app.patch(fullPath, route.handler);
+                    app.patch(fullPath, ...handlers);
                     break;
             }
         }