crudora 0.2.0 → 0.2.1

package/dist/index.js

@@ -1,28 +1,1686 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getRelationMetadata = exports.getFieldMetadata = exports.BelongsToMany = exports.BelongsTo = exports.HasOne = exports.HasMany = exports.Field = exports.Model = exports.ValidationGenerator = exports.DrizzleTableBuilder = exports.SchemaGenerator = exports.NotFoundError = exports.Repository = exports.CrudoraServer = exports.Crudora = void 0;
-require("reflect-metadata");
-var crudora_1 = require("./core/crudora");
-Object.defineProperty(exports, "Crudora", { enumerable: true, get: function () { return crudora_1.Crudora; } });
-var crudoraServer_1 = require("./core/crudoraServer");
-Object.defineProperty(exports, "CrudoraServer", { enumerable: true, get: function () { return crudoraServer_1.CrudoraServer; } });
-var repository_1 = require("./core/repository");
-Object.defineProperty(exports, "Repository", { enumerable: true, get: function () { return repository_1.Repository; } });
-Object.defineProperty(exports, "NotFoundError", { enumerable: true, get: function () { return repository_1.NotFoundError; } });
-var schemaGenerator_1 = require("./core/schemaGenerator");
-Object.defineProperty(exports, "SchemaGenerator", { enumerable: true, get: function () { return schemaGenerator_1.SchemaGenerator; } });
-var drizzleTableBuilder_1 = require("./core/drizzleTableBuilder");
-Object.defineProperty(exports, "DrizzleTableBuilder", { enumerable: true, get: function () { return drizzleTableBuilder_1.DrizzleTableBuilder; } });
-var validation_1 = require("./utils/validation");
-Object.defineProperty(exports, "ValidationGenerator", { enumerable: true, get: function () { return validation_1.ValidationGenerator; } });
-var model_1 = require("./core/model");
-Object.defineProperty(exports, "Model", { enumerable: true, get: function () { return model_1.Model; } });
-var model_2 = require("./decorators/model");
-Object.defineProperty(exports, "Field", { enumerable: true, get: function () { return model_2.Field; } });
-Object.defineProperty(exports, "HasMany", { enumerable: true, get: function () { return model_2.HasMany; } });
-Object.defineProperty(exports, "HasOne", { enumerable: true, get: function () { return model_2.HasOne; } });
-Object.defineProperty(exports, "BelongsTo", { enumerable: true, get: function () { return model_2.BelongsTo; } });
-Object.defineProperty(exports, "BelongsToMany", { enumerable: true, get: function () { return model_2.BelongsToMany; } });
-Object.defineProperty(exports, "getFieldMetadata", { enumerable: true, get: function () { return model_2.getFieldMetadata; } });
-Object.defineProperty(exports, "getRelationMetadata", { enumerable: true, get: function () { return model_2.getRelationMetadata; } });
+// src/index.ts
+import "reflect-metadata";
+
+// src/core/crudora.ts
+import { z as z2 } from "zod";
+
+// src/core/repository.ts
+import {
+  eq,
+  and,
+  or,
+  gt,
+  gte,
+  lt,
+  lte,
+  like,
+  ne,
+  inArray,
+  count as drizzleCount,
+  getTableColumns,
+  isNull,
+  asc,
+  desc
+} from "drizzle-orm";
+import { randomUUID } from "crypto";
+
+// src/decorators/model.ts
+import "reflect-metadata";
+var FIELD_METADATA_KEY = /* @__PURE__ */ Symbol("field");
+function Field(options) {
+  return function(target, context) {
+    if (typeof context === "string") {
+      const propertyKey = context;
+      const existingFields = Reflect.getMetadata(FIELD_METADATA_KEY, target.constructor) || {};
+      existingFields[propertyKey] = options;
+      Reflect.defineMetadata(FIELD_METADATA_KEY, existingFields, target.constructor);
+    } else {
+      const propertyKey = context.name;
+      const constructor = target.constructor;
+      const existingFields = Reflect.getMetadata(FIELD_METADATA_KEY, constructor) || {};
+      existingFields[propertyKey] = options;
+      Reflect.defineMetadata(FIELD_METADATA_KEY, existingFields, constructor);
+    }
+  };
+}
+function getFieldMetadata(target) {
+  return Reflect.getMetadata(FIELD_METADATA_KEY, target) || {};
+}
+var RELATION_METADATA_KEY = /* @__PURE__ */ Symbol("relations");
+function defineRelation(type, model, foreignKey, relatedKey) {
+  return function(target, propertyKey) {
+    const constructor = target.constructor;
+    const existing = Reflect.getMetadata(RELATION_METADATA_KEY, constructor) || {};
+    existing[propertyKey] = { type, model, foreignKey, relatedKey };
+    Reflect.defineMetadata(RELATION_METADATA_KEY, existing, constructor);
+  };
+}
+function HasMany(model, foreignKey, localKey) {
+  return defineRelation("hasMany", model, foreignKey, localKey);
+}
+function HasOne(model, foreignKey, localKey) {
+  return defineRelation("hasOne", model, foreignKey, localKey);
+}
+function BelongsTo(model, foreignKey, ownerKey) {
+  return defineRelation("belongsTo", model, foreignKey, ownerKey);
+}
+function BelongsToMany(model, pivotModel, pivotForeignKey, pivotRelatedKey, localKey) {
+  return function(target, propertyKey) {
+    const constructor = target.constructor;
+    const existing = Reflect.getMetadata(RELATION_METADATA_KEY, constructor) || {};
+    existing[propertyKey] = {
+      type: "belongsToMany",
+      model,
+      foreignKey: pivotForeignKey,
+      relatedKey: localKey,
+      pivotModel,
+      pivotRelatedKey
+    };
+    Reflect.defineMetadata(RELATION_METADATA_KEY, existing, constructor);
+  };
+}
+function getRelationMetadata(target) {
+  return Reflect.getMetadata(RELATION_METADATA_KEY, target) || {};
+}
+
+// src/core/repository.ts
+var SYSTEM_FIELDS = ["createdAt", "updatedAt", "deletedAt"];
+var MAX_IN_VALUES = 500;
+var MAX_LIKE_LENGTH = 200;
+var MAX_RELATIONS = 5;
+var INSERT_BATCH_SIZE = 500;
+var SAFE_KEY_RE = /^[a-zA-Z_][a-zA-Z0-9_]*(_gt|_gte|_lt|_lte|_ne|_like|_in)?$/;
+var OPERATOR_MAP = {
+  _gt: (col, val) => gt(col, val),
+  _gte: (col, val) => gte(col, val),
+  _lt: (col, val) => lt(col, val),
+  _lte: (col, val) => lte(col, val),
+  _ne: (col, val) => ne(col, val),
+  _like: (col, val) => like(col, `%${String(val).slice(0, MAX_LIKE_LENGTH)}%`),
+  // _in splits on literal commas. Values that contain commas must be URL-encoded (%2C)
+  // before reaching this layer. This is safe for UUID/integer FK values which never contain commas.
+  _in: (col, val) => inArray(col, String(val).split(",").filter((v) => v !== "").slice(0, MAX_IN_VALUES))
+};
+function encodeCursor(cursorField, cursorValue, pk, pkValue) {
+  return Buffer.from(JSON.stringify({ [cursorField]: cursorValue, [pk]: pkValue })).toString("base64");
+}
+function decodeCursor(cursor) {
+  try {
+    return JSON.parse(Buffer.from(cursor, "base64").toString("utf-8"));
+  } catch {
+    return {};
+  }
+}
+var NotFoundError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.code = "NOT_FOUND";
+    this.name = "NotFoundError";
+  }
+};
+var Repository = class _Repository {
+  constructor(modelClass, db, table, registry) {
+    this.modelClass = modelClass;
+    this.db = db;
+    this.table = table;
+    this.registry = registry;
+  }
+  // ─── Internal helpers ───────────────────────────────────────────────────────
+  /**
+   * Builds the Drizzle select-column object, merging hidden-field exclusion with
+   * an optional explicit field list. Returns `undefined` to select all columns.
+   */
+  buildSelectCols(selectFields, includeHidden = false) {
+    const hidden = [
+      ...includeHidden ? [] : this.modelClass.hidden ?? [],
+      // deletedAt is an internal implementation detail — never expose it by default
+      ...this.modelClass.softDelete ? ["deletedAt"] : []
+    ];
+    if (!hidden.length && !selectFields?.length) return void 0;
+    const all = getTableColumns(this.table);
+    let entries = Object.entries(all).filter(([col]) => !hidden.includes(col));
+    if (selectFields?.length) {
+      entries = entries.filter(([col]) => selectFields.includes(col));
+    }
+    return Object.fromEntries(entries);
+  }
+  buildWhere(where) {
+    if (!where) return void 0;
+    const cols = this.table;
+    const conds = [];
+    for (const [key, val] of Object.entries(where)) {
+      if (!Object.prototype.hasOwnProperty.call(where, key)) continue;
+      if (!SAFE_KEY_RE.test(key)) continue;
+      if (val === void 0 || val === "") continue;
+      const suffix = Object.keys(OPERATOR_MAP).find((op) => key.endsWith(op));
+      if (suffix) {
+        const colName = key.slice(0, -suffix.length);
+        if (Object.prototype.hasOwnProperty.call(cols, colName)) {
+          conds.push(OPERATOR_MAP[suffix](cols[colName], val));
+        }
+      } else {
+        if (Object.prototype.hasOwnProperty.call(cols, key)) {
+          conds.push(eq(cols[key], val));
+        }
+      }
+    }
+    if (conds.length === 0) return void 0;
+    return conds.length === 1 ? conds[0] : and(...conds);
+  }
+  softDeleteClause() {
+    if (!this.modelClass.softDelete) return void 0;
+    const cols = this.table;
+    if (!cols.deletedAt) {
+      throw new Error(
+        `Model "${this.modelClass.name}" has softDelete enabled but the table is missing a "deletedAt" column.`
+      );
+    }
+    return isNull(cols.deletedAt);
+  }
+  combineWhere(...clauses) {
+    const active = clauses.filter(Boolean);
+    if (active.length === 0) return void 0;
+    if (active.length === 1) return active[0];
+    return and(...active);
+  }
+  // ─── Relation loading ───────────────────────────────────────────────────────
+  /**
+   * Batch-loads relations for a list of records. Uses the _in operator so the
+   * total number of DB round-trips equals the number of requested relations.
+   */
+  async loadRelations(items, withRelations) {
+    if (!this.registry || !items.length || !withRelations.length) return items;
+    const relDefs = getRelationMetadata(this.modelClass);
+    let result = [...items];
+    for (const relName of withRelations.slice(0, MAX_RELATIONS)) {
+      const relDef = relDefs[relName];
+      if (!relDef) continue;
+      const RelModel = relDef.model();
+      const relRepo = this.registry.get(RelModel.name);
+      if (!relRepo) continue;
+      const pk = this.modelClass.getPrimaryKey();
+      if (relDef.type === "hasMany" || relDef.type === "hasOne") {
+        const localKey = relDef.relatedKey ?? pk;
+        const localVals = [...new Set(result.map((r) => r[localKey]).filter(Boolean))];
+        if (!localVals.length) {
+          result = result.map((r) => ({ ...r, [relName]: relDef.type === "hasOne" ? null : [] }));
+          continue;
+        }
+        const related = await relRepo.findAll({
+          where: { [`${relDef.foreignKey}_in`]: localVals.join(",") }
+        });
+        result = result.map((r) => {
+          const matches = related.filter((rel) => rel[relDef.foreignKey] === r[localKey]);
+          return { ...r, [relName]: relDef.type === "hasOne" ? matches[0] ?? null : matches };
+        });
+      } else if (relDef.type === "belongsTo") {
+        const ownerKey = relDef.relatedKey ?? RelModel.getPrimaryKey();
+        const fkVals = [...new Set(result.map((r) => r[relDef.foreignKey]).filter(Boolean))];
+        if (!fkVals.length) {
+          result = result.map((r) => ({ ...r, [relName]: null }));
+          continue;
+        }
+        const related = await relRepo.findAll({
+          where: { [`${ownerKey}_in`]: fkVals.join(",") }
+        });
+        result = result.map((r) => {
+          const match = related.find((rel) => rel[ownerKey] === r[relDef.foreignKey]);
+          return { ...r, [relName]: match ?? null };
+        });
+      } else if (relDef.type === "belongsToMany") {
+        const localKey = relDef.relatedKey ?? pk;
+        const localVals = [...new Set(result.map((r) => r[localKey]).filter(Boolean))];
+        if (!localVals.length) {
+          result = result.map((r) => ({ ...r, [relName]: [] }));
+          continue;
+        }
+        const PivotModel = relDef.pivotModel();
+        const pivotRepo = this.registry.get(PivotModel.name);
+        if (!pivotRepo) continue;
+        const pivotRows = await pivotRepo.findAll({
+          where: { [`${relDef.foreignKey}_in`]: localVals.join(",") }
+        });
+        const relatedIds = [
+          ...new Set(pivotRows.map((p) => p[relDef.pivotRelatedKey]).filter(Boolean))
+        ];
+        if (!relatedIds.length) {
+          result = result.map((r) => ({ ...r, [relName]: [] }));
+          continue;
+        }
+        const relatedPk = RelModel.getPrimaryKey();
+        const relatedRows = await relRepo.findAll({
+          where: { [`${relatedPk}_in`]: relatedIds.join(",") }
+        });
+        result = result.map((r) => {
+          const myPivots = pivotRows.filter((p) => p[relDef.foreignKey] === r[localKey]);
+          const myIds = new Set(myPivots.map((p) => p[relDef.pivotRelatedKey]));
+          return { ...r, [relName]: relatedRows.filter((rel) => myIds.has(rel[relatedPk])) };
+        });
+      }
+    }
+    return result;
+  }
+  // ─── Public API ─────────────────────────────────────────────────────────────
+  async create(data) {
+    let processed = { ...data };
+    for (const f of SYSTEM_FIELDS) delete processed[f];
+    if (this.modelClass.beforeCreate) {
+      processed = await this.modelClass.beforeCreate(processed);
+    }
+    const pkField = this.modelClass.getPrimaryKey();
+    if (!processed[pkField]) {
+      processed[pkField] = randomUUID();
+    }
+    for (const f of SYSTEM_FIELDS) delete processed[f];
+    await this.db.insert(this.table).values(processed);
+    const result = await this.findById(processed[pkField]);
+    if (!result) throw new Error(`Create failed: could not retrieve record after insert (id: ${processed[pkField]})`);
+    let final = result;
+    if (this.modelClass.afterCreate) {
+      final = await this.modelClass.afterCreate(processed, result);
+    }
+    return final;
+  }
+  async findById(id, opts) {
+    const pk = this.modelClass.getPrimaryKey();
+    const selectCols = this.buildSelectCols(opts?.select, opts?.includeHidden);
+    let hookOptions = { where: { [pk]: id } };
+    if (this.modelClass.beforeFind) {
+      hookOptions = await this.modelClass.beforeFind(hookOptions);
+    }
+    const extraWhere = this.buildWhere(hookOptions?.where ? { ...hookOptions.where, [pk]: void 0 } : void 0);
+    let query = selectCols ? this.db.select(selectCols).from(this.table) : this.db.select().from(this.table);
+    const whereClause = this.combineWhere(
+      eq(this.table[pk], id),
+      opts?.withDeleted ? void 0 : this.softDeleteClause(),
+      extraWhere
+    );
+    query = query.where(whereClause).limit(1);
+    const [result] = await query;
+    let found = result ?? null;
+    if (found && this.modelClass.afterFind) {
+      [found] = await this.modelClass.afterFind([found]);
+    }
+    if (found && opts?.with?.length) {
+      const [withResult] = await this.loadRelations([found], opts.with);
+      return withResult ?? null;
+    }
+    return found;
+  }
+  async findAll(options) {
+    let queryOptions = options ? { ...options } : void 0;
+    if (this.modelClass.beforeFind) {
+      queryOptions = await this.modelClass.beforeFind(queryOptions);
+    }
+    const selectCols = this.buildSelectCols(queryOptions?.select, queryOptions?.includeHidden);
+    const whereClause = this.combineWhere(
+      this.buildWhere(queryOptions?.where),
+      queryOptions?.withDeleted ? void 0 : this.softDeleteClause()
+    );
+    let query = selectCols ? this.db.select(selectCols).from(this.table) : this.db.select().from(this.table);
+    if (whereClause) query = query.where(whereClause);
+    if (queryOptions?.orderBy) {
+      const fields = Array.isArray(queryOptions.orderBy) ? queryOptions.orderBy : [queryOptions.orderBy];
+      const orders = Array.isArray(queryOptions.order) ? queryOptions.order : [queryOptions.order ?? "asc"];
+      const orderClauses = fields.map((field, i) => {
+        if (!SAFE_KEY_RE.test(field)) return null;
+        if (!Object.prototype.hasOwnProperty.call(this.table, field)) return null;
+        const col = this.table[field];
+        return (orders[i] ?? orders[0] ?? "asc") === "desc" ? desc(col) : asc(col);
+      }).filter(Boolean);
+      if (orderClauses.length) query = query.orderBy(...orderClauses);
+    }
+    if (queryOptions?.skip !== void 0) query = query.offset(queryOptions.skip);
+    if (queryOptions?.take !== void 0) query = query.limit(queryOptions.take);
+    let results = await query;
+    if (this.modelClass.afterFind) {
+      results = await this.modelClass.afterFind(results);
+    }
+    if (queryOptions?.with?.length) {
+      results = await this.loadRelations(results, queryOptions.with);
+    }
+    return results;
+  }
+  /**
+   * Cursor-based pagination — more efficient than offset for large datasets.
+   *
+   * @example
+   * const page1 = await userRepo.findWithCursor({ take: 10 });
+   * const page2 = await userRepo.findWithCursor({ take: 10, cursor: page1.nextCursor });
+   */
+  async findWithCursor(options) {
+    const {
+      take = 10,
+      cursor,
+      order = "asc",
+      where,
+      select,
+      with: withRelations,
+      withDeleted,
+      includeHidden
+    } = options;
+    const pk = this.modelClass.getPrimaryKey();
+    const requestedCursorField = options.cursorField ?? pk;
+    const cursorField = SAFE_KEY_RE.test(requestedCursorField) && Object.prototype.hasOwnProperty.call(this.table, requestedCursorField) ? requestedCursorField : pk;
+    const col = this.table[cursorField];
+    const pkCol = this.table[pk];
+    const cursorFieldIsPk = cursorField === pk;
+    let cursorValue = null;
+    let cursorPkValue = null;
+    if (cursor) {
+      const decoded = decodeCursor(cursor);
+      cursorValue = decoded[cursorField] ?? null;
+      cursorPkValue = decoded[pk] ?? null;
+    }
+    let cursorCond = void 0;
+    if (cursorValue !== null && col) {
+      if (cursorFieldIsPk || cursorPkValue === null) {
+        cursorCond = order === "desc" ? lt(col, cursorValue) : gt(col, cursorValue);
+      } else {
+        cursorCond = or(
+          order === "desc" ? lt(col, cursorValue) : gt(col, cursorValue),
+          and(
+            eq(col, cursorValue),
+            order === "desc" ? lt(pkCol, cursorPkValue) : gt(pkCol, cursorPkValue)
+          )
+        );
+      }
+    }
+    const whereClause = this.combineWhere(
+      this.buildWhere(where),
+      withDeleted ? void 0 : this.softDeleteClause(),
+      cursorCond
+    );
+    const selectCols = this.buildSelectCols(select, includeHidden);
+    let query = selectCols ? this.db.select(selectCols).from(this.table) : this.db.select().from(this.table);
+    if (whereClause) query = query.where(whereClause);
+    if (col) {
+      query = !cursorFieldIsPk && pkCol ? query.orderBy(order === "desc" ? desc(col) : asc(col), order === "desc" ? desc(pkCol) : asc(pkCol)) : query.orderBy(order === "desc" ? desc(col) : asc(col));
+    }
+    query = query.limit(take + 1);
+    let results = await query;
+    const hasMore = results.length > take;
+    const data = hasMore ? results.slice(0, take) : results;
+    const nextCursor = hasMore && data.length > 0 ? encodeCursor(cursorField, data[data.length - 1][cursorField], pk, data[data.length - 1][pk]) : null;
+    if (this.modelClass.afterFind) {
+      const processed = await this.modelClass.afterFind(data);
+      const finalData2 = withRelations?.length ? await this.loadRelations(processed, withRelations) : processed;
+      return { data: finalData2, nextCursor, hasMore };
+    }
+    const finalData = withRelations?.length ? await this.loadRelations(data, withRelations) : data;
+    return { data: finalData, nextCursor, hasMore };
+  }
+  async update(id, data) {
+    let processed = { ...data };
+    const pk = this.modelClass.getPrimaryKey();
+    delete processed[pk];
+    delete processed["createdAt"];
+    delete processed["deletedAt"];
+    if (this.modelClass.beforeUpdate) {
+      processed = await this.modelClass.beforeUpdate(id, processed);
+    }
+    delete processed[pk];
+    delete processed["createdAt"];
+    delete processed["deletedAt"];
+    if (Object.keys(processed).length === 0) {
+      const existing = await this.findById(id);
+      if (!existing) throw new NotFoundError(`Record with id "${id}" not found`);
+      return existing;
+    }
+    if (this.modelClass.timestamps !== false) {
+      const cols = getTableColumns(this.table);
+      if ("updatedAt" in cols) {
+        processed.updatedAt = /* @__PURE__ */ new Date();
+      }
+    }
+    if (this.modelClass.softDelete) {
+      const tbl = this.table;
+      const [row] = await this.db.select({ _deleted: tbl.deletedAt }).from(this.table).where(eq(tbl[pk], id)).limit(1);
+      if (!row) throw new NotFoundError(`Record with id "${id}" not found`);
+      if (row._deleted !== null && row._deleted !== void 0) {
+        throw new NotFoundError(`Record with id "${id}" is soft-deleted and cannot be updated`);
+      }
+    }
+    const updateWhere = this.combineWhere(
+      eq(this.table[pk], id),
+      this.softDeleteClause()
+    );
+    await this.db.update(this.table).set(processed).where(updateWhere);
+    const result = await this.findById(id);
+    if (!result) throw new NotFoundError(`Record with id "${id}" not found`);
+    let final = result;
+    if (this.modelClass.afterUpdate) {
+      final = await this.modelClass.afterUpdate(id, processed, result);
+    }
+    return final;
+  }
+  async delete(id) {
+    const existing = await this.findById(id);
+    if (!existing) throw new NotFoundError(`Record with id "${id}" not found`);
+    if (this.modelClass.beforeDelete) {
+      await this.modelClass.beforeDelete(id);
+    }
+    const pk = this.modelClass.getPrimaryKey();
+    if (this.modelClass.softDelete) {
+      await this.db.update(this.table).set({ deletedAt: /* @__PURE__ */ new Date() }).where(eq(this.table[pk], id));
+    } else {
+      await this.db.delete(this.table).where(eq(this.table[pk], id));
+    }
+    let final = existing;
+    if (this.modelClass.afterDelete) {
+      final = await this.modelClass.afterDelete(id, existing);
+    }
+    return final;
+  }
+  async hardDelete(id) {
+    const existing = await this.findById(id, { withDeleted: true });
+    if (!existing) throw new NotFoundError(`Record with id "${id}" not found`);
+    const pk = this.modelClass.getPrimaryKey();
+    await this.db.delete(this.table).where(eq(this.table[pk], id));
+    return existing;
+  }
+  async restore(id) {
+    const pk = this.modelClass.getPrimaryKey();
+    const cols = this.table;
+    if (!cols.deletedAt) throw new Error("softDelete is not enabled on this model");
+    const [raw] = await this.db.select().from(this.table).where(eq(cols[pk], id)).limit(1);
+    if (!raw) throw new NotFoundError(`Record with id "${id}" not found`);
+    if (!raw.deletedAt) throw new Error(`Record with id "${id}" is not soft-deleted`);
+    await this.db.update(this.table).set({ deletedAt: null }).where(eq(cols[pk], id));
+    const selectCols = this.buildSelectCols();
+    let query = selectCols ? this.db.select(selectCols).from(this.table) : this.db.select().from(this.table);
+    query = query.where(eq(cols[pk], id)).limit(1);
+    const [result] = await query;
+    return result ?? null;
+  }
+  async count(where, withDeleted) {
+    const whereClause = this.combineWhere(
+      this.buildWhere(where),
+      withDeleted ? void 0 : this.softDeleteClause()
+    );
+    let query = this.db.select({ count: drizzleCount() }).from(this.table);
+    if (whereClause) query = query.where(whereClause);
+    const [result] = await query;
+    return Number(result.count);
+  }
+  /** Returns the first record matching `where`, or null. Builds a direct LIMIT 1 query — does not delegate to findAll. */
+  async findOne(where, opts) {
+    const selectCols = this.buildSelectCols(opts?.select, opts?.includeHidden);
+    const whereClause = this.combineWhere(
+      this.buildWhere(where),
+      opts?.withDeleted ? void 0 : this.softDeleteClause()
+    );
+    let query = selectCols ? this.db.select(selectCols).from(this.table) : this.db.select().from(this.table);
+    if (whereClause) query = query.where(whereClause);
+    query = query.limit(1);
+    const [result] = await query;
+    let found = result ?? null;
+    if (found && this.modelClass.afterFind) {
+      [found] = await this.modelClass.afterFind([found]);
+    }
+    if (found && opts?.with?.length) {
+      const [withResult] = await this.loadRelations([found], opts.with);
+      return withResult ?? null;
+    }
+    return found;
+  }
+  /**
+   * Returns true if at least one record matches `where`.
+   * Uses SELECT pk LIMIT 1 — more efficient than COUNT(*) because the DB stops at the first match.
+   */
+  async exists(where, withDeleted) {
+    const pk = this.modelClass.getPrimaryKey();
+    const whereClause = this.combineWhere(
+      this.buildWhere(where),
+      withDeleted ? void 0 : this.softDeleteClause()
+    );
+    let query = this.db.select({ _pk: this.table[pk] }).from(this.table);
+    if (whereClause) query = query.where(whereClause);
+    query = query.limit(1);
+    const [result] = await query;
+    return result !== void 0;
+  }
+  /**
+   * Inserts multiple records in a single INSERT statement.
+   * Calls `beforeCreate` for each row. Calls `afterCreateMany` once with all
+   * results — use this hook for batch-aware side effects (e.g. bulk notifications).
+   * Individual `afterCreate` is intentionally NOT called per row for performance.
+   */
+  async createMany(data) {
+    if (data.length === 0) return [];
+    const pk = this.modelClass.getPrimaryKey();
+    const processed = await Promise.all(
+      data.map(async (item) => {
+        let row = { ...item };
+        for (const f of SYSTEM_FIELDS) delete row[f];
+        if (this.modelClass.beforeCreate) {
+          row = await this.modelClass.beforeCreate(row);
+        }
+        for (const f of SYSTEM_FIELDS) delete row[f];
+        if (!row[pk]) row[pk] = randomUUID();
+        return row;
+      })
+    );
+    for (let i = 0; i < processed.length; i += INSERT_BATCH_SIZE) {
+      await this.db.insert(this.table).values(processed.slice(i, i + INSERT_BATCH_SIZE));
+    }
+    const pks = processed.map((r) => r[pk]);
+    const results = [];
+    for (let i = 0; i < pks.length; i += MAX_IN_VALUES) {
+      const batch = pks.slice(i, i + MAX_IN_VALUES);
+      const rows = await this.findAll({ where: { [`${pk}_in`]: batch.join(",") } });
+      results.push(...rows);
+    }
+    const pkOrder = new Map(pks.map((id, i) => [id, i]));
+    results.sort((a, b) => (pkOrder.get(a[pk]) ?? 0) - (pkOrder.get(b[pk]) ?? 0));
+    if (this.modelClass.afterCreateMany) {
+      return this.modelClass.afterCreateMany(results);
+    }
+    return results;
+  }
+  /**
+   * Runs `fn` inside a database transaction. The callback receives a new
+   * Repository bound to the transaction connection.
+   *
+   * @example
+   * await userRepo.transaction(async (trx) => {
+   *   await trx.create({ name: 'Alice' });
+   *   await trx.update(id, { name: 'Bob' });
+   * });
+   */
+  async transaction(fn) {
+    return this.db.transaction(async (trx) => {
+      let trxRegistry;
+      if (this.registry) {
+        trxRegistry = /* @__PURE__ */ new Map();
+        for (const [name, repo] of this.registry.entries()) {
+          trxRegistry.set(name, new _Repository(repo.modelClass, trx, repo.table, trxRegistry));
+        }
+      }
+      return fn(new _Repository(this.modelClass, trx, this.table, trxRegistry));
+    });
+  }
+};
+
+// src/core/schemaGenerator.ts
+function safe(s) {
+  return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function pgColumnDef(name, opts) {
+  const type = opts.type;
+  let col;
+  const n = safe(name);
+  switch (type) {
+    case "uuid":
+      col = `uuid('${n}')`;
+      break;
+    case "text":
+      col = `text('${n}')`;
+      break;
+    case "integer":
+      col = `integer('${n}')`;
+      break;
+    case "number":
+      col = `doublePrecision('${n}')`;
+      break;
+    case "boolean":
+      col = `boolean('${n}')`;
+      break;
+    case "date":
+      col = `timestamp('${n}', { mode: 'date' })`;
+      break;
+    case "decimal":
+      col = `decimal('${n}', { precision: ${opts.precision ?? 10}, scale: ${opts.scale ?? 2} })`;
+      break;
+    case "json":
+      col = `json('${n}')`;
+      break;
+    case "enum":
+      col = `text('${n}')`;
+      break;
+    case "bigint":
+      col = `bigint('${n}', { mode: 'number' })`;
+      break;
+    case "serial":
+      col = `serial('${n}')`;
+      break;
+    case "array":
+      col = `text('${n}').array()`;
+      break;
+    case "string":
+    default:
+      col = `varchar('${n}', { length: ${opts.length ?? 255} })`;
+  }
+  if (opts.primary) col += ".primaryKey()";
+  if (opts.required && !opts.nullable && opts.type !== "serial") col += ".notNull()";
+  if (opts.unique) col += ".unique()";
+  if (opts.default !== void 0 && opts.type !== "serial") col += `.default(${JSON.stringify(opts.default)})`;
+  return col;
+}
+function mysqlColumnDef(name, opts) {
+  const type = opts.type;
+  let col;
+  const n = safe(name);
+  switch (type) {
+    case "uuid":
+      col = `varchar('${n}', { length: 36 })`;
+      break;
+    case "text":
+      col = `text('${n}')`;
+      break;
+    case "integer":
+      col = `int('${n}')`;
+      break;
+    case "number":
+      col = `double('${n}')`;
+      break;
+    case "boolean":
+      col = `boolean('${n}')`;
+      break;
+    case "date":
+      col = `datetime('${n}', { mode: 'date' })`;
+      break;
+    case "decimal":
+      col = `decimal('${n}', { precision: ${opts.precision ?? 10}, scale: ${opts.scale ?? 2} })`;
+      break;
+    case "json":
+      col = `json('${n}')`;
+      break;
+    case "enum":
+      col = `mysqlEnum('${n}', [${(opts.enumValues ?? []).map((v) => `'${safe(v)}'`).join(", ")}])`;
+      break;
+    case "bigint":
+      col = `bigint('${n}', { mode: 'number' })`;
+      break;
+    case "serial":
+      col = `int('${n}').autoincrement()`;
+      break;
+    case "array":
+      col = `json('${n}')`;
+      break;
+    case "string":
+    default:
+      col = `varchar('${n}', { length: ${opts.length ?? 255} })`;
+  }
+  if (opts.primary) col += ".primaryKey()";
+  if (opts.required && !opts.nullable && opts.type !== "serial") col += ".notNull()";
+  if (opts.unique) col += ".unique()";
+  if (opts.default !== void 0 && opts.type !== "serial") col += `.default(${JSON.stringify(opts.default)})`;
+  return col;
+}
+function generateModelBlock(modelClass, dialect, schemaVars) {
+  const fields = getFieldMetadata(modelClass);
+  const tableName = modelClass.getTableName();
+  const schemaName = modelClass.schema;
+  const exportName = modelClass.name.charAt(0).toLowerCase() + modelClass.name.slice(1) + "Table";
+  const columnDef = dialect === "postgresql" ? pgColumnDef : mysqlColumnDef;
+  const cols = [];
+  for (const [fieldName, opts] of Object.entries(fields)) {
+    cols.push(`  ${fieldName}: ${columnDef(fieldName, opts)},`);
+  }
+  if (modelClass.timestamps !== false) {
+    if (dialect === "postgresql") {
+      cols.push(`  createdAt: timestamp('createdAt', { mode: 'date' }).defaultNow().notNull(),`);
+      cols.push(`  updatedAt: timestamp('updatedAt', { mode: 'date' }).defaultNow().notNull(),`);
+    } else {
+      cols.push(`  createdAt: datetime('createdAt', { mode: 'date' }).notNull(),`);
+      cols.push(`  updatedAt: datetime('updatedAt', { mode: 'date' }).notNull(),`);
+    }
+  }
+  if (modelClass.softDelete) {
+    if (dialect === "postgresql") {
+      cols.push(`  deletedAt: timestamp('deletedAt', { mode: 'date' }),`);
+    } else {
+      cols.push(`  deletedAt: datetime('deletedAt', { mode: 'date' }),`);
+    }
+  }
+  let tableCall;
+  if (schemaName) {
+    const schemaVar = schemaVars.get(schemaName);
+    tableCall = `${schemaVar}.table('${safe(tableName)}', {
+${cols.join("\n")}
+})`;
+  } else {
+    const tableFactory = dialect === "postgresql" ? "pgTable" : "mysqlTable";
+    tableCall = `${tableFactory}('${safe(tableName)}', {
+${cols.join("\n")}
+})`;
+  }
+  return `export const ${exportName} = ${tableCall};
+`;
+}
+var SchemaGenerator = class {
+  static generateDrizzleSchema(models, dialect) {
+    const schemaNames = /* @__PURE__ */ new Set();
+    for (const m of models) {
+      const s = m.schema;
+      if (s) schemaNames.add(s);
+    }
+    const schemaVars = /* @__PURE__ */ new Map();
+    for (const name of schemaNames) {
+      schemaVars.set(name, name + "Schema");
+    }
+    const coreImports = /* @__PURE__ */ new Set();
+    const schemaFactory = dialect === "postgresql" ? "pgSchema" : "mysqlSchema";
+    const tableFactory = dialect === "postgresql" ? "pgTable" : "mysqlTable";
+    const pkg = dialect === "postgresql" ? "drizzle-orm/pg-core" : "drizzle-orm/mysql-core";
+    if (schemaNames.size > 0) coreImports.add(schemaFactory);
+    const hasDefaultSchema = models.some((m) => !m.schema);
+    if (hasDefaultSchema) coreImports.add(tableFactory);
+    const colImports = /* @__PURE__ */ new Set();
+    for (const modelClass of models) {
+      const fields = getFieldMetadata(modelClass);
+      for (const opts of Object.values(fields)) {
+        colImports.add(getColumnImport(opts.type, dialect));
+      }
+      if (modelClass.timestamps !== false) {
+        colImports.add(dialect === "postgresql" ? "timestamp" : "datetime");
+      }
+    }
+    const allImports = /* @__PURE__ */ new Set([...coreImports, ...colImports]);
+    let output = `// Auto-generated by Crudora \u2014 do not edit manually
+`;
+    output += `import { ${[...allImports].sort().join(", ")} } from '${pkg}';
+
+`;
+    for (const [name, varName] of schemaVars) {
+      output += `const ${varName} = ${schemaFactory}('${safe(name)}');
+`;
+    }
+    if (schemaVars.size > 0) output += "\n";
+    for (const modelClass of models) {
+      output += generateModelBlock(modelClass, dialect, schemaVars) + "\n";
+    }
+    return output;
+  }
+};
+function getColumnImport(type, dialect) {
+  if (dialect === "postgresql") {
+    const map = {
+      uuid: "uuid",
+      text: "text",
+      string: "varchar",
+      integer: "integer",
+      number: "doublePrecision",
+      boolean: "boolean",
+      date: "timestamp",
+      decimal: "decimal",
+      json: "json",
+      enum: "text",
+      bigint: "bigint",
+      serial: "serial",
+      array: "text"
+    };
+    return map[type] ?? "varchar";
+  } else {
+    const map = {
+      uuid: "varchar",
+      text: "text",
+      string: "varchar",
+      integer: "int",
+      number: "double",
+      boolean: "boolean",
+      date: "datetime",
+      decimal: "decimal",
+      json: "json",
+      enum: "mysqlEnum",
+      bigint: "bigint",
+      serial: "int",
+      array: "json"
+    };
+    return map[type] ?? "varchar";
+  }
+}
+
+// src/utils/validation.ts
+import { z } from "zod";
+function zodTypeFor(opts, forStrict) {
+  const { type, required = false, nullable = false, length } = opts;
+  let base;
+  switch (type) {
+    case "integer":
+      base = z.number().int();
+      break;
+    case "number":
+      base = z.number();
+      break;
+    case "boolean":
+      base = z.boolean();
+      break;
+    case "date":
+      base = z.coerce.date();
+      break;
+    case "decimal":
+      base = z.string().regex(/^-?\d+(\.\d+)?$/, "Must be a valid decimal number");
+      break;
+    case "json":
+      base = z.union([z.record(z.string(), z.any()), z.array(z.any())]);
+      break;
+    case "uuid":
+      base = z.uuid();
+      break;
+    case "enum":
+      base = opts.enumValues?.length ? z.enum(opts.enumValues) : z.string();
+      break;
+    case "bigint":
+      base = z.number().int();
+      break;
+    case "serial":
+      base = z.number().int().positive();
+      break;
+    case "array":
+      base = z.array(z.string());
+      break;
+    case "string":
+      base = length ? z.string().max(length) : z.string();
+      break;
+    case "text":
+    default:
+      base = z.string();
+  }
+  if (nullable) base = base.nullable();
+  if (forStrict) {
+    return required ? base : base.optional();
+  }
+  return base.optional();
+}
+var SYSTEM_FIELDS2 = /* @__PURE__ */ new Set(["createdAt", "updatedAt", "deletedAt"]);
+function resolveFields(modelClass) {
+  const fieldMeta = getFieldMetadata(modelClass);
+  const hasMeta = Object.keys(fieldMeta).length > 0;
+  const fillable = modelClass.fillable;
+  if (hasMeta) {
+    let entries = Object.entries(fieldMeta).filter(
+      ([name, opts]) => !opts.primary && !SYSTEM_FIELDS2.has(name)
+    );
+    if (fillable?.length) {
+      entries = entries.filter(([name]) => fillable.includes(name));
+    }
+    return entries.map(([name, opts]) => ({ name, opts }));
+  }
+  return (fillable ?? []).map((name) => ({
+    name,
+    opts: { type: "string", required: false }
+  }));
+}
+var ValidationGenerator = class {
+  static generateZodSchema(modelClass) {
+    const fields = resolveFields(modelClass);
+    if (fields.length === 0) return z.object({}).partial();
+    const shape = {};
+    for (const { name, opts } of fields) {
+      shape[name] = zodTypeFor(opts, false);
+    }
+    return z.object(shape);
+  }
+  static generateStrictZodSchema(modelClass) {
+    const fields = resolveFields(modelClass);
+    if (fields.length === 0) return z.object({});
+    const shape = {};
+    for (const { name, opts } of fields) {
+      shape[name] = zodTypeFor(opts, true);
+    }
+    return z.object(shape);
+  }
+};
+
+// src/core/drizzleTableBuilder.ts
+import {
+  pgTable,
+  pgSchema,
+  text,
+  varchar,
+  integer,
+  doublePrecision,
+  boolean,
+  timestamp,
+  decimal,
+  json,
+  uuid,
+  bigint as pgBigint,
+  serial as pgSerial
+} from "drizzle-orm/pg-core";
+import {
+  mysqlTable,
+  mysqlSchema,
+  varchar as mysqlVarchar,
+  int,
+  double,
+  boolean as mysqlBoolean,
+  datetime,
+  decimal as mysqlDecimal,
+  json as mysqlJson,
+  text as mysqlText,
+  bigint as mysqlBigint,
+  mysqlEnum
+} from "drizzle-orm/mysql-core";
+function buildPgColumn(name, opts) {
+  const type = opts.type;
+  let col;
+  switch (type) {
+    case "uuid":
+      col = uuid(name);
+      break;
+    case "text":
+      col = text(name);
+      break;
+    case "integer":
+      col = integer(name);
+      break;
+    case "number":
+      col = doublePrecision(name);
+      break;
+    case "boolean":
+      col = boolean(name);
+      break;
+    case "date":
+      col = timestamp(name, { mode: "date" });
+      break;
+    case "decimal":
+      col = decimal(name, {
+        precision: opts.precision ?? 10,
+        scale: opts.scale ?? 2
+      });
+      break;
+    case "json":
+      col = json(name);
+      break;
+    case "enum":
+      col = text(name);
+      break;
+    case "bigint":
+      col = pgBigint(name, { mode: "number" });
+      break;
+    case "serial":
+      col = pgSerial(name);
+      break;
+    case "array":
+      col = text(name).array();
+      break;
+    case "string":
+    default:
+      col = varchar(name, { length: opts.length ?? 255 });
+  }
+  if (opts.primary) col = col.primaryKey();
+  if (opts.required && !opts.nullable && opts.type !== "serial") col = col.notNull();
+  if (opts.unique) col = col.unique();
+  if (opts.default !== void 0 && opts.type !== "serial") col = col.default(opts.default);
+  return col;
+}
+function buildMysqlColumn(name, opts) {
+  const type = opts.type;
+  let col;
+  switch (type) {
+    case "uuid":
+      col = mysqlVarchar(name, { length: 36 });
+      break;
+    case "text":
+      col = mysqlText(name);
+      break;
+    case "integer":
+      col = int(name);
+      break;
+    case "number":
+      col = double(name);
+      break;
+    case "boolean":
+      col = mysqlBoolean(name);
+      break;
+    case "date":
+      col = datetime(name, { mode: "date" });
+      break;
+    case "decimal":
+      col = mysqlDecimal(name, {
+        precision: opts.precision ?? 10,
+        scale: opts.scale ?? 2
+      });
+      break;
+    case "json":
+      col = mysqlJson(name);
+      break;
+    case "enum":
+      if (!opts.enumValues?.length) {
+        throw new Error(`Field "${name}" of type "enum" requires the enumValues option`);
+      }
+      col = mysqlEnum(name, opts.enumValues);
+      break;
+    case "bigint":
+      col = mysqlBigint(name, { mode: "number" });
+      break;
+    case "serial":
+      col = int(name).autoincrement();
+      break;
+    case "array":
+      throw new Error(`Field type "array" is not supported in MySQL dialect. Use "json" instead.`);
+    case "string":
+    default:
+      col = mysqlVarchar(name, { length: opts.length ?? 255 });
+  }
+  if (opts.primary) col = col.primaryKey();
+  if (opts.required && !opts.nullable && opts.type !== "serial") col = col.notNull();
+  if (opts.unique) col = col.unique();
+  if (opts.default !== void 0 && opts.type !== "serial") col = col.default(opts.default);
+  return col;
+}
+function buildPgColumns(fields, modelClass) {
+  const cols = {};
+  for (const [name, opts] of Object.entries(fields)) {
+    cols[name] = buildPgColumn(name, opts);
+  }
+  if (modelClass.timestamps !== false) {
+    cols.createdAt = timestamp("createdAt", { mode: "date" }).defaultNow().notNull();
+    cols.updatedAt = timestamp("updatedAt", { mode: "date" }).defaultNow().notNull();
+  }
+  if (modelClass.softDelete) {
+    cols.deletedAt = timestamp("deletedAt", { mode: "date" });
+  }
+  return cols;
+}
+function buildMysqlColumns(fields, modelClass) {
+  const cols = {};
+  for (const [name, opts] of Object.entries(fields)) {
+    cols[name] = buildMysqlColumn(name, opts);
+  }
+  if (modelClass.timestamps !== false) {
+    cols.createdAt = datetime("createdAt", { mode: "date" }).notNull();
+    cols.updatedAt = datetime("updatedAt", { mode: "date" }).notNull();
+  }
+  if (modelClass.softDelete) {
+    cols.deletedAt = datetime("deletedAt", { mode: "date" });
+  }
+  return cols;
+}
+var DrizzleTableBuilder = class {
+  static build(modelClass, dialect) {
+    const fields = getFieldMetadata(modelClass);
+    const tableName = modelClass.getTableName();
+    const schemaName = modelClass.schema;
+    if (dialect === "postgresql") {
+      const cols = buildPgColumns(fields, modelClass);
+      return schemaName ? pgSchema(schemaName).table(tableName, cols) : pgTable(tableName, cols);
+    }
+    if (dialect === "mysql") {
+      const cols = buildMysqlColumns(fields, modelClass);
+      return schemaName ? mysqlSchema(schemaName).table(tableName, cols) : mysqlTable(tableName, cols);
+    }
+    throw new Error(`Unsupported dialect: ${dialect}. Use 'postgresql' or 'mysql'.`);
+  }
+};
+
+// src/core/crudora.ts
+var MAX_LIMIT = 1e3;
+var MAX_RELATIONS2 = 5;
+var SAFE_KEY_RE2 = /^[a-zA-Z_][a-zA-Z0-9_]*(_gt|_gte|_lt|_lte|_ne|_like|_in)?$/;
+function ok(data, meta) {
+  return meta !== void 0 ? { success: true, data, meta } : { success: true, data };
+}
+function fail(code, message, details) {
+  const error = { code, message };
+  if (details !== void 0) error.details = details;
+  return { success: false, error };
+}
+function zodDetails(issues) {
+  return issues.map((issue) => ({
+    field: issue.path.length ? issue.path.join(".") : "_root",
+    message: issue.message
+  }));
+}
+var Crudora = class {
+  constructor(db, dialect, logger) {
+    this.models = /* @__PURE__ */ new Map();
+    this.tables = /* @__PURE__ */ new Map();
+    this.repositories = /* @__PURE__ */ new Map();
+    this.customRoutes = [];
+    if (!db) {
+      throw new Error(
+        'Crudora: db is required. Provide a Drizzle db instance:\n  import { drizzle } from "drizzle-orm/node-postgres";\n  import { Pool } from "pg";\n  const db = drizzle(new Pool({ connectionString: process.env.DATABASE_URL }));'
+      );
+    }
+    if (typeof db.select !== "function" || typeof db.insert !== "function") {
+      throw new Error(
+        "Crudora: the provided db object does not look like a Drizzle ORM instance. Make sure drizzle-orm is installed (npm install drizzle-orm) and that you are passing the result of drizzle(pool) or drizzle(client), not a raw pool/connection."
+      );
+    }
+    this.db = db;
+    this.dialect = dialect;
+    this.logger = logger;
+  }
+  registerModel(...modelClasses) {
+    for (const modelClass of modelClasses) {
+      const table = DrizzleTableBuilder.build(modelClass, this.dialect);
+      const repository = new Repository(modelClass, this.db, table, this.repositories);
+      this.models.set(modelClass.name, modelClass);
+      this.tables.set(modelClass.name, table);
+      this.repositories.set(modelClass.name, repository);
+    }
+    return this;
+  }
+  /**
+   * Register a model against a pre-built Drizzle table object (e.g. from `drizzle-kit introspect`).
+   * Skips `DrizzleTableBuilder` — useful when the database already exists and the schema
+   * was generated via introspection rather than Crudora decorators.
+   *
+   * Validation works if the model defines `@Field()` decorators matching the table columns.
+   * Without decorators, POST/PUT bodies pass through without Zod validation.
+   */
+  registerTable(modelClass, table) {
+    const repository = new Repository(modelClass, this.db, table, this.repositories);
+    this.models.set(modelClass.name, modelClass);
+    this.tables.set(modelClass.name, table);
+    this.repositories.set(modelClass.name, repository);
+    return this;
+  }
+  getRepository(modelClass) {
+    const repository = this.repositories.get(modelClass.name);
+    if (!repository) {
+      throw new Error(`Repository for ${modelClass.name} not found. Did you register the model?`);
+    }
+    return repository;
+  }
+  /**
+   * Returns the Drizzle table object for a registered model.
+   * Useful for raw queries that need access to columns excluded by `hidden`
+   * (e.g. fetching a password hash for authentication).
+   *
+   * @example
+   * const usersTable = crudora.getTable(User);
+   * const [row] = await db.select().from(usersTable).where(eq(usersTable.email, email)).limit(1);
+   */
+  getTable(modelClass) {
+    const table = this.tables.get(modelClass.name);
+    if (!table) {
+      throw new Error(`Table for ${modelClass.name} not found. Did you register the model?`);
+    }
+    return table;
+  }
+  generateDrizzleSchema() {
+    const modelClasses = Array.from(this.models.values());
+    return SchemaGenerator.generateDrizzleSchema(modelClasses, this.dialect);
+  }
+  getValidationSchema(modelClass) {
+    return ValidationGenerator.generateZodSchema(modelClass);
+  }
+  getStrictValidationSchema(modelClass) {
+    return ValidationGenerator.generateStrictZodSchema(modelClass);
+  }
+  get(path, ...handlers) {
+    this.customRoutes.push({ method: "GET", path, handlers });
+    return this;
+  }
+  post(path, ...handlers) {
+    this.customRoutes.push({ method: "POST", path, handlers });
+    return this;
+  }
+  put(path, ...handlers) {
+    this.customRoutes.push({ method: "PUT", path, handlers });
+    return this;
+  }
+  delete(path, ...handlers) {
+    this.customRoutes.push({ method: "DELETE", path, handlers });
+    return this;
+  }
+  patch(path, ...handlers) {
+    this.customRoutes.push({ method: "PATCH", path, handlers });
+    return this;
+  }
+  /** Runs `fn` inside a database transaction and returns its result. */
+  async transaction(fn) {
+    return this.db.transaction(fn);
+  }
+  generateRoutes(app, basePath = "/api") {
+    app.get(basePath, (_req, res) => {
+      const routes = [];
+      for (const [, modelClass] of this.models) {
+        const routePath = `${basePath}/${modelClass.getTableName()}`;
+        routes.push(
+          { method: "GET", path: routePath, description: `List all ${modelClass.getTableName()}`, type: "CRUD" },
+          { method: "GET", path: `${routePath}/:id`, description: `Get ${modelClass.getTableName()} by ID`, type: "CRUD" },
+          { method: "POST", path: routePath, description: `Create new ${modelClass.getTableName()}`, type: "CRUD" },
+          { method: "PUT", path: `${routePath}/:id`, description: `Replace ${modelClass.getTableName()} by ID`, type: "CRUD" },
+          { method: "PATCH", path: `${routePath}/:id`, description: `Partial update ${modelClass.getTableName()} by ID`, type: "CRUD" },
+          { method: "DELETE", path: `${routePath}/:id`, description: `Delete ${modelClass.getTableName()} by ID`, type: "CRUD" }
+        );
+      }
+      for (const route of this.customRoutes) {
+        routes.push({
+          method: route.method,
+          path: `${basePath}${route.path}`,
+          description: `Custom ${route.method} route`,
+          type: "Custom"
+        });
+      }
+      res.json(ok({ routes }));
+    });
+    for (const [, modelClass] of this.models) {
+      const repository = this.getRepository(modelClass);
+      const validationSchema = this.getValidationSchema(modelClass);
+      const strictValidationSchema = this.getStrictValidationSchema(modelClass);
+      const routePath = `${basePath}/${modelClass.getTableName()}`;
+      app.get(routePath, async (req, res) => {
+        try {
+          const {
+            page,
+            limit = "10",
+            orderBy,
+            order,
+            cursor,
+            // presence triggers cursor mode
+            cursorField,
+            select,
+            // comma-separated field names
+            with: withStr,
+            // comma-separated relation names
+            withDeleted,
+            ...filters
+          } = req.query;
+          const selectFields = select ? select.split(",").map((f) => f.trim()).filter((f) => SAFE_KEY_RE2.test(f)) : void 0;
+          const withRelations = withStr ? withStr.split(",").map((r) => r.trim()).filter((r) => SAFE_KEY_RE2.test(r)).slice(0, MAX_RELATIONS2) : void 0;
+          const safeFilters = {};
+          for (const [k, v] of Object.entries(filters)) {
+            if (SAFE_KEY_RE2.test(k)) safeFilters[k] = v;
+          }
+          const whereFilters = Object.keys(safeFilters).length ? safeFilters : void 0;
+          const rawLimit = Number(limit);
+          const limitNum = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, MAX_LIMIT) : 10;
+          const includeDeleted = withDeleted === "true";
+          const orderByFields = orderBy ? orderBy.split(",").map((f) => f.trim()).filter(Boolean) : void 0;
+          const orderValues = order ? order.split(",").map((o) => o.trim()).filter(Boolean) : void 0;
+          const orderByArg = orderByFields && orderByFields.length === 1 ? orderByFields[0] : orderByFields;
+          const orderArg = orderValues && orderValues.length === 1 ? orderValues[0] : orderValues;
+          if (cursor !== void 0) {
+            const result = await repository.findWithCursor({
+              take: limitNum,
+              cursor: cursor || null,
+              cursorField,
+              order: orderValues?.[0] ?? (order === "desc" ? "desc" : "asc"),
+              where: whereFilters,
+              select: selectFields,
+              with: withRelations,
+              withDeleted: includeDeleted
+            });
+            return res.json(ok(result.data, {
+              cursor: { next: result.nextCursor, hasMore: result.hasMore }
+            }));
+          }
+          const rawPage = Number(page ?? 1);
+          const pageNum = Number.isFinite(rawPage) && rawPage > 0 ? Math.floor(rawPage) : 1;
+          const skip = (pageNum - 1) * limitNum;
+          const items = await repository.findAll({
+            skip,
+            take: limitNum,
+            where: whereFilters,
+            orderBy: orderByArg,
+            order: orderArg,
+            select: selectFields,
+            with: withRelations,
+            withDeleted: includeDeleted
+          });
+          const total = await repository.count(whereFilters, includeDeleted);
+          return res.json(ok(items, {
+            pagination: { page: pageNum, limit: limitNum, total, pages: total === 0 ? 0 : Math.ceil(total / limitNum) }
+          }));
+        } catch (err) {
+          this.logger?.error("GET request failed", {
+            path: routePath,
+            correlationId: req.correlationId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+      app.get(`${routePath}/:id`, async (req, res) => {
+        try {
+          const { select, with: withStr, withDeleted } = req.query;
+          const selectFields = select ? select.split(",").map((f) => f.trim()).filter((f) => SAFE_KEY_RE2.test(f)) : void 0;
+          const withRelations = withStr ? withStr.split(",").map((r) => r.trim()).filter((r) => SAFE_KEY_RE2.test(r)).slice(0, MAX_RELATIONS2) : void 0;
+          const item = await repository.findById(req.params.id, {
+            select: selectFields,
+            with: withRelations,
+            withDeleted: withDeleted === "true"
+          });
+          if (!item) return res.status(404).json(fail("NOT_FOUND", "Resource not found"));
+          return res.json(ok(item));
+        } catch (err) {
+          this.logger?.error("GET by ID request failed", {
+            path: `${routePath}/:id`,
+            id: req.params.id,
+            correlationId: req.correlationId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+      app.post(routePath, async (req, res) => {
+        try {
+          const validatedData = strictValidationSchema.parse(req.body);
+          const item = await repository.create(validatedData);
+          return res.status(201).json(ok(item));
+        } catch (error) {
+          if (error instanceof z2.ZodError) {
+            return res.status(422).json(fail("VALIDATION_ERROR", "Validation failed", zodDetails(error.issues)));
+          }
+          this.logger?.error("POST request failed", {
+            path: routePath,
+            correlationId: req.correlationId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+      app.put(`${routePath}/:id`, async (req, res) => {
+        try {
+          const validatedData = strictValidationSchema.parse(req.body);
+          const item = await repository.update(req.params.id, validatedData);
+          return res.json(ok(item));
+        } catch (error) {
+          if (error instanceof NotFoundError) return res.status(404).json(fail("NOT_FOUND", error.message));
+          if (error instanceof z2.ZodError) {
+            return res.status(422).json(fail("VALIDATION_ERROR", "Validation failed", zodDetails(error.issues)));
+          }
+          this.logger?.error("PUT request failed", {
+            path: `${routePath}/:id`,
+            id: req.params.id,
+            correlationId: req.correlationId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+      app.patch(`${routePath}/:id`, async (req, res) => {
+        try {
+          const validatedData = validationSchema.parse(req.body);
+          const item = await repository.update(req.params.id, validatedData);
+          return res.json(ok(item));
+        } catch (error) {
+          if (error instanceof NotFoundError) return res.status(404).json(fail("NOT_FOUND", error.message));
+          if (error instanceof z2.ZodError) {
+            return res.status(422).json(fail("VALIDATION_ERROR", "Validation failed", zodDetails(error.issues)));
+          }
+          this.logger?.error("PATCH request failed", {
+            path: `${routePath}/:id`,
+            id: req.params.id,
+            correlationId: req.correlationId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+      app.delete(`${routePath}/:id`, async (req, res) => {
+        try {
+          await repository.delete(req.params.id);
+          return res.status(204).send();
+        } catch (error) {
+          if (error instanceof NotFoundError) return res.status(404).json(fail("NOT_FOUND", error.message));
+          this.logger?.error("DELETE request failed", {
+            path: `${routePath}/:id`,
+            id: req.params.id,
+            correlationId: req.correlationId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+          res.status(500).json(fail("INTERNAL_ERROR", "Internal server error"));
+        }
+      });
+    }
+    for (const route of this.customRoutes) {
+      const fullPath = `${basePath}${route.path}`;
+      const { method, handlers } = route;
+      switch (method.toLowerCase()) {
+        case "get":
+          app.get(fullPath, ...handlers);
+          break;
+        case "post":
+          app.post(fullPath, ...handlers);
+          break;
+        case "put":
+          app.put(fullPath, ...handlers);
+          break;
+        case "delete":
+          app.delete(fullPath, ...handlers);
+          break;
+        case "patch":
+          app.patch(fullPath, ...handlers);
+          break;
+      }
+    }
+  }
+};
+
+// src/core/crudoraServer.ts
+import express from "express";
+import { randomUUID as randomUUID2 } from "crypto";
+function createRateLimiter(config) {
+  const store = /* @__PURE__ */ new Map();
+  const timer = setInterval(() => {
+    const cutoff = Date.now() - config.windowMs;
+    for (const [key, hits] of store.entries()) {
+      const active = hits.filter((t) => t > cutoff);
+      if (active.length === 0) store.delete(key);
+      else store.set(key, active);
+    }
+  }, config.windowMs);
+  if (timer.unref) timer.unref();
+  return (req, res, next) => {
+    const key = config.keyGenerator(req);
+    const now = Date.now();
+    const cutoff = now - config.windowMs;
+    const hits = (store.get(key) ?? []).filter((t) => t > cutoff);
+    const remaining = Math.max(0, config.max - hits.length - 1);
+    const resetAt = Math.ceil((now + config.windowMs) / 1e3);
+    res.setHeader("X-RateLimit-Limit", config.max);
+    res.setHeader("X-RateLimit-Remaining", remaining);
+    res.setHeader("X-RateLimit-Reset", resetAt);
+    if (hits.length >= config.max) {
+      res.setHeader("Retry-After", Math.ceil(config.windowMs / 1e3));
+      return res.status(429).json({
+        success: false,
+        error: { code: "RATE_LIMIT_EXCEEDED", message: config.message }
+      });
+    }
+    hits.push(now);
+    store.set(key, hits);
+    next();
+  };
+}
+function createDefaultLogger() {
+  const fmt = (level, msg, ctx) => JSON.stringify({ level, time: (/* @__PURE__ */ new Date()).toISOString(), msg, ...ctx });
+  return {
+    error: (msg, ctx) => console.error(fmt("error", msg, ctx)),
+    warn: (msg, ctx) => console.warn(fmt("warn", msg, ctx)),
+    info: (msg, ctx) => console.info(fmt("info", msg, ctx)),
+    debug: (msg, ctx) => console.debug(fmt("debug", msg, ctx))
+  };
+}
+var CrudoraServer = class {
+  constructor(config) {
+    const resolvedLogger = config.logger === void 0 ? createDefaultLogger() : config.logger;
+    const resolvedRateLimit = config.rateLimit === false ? false : {
+      windowMs: config.rateLimit?.windowMs ?? 6e4,
+      max: config.rateLimit?.max ?? 100,
+      message: config.rateLimit?.message ?? "Too many requests",
+      keyGenerator: config.rateLimit?.keyGenerator ?? ((req) => String(req.ip ?? "unknown"))
+    };
+    this.config = {
+      port: 3e3,
+      cors: true,
+      bodyParser: true,
+      bodyParserLimit: "100kb",
+      basePath: "/api",
+      ...config,
+      logger: resolvedLogger,
+      rateLimit: resolvedRateLimit
+    };
+    this.app = express();
+    this.crudora = new Crudora(
+      config.db,
+      config.dialect,
+      resolvedLogger === false ? void 0 : resolvedLogger
+    );
+    this.setupMiddleware();
+  }
+  setupMiddleware() {
+    this.app.use((_req, res, next) => {
+      res.setHeader("X-Content-Type-Options", "nosniff");
+      res.setHeader("X-Frame-Options", "DENY");
+      res.setHeader("X-XSS-Protection", "0");
+      next();
+    });
+    this.app.use((req, _res, next) => {
+      req.correlationId = randomUUID2();
+      next();
+    });
+    if (this.config.rateLimit !== false) {
+      this.app.use(createRateLimiter(this.config.rateLimit));
+    }
+    if (this.config.bodyParser) {
+      this.app.use(express.json({ limit: this.config.bodyParserLimit }));
+      this.app.use(express.urlencoded({ extended: true, limit: this.config.bodyParserLimit }));
+    }
+    if (this.config.cors !== false) {
+      this.app.use((req, res, next) => {
+        const cors = this.config.cors;
+        if (cors === true || cors === void 0) {
+          res.header("Access-Control-Allow-Origin", "*");
+        } else if (typeof cors === "string") {
+          res.header("Access-Control-Allow-Origin", cors);
+          res.header("Vary", "Origin");
+        } else if (Array.isArray(cors)) {
+          const requestOrigin = req.headers.origin;
+          if (requestOrigin && cors.includes(requestOrigin)) {
+            res.header("Access-Control-Allow-Origin", requestOrigin);
+            res.header("Vary", "Origin");
+          }
+        }
+        res.header("Access-Control-Allow-Methods", "GET,PUT,PATCH,POST,DELETE,OPTIONS");
+        res.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
+        if (req.method === "OPTIONS") {
+          res.sendStatus(204);
+        } else {
+          next();
+        }
+      });
+    }
+  }
+  registerModel(...modelClasses) {
+    this.crudora.registerModel(...modelClasses);
+    return this;
+  }
+  registerTable(modelClass, table) {
+    this.crudora.registerTable(modelClass, table);
+    return this;
+  }
+  generateRoutes() {
+    this.crudora.generateRoutes(this.app, this.config.basePath);
+    return this;
+  }
+  use(middleware) {
+    this.app.use(middleware);
+    return this;
+  }
+  listen(callback) {
+    this.app.listen(this.config.port, () => {
+      console.log(`\u{1F680} Crudora server running on port ${this.config.port}`);
+      console.log(`\u{1F4DA} API available at http://localhost:${this.config.port}${this.config.basePath}`);
+      if (callback) callback();
+    });
+  }
+  getApp() {
+    return this.app;
+  }
+  getCrudora() {
+    return this.crudora;
+  }
+  /**
+   * Returns the Drizzle table object for a registered model — delegates to `Crudora.getTable()`.
+   * Use this when you need raw DB access to columns excluded by `static hidden`
+   * (e.g. a login route that must read the password hash).
+   *
+   * @example
+   * const usersTable = server.getTable(User);
+   * const [row] = await db.select().from(usersTable).where(eq(usersTable.email, email)).limit(1);
+   */
+  getTable(modelClass) {
+    return this.crudora.getTable(modelClass);
+  }
+  get(path, ...handlers) {
+    this.crudora.get(path, ...handlers);
+    return this;
+  }
+  post(path, ...handlers) {
+    this.crudora.post(path, ...handlers);
+    return this;
+  }
+  put(path, ...handlers) {
+    this.crudora.put(path, ...handlers);
+    return this;
+  }
+  delete(path, ...handlers) {
+    this.crudora.delete(path, ...handlers);
+    return this;
+  }
+  patch(path, ...handlers) {
+    this.crudora.patch(path, ...handlers);
+    return this;
+  }
+};
+
+// src/core/model.ts
+var Model = class {
+  static getTableName() {
+    return this.tableName || this.name.toLowerCase() + "s";
+  }
+  static getPrimaryKey() {
+    return this.primaryKey || "id";
+  }
+  // Lifecycle Hooks
+  static async beforeCreate(_data) {
+    return _data;
+  }
+  static async afterCreate(_data, result) {
+    return result;
+  }
+  static async afterCreateMany(_records) {
+    return _records;
+  }
+  static async beforeUpdate(_id, _data) {
+    return _data;
+  }
+  static async afterUpdate(_id, _data, result) {
+    return result;
+  }
+  static async beforeDelete(_id) {
+  }
+  static async afterDelete(_id, result) {
+    return result;
+  }
+  static async beforeFind(options) {
+    return options;
+  }
+  static async afterFind(results) {
+    return results;
+  }
+  async beforeSave() {
+  }
+  async afterSave() {
+  }
+};
+Model.primaryKey = "id";
+Model.timestamps = true;
+Model.softDelete = false;
+export {
+  BelongsTo,
+  BelongsToMany,
+  Crudora,
+  CrudoraServer,
+  DrizzleTableBuilder,
+  Field,
+  HasMany,
+  HasOne,
+  Model,
+  NotFoundError,
+  Repository,
+  SchemaGenerator,
+  ValidationGenerator,
+  getFieldMetadata,
+  getRelationMetadata
+};
 //# sourceMappingURL=index.js.map