@getstrata/bootstrap 0.2.26 → 0.2.29

package/dist/index.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/bootstrap/public-api.ts
-import { appSchedule as appSchedule2, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
+import { appSchedule as appSchedule3, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
 
 // ../../src/core/scheduler/schedule.ts
 class Schedule {
@@ -35,6 +35,11 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   return due.length;
 }
 
+// ../../src/bootstrap/schedule.ts
+import { exportPendingAuditLogs } from "@getstrata/core/audit/exportAuditLogs";
+import { appLogger } from "@getstrata/core/logging/logger";
+import { appSchedule as appSchedule2 } from "@getstrata/core/scheduler/schedule";
+
 // ../../src/config/features.ts
 function readFeatureFlags() {
   return {
@@ -56,431 +61,11 @@ function isFeatureEnabled(feature) {
   return readFeatureFlags()[feature];
 }
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
-}
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveRepositoryConnection()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-
-class BadRequestError extends HttpError {
-  constructor(message = "Bad Request", details) {
-    super(400, message, details);
-  }
-}
-class ConflictError extends HttpError {
-  constructor(message = "Conflict", details) {
-    super(409, message, details);
-  }
-}
-
-class UnprocessableEntityError extends HttpError {
-  constructor(message = "Unprocessable Entity", details) {
-    super(422, message, details);
-  }
-}
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-class PreconditionFailedError extends HttpError {
-  constructor(message = "Precondition Failed", details) {
-    super(412, message, details);
-  }
-}
-
-// ../../src/core/security/safeUrl.ts
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/tenant/databaseTenantContext.ts
-async function runWithMigrationBypass(callback) {
-  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
-  }
-}
-
-// ../../src/core/audit/siemFormatter.ts
-function formatSiemAuditEvent(input) {
-  return {
-    timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
-    actor_user_id: input.user_id,
-    tenant_id: input.tenant_id ?? null,
-    trace_id: input.trace_id ?? null,
-    action: input.action,
-    subject_type: input.subject_type,
-    subject_id: input.subject_id,
-    ip_address: input.ip_address ?? null,
-    user_agent: input.user_agent ?? null,
-    checksum: input.checksum ?? null,
-    payload: input.payload ?? {}
-  };
-}
-function formatCefLine(event) {
-  const extension = [
-    `rt=${event.timestamp}`,
-    `suid=${event.actor_user_id ?? "unknown"}`,
-    `cs1=${event.action}`,
-    `cs1Label=Action`,
-    `cs2=${event.subject_type}`,
-    `cs2Label=SubjectType`,
-    `cs3=${event.subject_id ?? ""}`,
-    `cs3Label=SubjectId`,
-    `src=${event.ip_address ?? ""}`,
-    `request=${event.trace_id ?? ""}`
-  ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
-}
-
-// ../../src/core/audit/exportAuditLogs.ts
-function resolveAuditExportConfig() {
-  const endpoint = process.env.SIEM_EXPORT_URL?.trim();
-  if (!endpoint) {
-    return null;
-  }
-  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
-  const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
-  return {
-    endpoint,
-    format: process.env.SIEM_EXPORT_FORMAT === "cef" ? "cef" : "json",
-    batchSize: Number.isFinite(batchSize) ? batchSize : 100
-  };
-}
-async function exportPendingAuditLogs() {
-  const config = resolveAuditExportConfig();
-  if (!config) {
-    return 0;
-  }
-  return await runWithMigrationBypass(async () => {
-    const rows = await repositoryConnection`
-      SELECT
-        id,
-        user_id,
-        action,
-        subject_type,
-        subject_id,
-        payload,
-        ip_address,
-        user_agent,
-        checksum,
-        tenant_id,
-        trace_id,
-        created_at
-      FROM audit_log
-      WHERE exported_at IS NULL
-      ORDER BY id
-      LIMIT ${config.batchSize}
-    `;
-    if (rows.length === 0) {
-      return 0;
-    }
-    const events = rows.map((row) => formatSiemAuditEvent({
-      action: row.action,
-      subject_type: row.subject_type,
-      subject_id: row.subject_id,
-      user_id: row.user_id,
-      tenant_id: row.tenant_id,
-      trace_id: row.trace_id,
-      ip_address: row.ip_address,
-      user_agent: row.user_agent,
-      checksum: row.checksum,
-      payload: row.payload,
-      created_at: row.created_at
-    }));
-    const body = config.format === "cef" ? events.map((event) => formatCefLine(event)).join(`
-`) : JSON.stringify({ events });
-    const response = await safeFetch(config.endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": config.format === "cef" ? "text/plain" : "application/json",
-        ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
-      },
-      body
-    }, { allowHttp: appConfig.env !== "production" });
-    if (!response.ok) {
-      throw new Error(`SIEM export failed with status ${response.status}.`);
-    }
-    const ids = rows.map((row) => row.id);
-    for (const id of ids) {
-      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
-    }
-    return rows.length;
-  });
-}
-
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
-}
-var appLogger = new Logger("app");
-
 // ../../src/bootstrap/schedule.ts
-appSchedule.command("* * * * *", "heartbeat", () => {
+appSchedule2.command("* * * * *", "heartbeat", () => {
   appLogger.debug("Scheduler heartbeat");
 });
-appSchedule.command("* * * * *", "audit-export", async () => {
+appSchedule2.command("* * * * *", "audit-export", async () => {
   if (!isFeatureEnabled("siemExport")) {
     return;
   }
@@ -967,6 +552,14 @@ import {
   resolveService
 } from "@getstrata/core/contracts/di";
 
+// ../../src/bootstrap/providers/auth.ts
+import {
+  AuthManager,
+  CompositeGuard,
+  DatabaseTokenGuard,
+  GuestGuard
+} from "@getstrata/core/auth/guard";
+
 // ../../src/config/auth.ts
 var authConfig = {
   allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
@@ -1032,6 +625,68 @@ var databaseConfig = {
   connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
 };
 
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
 // ../../src/db/connection/createConnection.ts
 var {SQL } = globalThis.Bun;
 function createDatabaseConnection(config) {
@@ -1094,7 +749,7 @@ var apiTokenTable = defineTable({
 // ../../src/modules/user/authService.ts
 import { verifyPassword } from "@getstrata/core/auth/password";
 import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError as UnauthorizedError2 } from "@getstrata/core/errors/http";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
 import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
 import { verifyTotp } from "@getstrata/core/security/totp";
@@ -1119,22 +774,22 @@ class AuthService {
     const user = await this.users.findByEmail(email);
     if (!user?.password_hash) {
       logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError2("Invalid credentials.");
+      throw new UnauthorizedError("Invalid credentials.");
     }
     const valid = await verifyPassword(password, user.password_hash);
     if (!valid) {
       logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError2("Invalid credentials.");
+      throw new UnauthorizedError("Invalid credentials.");
     }
     if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
       logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError2("Email address is not verified.");
+      throw new UnauthorizedError("Email address is not verified.");
     }
     if (isFeatureEnabled("mfa") && user.mfa_enabled) {
       const mfaSecret = revealMfaSecret(user.mfa_secret);
       if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
         logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError2("Invalid MFA code.");
+        throw new UnauthorizedError("Invalid MFA code.");
       }
     }
     logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
@@ -1147,7 +802,7 @@ class AuthService {
   async loginWithOAuth(providerName, code) {
     const provider = this.oauthProviders.get(providerName);
     if (!provider) {
-      throw new UnauthorizedError2("Unsupported OAuth provider.");
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
     const profile = await provider.exchangeCode(code);
     const user = await this.findOrCreateOAuthUser(providerName, profile);
@@ -1161,7 +816,7 @@ class AuthService {
   buildOAuthAuthorizationUrl(providerName, state) {
     const provider = this.oauthProviders.get(providerName);
     if (!provider) {
-      throw new UnauthorizedError2("Unsupported OAuth provider.");
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
     return provider.getAuthorizationUrl(state);
   }
@@ -1248,115 +903,23 @@ var userTable = defineTable4({
 
 // ../../src/modules/user/tokenService.ts
 import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError as ForbiddenError2, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
 import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
-// ../../src/core/auth/authContext.ts
-var authContext = createAsyncContextStore("@getstrata/authContext");
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
+// ../../src/core/auth/sessionCookie.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SESSION_COOKIE = "workhub_session";
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function resolveSessionSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
-
-// ../../src/core/auth/guard.ts
-function devHeaderAbilities(role) {
-  if (role === "admin") {
-    return [...ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-class GuestGuard {
-  resolve(request) {
-    const userId = request.headers.get("x-authenticated-user-id");
-    if (!userId) {
-      return null;
-    }
-    const role = request.headers.get("x-authenticated-user-role");
-    return {
-      id: userId,
-      abilities: devHeaderAbilities(role),
-      ...role ? { role } : {}
-    };
-  }
-}
-class DatabaseTokenGuard {
-  container;
-  constructor(container) {
-    this.container = container;
-  }
-  async resolve(request) {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return null;
-    }
-    const token = authorization.slice("Bearer ".length).trim();
-    if (!token) {
-      return null;
-    }
-    if (!this.container.has(tokenServiceToken)) {
-      return null;
-    }
-    const tokenService = this.container.resolve(tokenServiceToken);
-    return await tokenService.resolveUserFromToken(token);
-  }
-}
-
-class CompositeGuard {
-  guards;
-  constructor(guards) {
-    this.guards = guards;
-  }
-  async resolve(request) {
-    for (const guard of this.guards) {
-      const user = await Promise.resolve(guard.resolve(request));
-      if (user) {
-        return user;
-      }
-    }
-    return null;
-  }
-}
-
-class AuthManager {
-  guard;
-  constructor(guard) {
-    this.guard = guard;
-  }
-  async resolve(request) {
-    if (request) {
-      return await Promise.resolve(this.guard.resolve(request));
-    }
-    return currentAuthUser();
-  }
-  user(request) {
-    return this.resolve(request);
-  }
-  async check(request) {
-    return await this.user(request) !== null;
-  }
-  async requireUser(request) {
-    const user = await this.user(request);
-    if (!user) {
-      throw new UnauthorizedError;
-    }
-    return user;
-  }
-}
-
-// ../../src/core/auth/sessionCookie.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SESSION_COOKIE = "workhub_session";
-var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
-function resolveSessionSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
-}
-function signSession(userId, issuedAt) {
-  const payload = `${userId}.${issuedAt}`;
-  const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
+function signSession(userId, issuedAt) {
+  const payload = `${userId}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
 }
 function readCookieValue(request, cookieName) {
   const cookieHeader = request.headers.get("cookie");
@@ -1446,378 +1009,8 @@ var authProvider = {
 };
 var auth_default = authProvider;
 
-// ../../src/core/cache/redisCacheStore.ts
-var {RedisClient } = globalThis.Bun;
-var KEY_PREFIX = "workhub:cache:";
-var TAG_PREFIX = "workhub:cache:tag:";
-
-class RedisCacheStore {
-  ttlMs;
-  maxEntries;
-  client;
-  inflight = new Map;
-  keyTags = new Map;
-  constructor(redisUrl, ttlMs, maxEntries) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    this.client = new RedisClient(redisUrl);
-  }
-  async get(key) {
-    const raw = await this.client.get(this.storageKey(key));
-    if (raw === null) {
-      return;
-    }
-    return JSON.parse(raw);
-  }
-  async set(key, value, ttlMs) {
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    const payload = JSON.stringify(value);
-    if (resolvedTtlMs > 0) {
-      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
-    } else {
-      await this.client.set(this.storageKey(key), payload);
-    }
-    await this.enforceMaxEntries();
-  }
-  async getOrSet(key, loader, ttlMs) {
-    const cached = await this.get(key);
-    if (cached !== undefined) {
-      return cached;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then(async (value) => {
-      await this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
-  }
-  async attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      await this.client.sadd(this.tagKey(tag), key);
-    }
-  }
-  async flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const members = await this.client.smembers(this.tagKey(tag));
-      for (const member of members) {
-        keysToRemove.add(member);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (await this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      await this.client.del(this.tagKey(tag));
-    }
-    return removed;
-  }
-  async invalidate(key) {
-    const deleted = await this.client.del(this.storageKey(key));
-    await this.detachKeyFromTags(key);
-    return deleted > 0;
-  }
-  async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    let removed = 0;
-    for (const storageKey of keys) {
-      const key = storageKey.slice(KEY_PREFIX.length);
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (await this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
-  }
-  async clear() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length > 0) {
-      await this.client.del(...keys);
-    }
-    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
-    if (tagKeys.length > 0) {
-      await this.client.del(...tagKeys);
-    }
-    this.inflight.clear();
-    this.keyTags.clear();
-  }
-  async size() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    return keys.length;
-  }
-  storageKey(key) {
-    return `${KEY_PREFIX}${key}`;
-  }
-  tagKey(tag) {
-    return `${TAG_PREFIX}${tag}`;
-  }
-  async detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      await this.client.srem(this.tagKey(tag), key);
-    }
-    this.keyTags.delete(key);
-  }
-  async enforceMaxEntries() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length <= this.maxEntries) {
-      return;
-    }
-    const overflow = keys.length - this.maxEntries;
-    const keysToRemove = keys.slice(0, overflow);
-    if (keysToRemove.length > 0) {
-      await this.client.del(...keysToRemove);
-    }
-  }
-}
-var redisCacheStore_default = RedisCacheStore;
-
-// ../../src/core/cache/simpleCache.ts
-class SimpleCache {
-  ttlMs;
-  maxEntries;
-  cache = new Map;
-  inflight = new Map;
-  tagIndex = new Map;
-  keyTags = new Map;
-  constructor(ttlMs = 3600000, maxEntries = 100) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
-      throw new RangeError("ttlMs must be a non-negative number.");
-    }
-    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
-      throw new RangeError("maxEntries must be a positive integer.");
-    }
-  }
-  get(key) {
-    return this.getFreshEntry(key)?.value;
-  }
-  set(key, value, ttlMs) {
-    const now = Date.now();
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    this.cache.set(key, {
-      value,
-      expiresAt: now + resolvedTtlMs,
-      lastAccessedAt: now
-    });
-    this.evictOverflow();
-  }
-  async getOrSet(key, loader, ttlMs) {
-    this.pruneExpired();
-    const cachedEntry = this.getFreshEntry(key);
-    if (cachedEntry) {
-      return cachedEntry.value;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then((value) => {
-      this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
-  }
-  attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      let keysForTag = this.tagIndex.get(tag);
-      if (!keysForTag) {
-        keysForTag = new Set;
-        this.tagIndex.set(tag, keysForTag);
-      }
-      keysForTag.add(key);
-    }
-  }
-  flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      for (const key of keys) {
-        keysToRemove.add(key);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      this.tagIndex.delete(tag);
-    }
-    return removed;
-  }
-  invalidate(key) {
-    const removed = this.cache.delete(key);
-    if (removed) {
-      this.detachKeyFromTags(key);
-    }
-    return removed;
-  }
-  invalidateByPrefix(prefix) {
-    let removed = 0;
-    for (const key of [...this.cache.keys()]) {
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
-  }
-  clear() {
-    this.cache.clear();
-    this.inflight.clear();
-    this.tagIndex.clear();
-    this.keyTags.clear();
-  }
-  size() {
-    this.pruneExpired();
-    return this.cache.size;
-  }
-  detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      keys.delete(key);
-      if (keys.size === 0) {
-        this.tagIndex.delete(tag);
-      }
-    }
-    this.keyTags.delete(key);
-  }
-  getFreshEntry(key) {
-    const entry = this.cache.get(key);
-    if (!entry) {
-      return;
-    }
-    if (entry.expiresAt <= Date.now()) {
-      this.invalidate(key);
-      return;
-    }
-    entry.lastAccessedAt = Date.now();
-    return entry;
-  }
-  pruneExpired() {
-    const now = Date.now();
-    for (const [key, entry] of this.cache.entries()) {
-      if (entry.expiresAt <= now) {
-        this.invalidate(key);
-      }
-    }
-  }
-  evictOverflow() {
-    while (this.cache.size > this.maxEntries) {
-      let oldestKey;
-      let oldestAccessTime = Number.POSITIVE_INFINITY;
-      for (const [key, entry] of this.cache.entries()) {
-        if (entry.lastAccessedAt < oldestAccessTime) {
-          oldestAccessTime = entry.lastAccessedAt;
-          oldestKey = key;
-        }
-      }
-      if (!oldestKey) {
-        return;
-      }
-      this.invalidate(oldestKey);
-    }
-  }
-}
-var simpleCache_default = SimpleCache;
-
-// ../../src/core/cache/simpleCacheStore.ts
-class SimpleCacheStore {
-  cache;
-  constructor(cache) {
-    this.cache = cache;
-  }
-  get(key) {
-    return Promise.resolve(this.cache.get(key));
-  }
-  set(key, value, ttlMs) {
-    this.cache.set(key, value, ttlMs);
-    return Promise.resolve();
-  }
-  getOrSet(key, loader, ttlMs) {
-    return this.cache.getOrSet(key, loader, ttlMs);
-  }
-  attachTags(key, tags) {
-    this.cache.attachTags(key, tags);
-    return Promise.resolve();
-  }
-  flushTags(tags) {
-    return Promise.resolve(this.cache.flushTags(tags));
-  }
-  invalidate(key) {
-    return Promise.resolve(this.cache.invalidate(key));
-  }
-  invalidateByPrefix(prefix) {
-    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
-  }
-  clear() {
-    this.cache.clear();
-    return Promise.resolve();
-  }
-  size() {
-    return Promise.resolve(this.cache.size());
-  }
-}
-var simpleCacheStore_default = SimpleCacheStore;
-
-// ../../src/core/cache/createCacheStore.ts
-function createCacheStore(options) {
-  if (options.driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
-    }
-    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
-  }
-  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
-}
+// ../../src/bootstrap/providers/cache.ts
+import { createCacheStore } from "@getstrata/core/cache/createCacheStore";
 
 // ../../src/core/cache/taggedCache.ts
 class TaggedCache {
@@ -1895,6 +1088,18 @@ var cacheProvider = {
 };
 var cache_default = cacheProvider;
 
+// ../../src/bootstrap/providers/config.ts
+import { validateEnv } from "@getstrata/core/config/envSchema";
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
 // ../../src/config/queue.ts
 var queueConfig = {
   driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
@@ -1902,34 +1107,6 @@ var queueConfig = {
   backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
 };
 
-// ../../src/core/config/envSchema.ts
-function validateEnv(schema, env = process.env) {
-  const resolved = {};
-  for (const [name, rule] of Object.entries(schema)) {
-    const rawValue = env[name];
-    const value = rawValue === undefined || rawValue.trim() === "" ? rule.default : rawValue;
-    if (value === undefined || value.trim() === "") {
-      if (rule.required) {
-        throw new Error(`Missing required environment variable "${name}".`);
-      }
-      continue;
-    }
-    if (rule.integer) {
-      const parsed = Number.parseInt(value, 10);
-      const minimum = rule.minimum ?? Number.NEGATIVE_INFINITY;
-      if (!Number.isInteger(parsed) || parsed < minimum) {
-        const comparison = minimum === Number.NEGATIVE_INFINITY ? "an integer" : `an integer >= ${minimum}`;
-        throw new Error(`Environment variable "${name}" must be ${comparison}.`);
-      }
-    }
-    if (rule.pattern && !rule.pattern.test(value)) {
-      throw new Error(`Environment variable "${name}" has an invalid format.`);
-    }
-    resolved[name] = value;
-  }
-  return resolved;
-}
-
 // ../../src/bootstrap/env.ts
 import { defineEnvSchema } from "@getstrata/core/config/envSchema";
 var appEnvSchema = defineEnvSchema({
@@ -2049,1985 +1226,49 @@ var configProvider = {
 };
 var config_default = configProvider;
 
-// ../../src/core/events/eventBus.ts
-class EventBus {
-  constructor() {}
-  listeners = new Map;
-  listen(event, listener) {
-    const handlers = this.listeners.get(event) ?? new Set;
-    handlers.add(listener);
-    this.listeners.set(event, handlers);
-    return () => {
-      handlers.delete(listener);
-      if (handlers.size === 0) {
-        this.listeners.delete(event);
-      }
-    };
-  }
-  async dispatch(event, payload) {
-    const handlers = this.listeners.get(event);
-    if (!handlers || handlers.size === 0) {
-      return;
-    }
-    for (const handler of handlers) {
-      await handler(payload);
-    }
-  }
-}
-var eventBus = new EventBus;
-
-// ../../src/core/events/index.ts
-function modelEventName(tableName, action) {
-  return `${tableName}.${action}`;
-}
-
-// ../../src/bootstrap/providers/events.ts
-var eventsProvider = {
-  name: "core.events",
-  register({ container }) {
-    container.set(CORE_EVENT_BUS_TOKEN, eventBus);
-  }
-};
-var events_default = eventsProvider;
-
-// ../../src/bootstrap/discoverListeners.ts
-import { readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
-async function loadDiscoveredListeners() {
-  const listenersDirectory = join2(import.meta.dir, "../listeners");
-  let entries;
-  try {
-    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return [];
-    }
-    throw error;
-  }
-  const listeners = await Promise.all(entries.map(async (fileName) => {
-    const moduleUrl = pathToFileURL2(join2(listenersDirectory, fileName)).href;
-    const loaded = await import(moduleUrl);
-    return loaded.default;
-  }));
-  return listeners.filter((listener) => typeof listener === "function");
-}
-var appListeners = await loadDiscoveredListeners();
-function discoverListeners() {
-  return appListeners;
-}
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
-// ../../src/core/pagination/index.ts
-function buildPaginationMeta(input) {
-  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
-  return {
-    page: input.page,
-    per_page: input.perPage,
-    total: input.total,
-    last_page: lastPage
-  };
-}
-
-// ../../src/core/database/errors.ts
-function isPostgresError(error) {
-  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
-}
-function getPostgresSqlState(error) {
-  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
-    return error.errno;
-  }
-  if (typeof error.errno === "number") {
-    return String(error.errno).padStart(5, "0");
-  }
-  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
-    return error.code;
-  }
-  return;
-}
-function mapDatabaseError(error) {
-  if (error instanceof HttpError) {
-    return error;
-  }
-  if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
-  }
-  const sqlState = getPostgresSqlState(error);
-  switch (sqlState) {
-    case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
-    case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
-    case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
-    case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
-    default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
-  }
-}
-async function withDatabaseErrorHandling(operation) {
-  try {
-    return await operation();
-  } catch (error) {
-    throw mapDatabaseError(error);
-  }
-}
-
-// ../../src/core/database/query.ts
-function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
-}
-function qualifyColumn(tableName, column) {
-  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
-}
-function resolveQualifiedColumn(defaultTable, columnName) {
-  if (columnName.includes(".")) {
-    const [table, column] = columnName.split(".", 2);
-    if (!table || !column) {
-      throw new Error(`Invalid qualified column: ${columnName}`);
-    }
-    return qualifyColumn(table, column);
-  }
-  return qualifyColumn(defaultTable, columnName);
-}
-function parseQualifiedColumn(reference) {
-  const [table, column] = reference.split(".", 2);
-  if (!table || !column) {
-    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
-  }
-  return { table, column };
-}
-function normalizeDirection(direction = "ASC") {
-  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
-}
-function isQueryOperator(value) {
-  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
-}
-function pushParam(values, value) {
-  values.push(value);
-  return `$${values.length}`;
-}
-function buildInClause(column, values, params) {
-  if (values.length === 0) {
-    return "1 = 0";
-  }
-  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
-}
-function buildOperatorClauses(column, operator, params) {
-  const clauses = [];
-  if (operator.isNull === true) {
-    clauses.push(`${column} IS NULL`);
-  }
-  if (operator.isNull === false) {
-    clauses.push(`${column} IS NOT NULL`);
-  }
-  if (operator.eq !== undefined) {
-    if (operator.eq === null) {
-      clauses.push(`${column} IS NULL`);
-    } else {
-      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
-    }
-  }
-  if (operator.in !== undefined) {
-    clauses.push(buildInClause(column, operator.in, params));
-  }
-  if (operator.gt !== undefined) {
-    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
-  }
-  if (operator.gte !== undefined) {
-    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
-  }
-  if (operator.lt !== undefined) {
-    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
-  }
-  if (operator.lte !== undefined) {
-    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
-  }
-  if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
-  }
-  if (operator.tsMatch !== undefined) {
-    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
-  }
-  return clauses;
-}
-function appendWhereParts(tableName, where, params) {
-  const clauses = [];
-  for (const [columnName, filterValue] of Object.entries(where)) {
-    if (filterValue === undefined) {
-      continue;
-    }
-    const column = resolveQualifiedColumn(tableName, columnName);
-    if (Array.isArray(filterValue)) {
-      clauses.push(buildInClause(column, filterValue, params));
-      continue;
-    }
-    if (isQueryOperator(filterValue)) {
-      clauses.push(...buildOperatorClauses(column, filterValue, params));
-      continue;
-    }
-    if (filterValue === null) {
-      clauses.push(`${column} IS NULL`);
-      continue;
-    }
-    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
-  }
-  return clauses.join(" AND ");
-}
-function buildWhereNodeClause(tableName, node, params) {
-  if ("where" in node) {
-    return appendWhereParts(tableName, node.where, params);
-  }
-  const grouped = buildWhereGroupClause(tableName, node.group, params);
-  if (!grouped) {
-    return "";
-  }
-  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
-}
-function buildWhereGroupClause(tableName, nodes, params) {
-  let result = "";
-  for (const node of nodes) {
-    const part = buildWhereNodeClause(tableName, node, params);
-    if (!part) {
-      continue;
-    }
-    if (!result) {
-      result = part;
-      continue;
-    }
-    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
-  }
-  if (!result) {
-    return "";
-  }
-  return result;
-}
-function buildAdvancedWhereClause(tableName, where = {}, whereNodes = [], params = []) {
-  const nodes = [];
-  if (Object.keys(where).length > 0) {
-    nodes.push({ kind: "and", where });
-  }
-  nodes.push(...whereNodes);
-  const combined = buildWhereGroupClause(tableName, nodes, params);
-  return {
-    clause: combined ? ` WHERE ${combined}` : "",
-    params
-  };
-}
-function resolveSoftDeleteColumn(table) {
-  if (!table.softDeletes) {
-    return null;
-  }
-  if (table.softDeletes === true) {
-    return "deleted_at";
-  }
-  return table.softDeletes.column ?? "deleted_at";
-}
-function appendSoftDeleteScope(table, options, clauses) {
-  const column = resolveSoftDeleteColumn(table);
-  if (!column) {
-    return;
-  }
-  const qualifiedColumn = qualifyColumn(table.name, column);
-  if (options.onlyTrashed) {
-    clauses.push(`${qualifiedColumn} IS NOT NULL`);
-    return;
-  }
-  if (!options.withTrashed) {
-    clauses.push(`${qualifiedColumn} IS NULL`);
-  }
-}
-function buildQueryWhereClause(table, options = {}, whereNodes = [], params = []) {
-  const { clause, params: whereParams } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes, params);
-  const softDeleteClauses = [];
-  appendSoftDeleteScope(table, options, softDeleteClauses);
-  if (softDeleteClauses.length === 0) {
-    return { clause, params: whereParams };
-  }
-  const base = clause.replace(/^ WHERE /, "");
-  const scope = softDeleteClauses.join(" AND ");
-  return {
-    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
-    params: whereParams
-  };
-}
-function isQueryOrder(value) {
-  return "column" in value;
-}
-function normalizeOrderBy(orderBy) {
-  if (!orderBy) {
-    return [];
-  }
-  if (Array.isArray(orderBy)) {
-    return orderBy;
-  }
-  if (isQueryOrder(orderBy)) {
-    return [orderBy];
-  }
-  return Object.entries(orderBy).map(([column, direction]) => ({
-    column,
-    direction
-  }));
-}
-function buildOrderByClause(tableName, orderBy) {
-  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
-    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
-  });
-  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
-}
-function buildGroupByClause(tableName, groupBy) {
-  if (!groupBy) {
-    return "";
-  }
-  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
-  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
-  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
-}
-function buildHavingClause(tableName, having, params) {
-  if (!having) {
-    return "";
-  }
-  const body = appendWhereParts(tableName, having, params);
-  return body.length > 0 ? ` HAVING ${body}` : "";
-}
-function buildJoinClause(joins = []) {
-  return joins.map((join3) => {
-    const joinType = join3.type === "left" ? "LEFT JOIN" : "INNER JOIN";
-    const onClause = join3.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
-    return ` ${joinType} ${quoteIdentifier(join3.table)} ON ${onClause}`;
-  }).join("");
-}
-function buildLimitClause(limit) {
-  if (limit === undefined) {
-    return "";
-  }
-  if (!Number.isInteger(limit) || limit <= 0) {
-    throw new Error("Query limit must be a positive integer.");
-  }
-  return ` LIMIT ${limit}`;
-}
-function buildOffsetClause(offset) {
-  if (offset === undefined) {
-    return "";
-  }
-  if (!Number.isInteger(offset) || offset < 0) {
-    throw new Error("Query offset must be a non-negative integer.");
-  }
-  return ` OFFSET ${offset}`;
-}
-function buildReturningColumns(table) {
-  return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
-}
-function buildSelectList(table, select, params = []) {
-  if (!select || select.length === 0) {
-    return buildReturningColumns(table);
-  }
-  return select.map((item) => {
-    if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
-    }
-    if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
-    }
-    const column = qualifyColumn(item.table, item.column);
-    const placeholder = pushParam(params, item.query);
-    return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
-  }).join(", ");
-}
-function getDefinedColumnEntries(table, values, options = {}) {
-  const record = values;
-  const excluded = new Set(options.exclude ?? []);
-  return table.columns.flatMap((column) => {
-    if (excluded.has(column) || !Object.hasOwn(record, column)) {
-      return [];
-    }
-    const value = record[column];
-    if (value === undefined) {
-      return [];
-    }
-    return [[column, value]];
-  });
-}
-function buildSelectQuery(table, options = {}, whereNodes = []) {
-  const params = [];
-  const columns = buildSelectList(table, options.select, params);
-  const { clause } = buildQueryWhereClause(table, options, whereNodes, params);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  const havingClause = buildHavingClause(table.name, options.having, params);
-  const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
-  const limit = buildLimitClause(options.limit);
-  const offset = buildOffsetClause(options.offset);
-  return {
-    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${havingClause}${orderBy}${limit}${offset}`,
-    params
-  };
-}
-function buildCountQuery(table, where = {}, options = {}, whereNodes = []) {
-  const params = [];
-  const { clause, params: whereParams } = buildQueryWhereClause(table, {
-    where,
-    withTrashed: options.withTrashed,
-    onlyTrashed: options.onlyTrashed
-  }, whereNodes);
-  params.push(...whereParams);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  return {
-    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}`,
-    params
-  };
-}
-function buildProjectionQuery(table, expression, alias, options = {}, whereNodes = []) {
-  assertSafeProjectionExpression(expression);
-  const params = [];
-  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
-  params.push(...whereParams);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  const orderBy = buildOrderByClause(table.name, options.orderBy);
-  const limit = buildLimitClause(options.limit);
-  return {
-    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${orderBy}${limit}`,
-    params
-  };
-}
-var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
-function assertSafeProjectionExpression(expression) {
-  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
-    throw new Error(`Unsafe projection expression: ${expression}`);
-  }
-}
-function buildGroupedCountQuery(table, column, where = {}, options = {}) {
-  const qualifiedColumn = qualifyColumn(table.name, column);
-  const { clause, params } = buildQueryWhereClause(table, {
-    where,
-    ...options
-  });
-  return {
-    text: `SELECT ${qualifiedColumn} AS ${quoteIdentifier("value")}, COUNT(*) AS ${quoteIdentifier("count")} FROM ${quoteIdentifier(table.name)}${clause} GROUP BY ${qualifiedColumn} ORDER BY ${qualifiedColumn} ASC`,
-    params
-  };
-}
-function buildInsertQuery(table, values) {
-  const entries = getDefinedColumnEntries(table, values);
-  if (entries.length === 0) {
-    throw new Error(`Cannot insert into ${table.name} without any column values.`);
-  }
-  const params = [];
-  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
-  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
-  const returningColumns = buildReturningColumns(table);
-  return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
-    params
-  };
-}
-function buildUpdateQuery(table, id, changes) {
-  const entries = getDefinedColumnEntries(table, changes, {
-    exclude: [table.primaryKey]
-  });
-  if (entries.length === 0) {
-    throw new Error(`Cannot update ${table.name} without any changed column values.`);
-  }
-  const params = [];
-  const setClause = entries.map(([column, value]) => `${quoteIdentifier(column)} = ${pushParam(params, value)}`).join(", ");
-  const primaryKeyPlaceholder = pushParam(params, id);
-  const returningColumns = buildReturningColumns(table);
-  const scopeClauses = [];
-  appendSoftDeleteScope(table, {}, scopeClauses);
-  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
-    params
-  };
-}
-function buildSoftDeleteByIdQuery(table, id, deletedAt) {
-  const deletedAtColumn = resolveSoftDeleteColumn(table);
-  if (!deletedAtColumn) {
-    throw new Error(`Table ${table.name} does not support soft deletes.`);
-  }
-  const returningColumns = buildReturningColumns(table);
-  const scopeClauses = [];
-  appendSoftDeleteScope(table, {}, scopeClauses);
-  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
-  };
-}
-function buildRestoreByIdQuery(table, id) {
-  const deletedAtColumn = resolveSoftDeleteColumn(table);
-  if (!deletedAtColumn) {
-    throw new Error(`Table ${table.name} does not support soft deletes.`);
-  }
-  const returningColumns = buildReturningColumns(table);
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
-  };
-}
-function buildDeleteByIdQuery(table, id) {
-  return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
-  };
-}
-
-// ../../src/core/database/relationships.ts
-function indexHasManyRelation(parents, children, relation) {
-  const groups = new Map;
-  for (const parent of parents) {
-    groups.set(parent[relation.localKey], []);
-  }
-  for (const child of children) {
-    const key = child[relation.foreignKey];
-    const group = groups.get(key);
-    if (!group) {
-      continue;
-    }
-    group.push(child);
-  }
-  return groups;
-}
-function indexBelongsToRelation(children, parents, relation) {
-  const parentsById = new Map;
-  for (const parent of parents) {
-    parentsById.set(parent[relation.ownerKey], parent);
-  }
-  const result = new Map;
-  for (const child of children) {
-    const foreignKey = child[relation.foreignKey];
-    const parent = parentsById.get(foreignKey);
-    if (parent) {
-      result.set(foreignKey, parent);
-    }
-  }
-  return result;
-}
-function indexMorphManyRelation(parents, children, relation) {
-  const groups = new Map;
-  for (const parent of parents) {
-    groups.set(parent[relation.localKey], []);
-  }
-  for (const child of children) {
-    if (child[relation.morphTypeKey] !== relation.morphType) {
-      continue;
-    }
-    const key = child[relation.morphIdKey];
-    const group = groups.get(key);
-    if (!group) {
-      continue;
-    }
-    group.push(child);
-  }
-  return groups;
-}
-function indexMorphToRelation(children, parentsByType, relation) {
-  const result = new Map;
-  for (const child of children) {
-    const morphType = String(child[relation.morphTypeKey]);
-    const parents = parentsByType.get(morphType);
-    if (!parents) {
-      continue;
-    }
-    const parent = parents.get(child[relation.morphIdKey]);
-    if (parent) {
-      result.set(child[relation.morphIdKey], parent);
-    }
-  }
-  return result;
-}
-
-// ../../src/core/database/whereBuilder.ts
-class WhereBuilder {
-  nodes = [];
-  where(where) {
-    this.nodes.push({ kind: "and", where });
-    return this;
-  }
-  orWhere(where) {
-    this.nodes.push({ kind: "or", where });
-    return this;
-  }
-  whereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
-      this.nodes.push({ kind: "and", group: nested.nodes });
-    }
-    return this;
-  }
-  orWhereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
-      this.nodes.push({ kind: "or", group: nested.nodes });
-    }
-    return this;
-  }
-}
-
-// ../../src/core/database/repositoryQuery.ts
-class RepositoryQuery {
-  repository;
-  whereClause;
-  queryOptions;
-  eagerLoads = [];
-  whereNodes = [];
-  constructor(repository, whereClause = {}, queryOptions = {}) {
-    this.repository = repository;
-    this.whereClause = whereClause;
-    this.queryOptions = queryOptions;
-  }
-  where(input) {
-    if (typeof input === "function") {
-      const builder = new WhereBuilder;
-      input(builder);
-      this.whereNodes.push(...builder.nodes);
-      return this;
-    }
-    this.whereClause = { ...this.whereClause, ...input };
-    return this;
-  }
-  orWhere(input) {
-    if (typeof input === "function") {
-      const builder = new WhereBuilder;
-      input(builder);
-      if (builder.nodes.length > 0) {
-        this.whereNodes.push({ kind: "or", group: builder.nodes });
-      }
-      return this;
-    }
-    this.whereNodes.push({ kind: "or", where: input });
-    return this;
-  }
-  orderBy(orderBy) {
-    this.queryOptions = { ...this.queryOptions, orderBy };
-    return this;
-  }
-  limit(limit) {
-    this.queryOptions = { ...this.queryOptions, limit };
-    return this;
-  }
-  offset(offset) {
-    this.queryOptions = { ...this.queryOptions, offset };
-    return this;
-  }
-  join(left, right) {
-    return this.addJoin("inner", left, right);
-  }
-  leftJoin(left, right) {
-    return this.addJoin("left", left, right);
-  }
-  groupBy(groupBy) {
-    this.queryOptions = { ...this.queryOptions, groupBy };
-    return this;
-  }
-  having(having) {
-    this.queryOptions = { ...this.queryOptions, having };
-    return this;
-  }
-  withHasMany(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "hasMany",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withBelongsTo(as, relation, parentRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "belongsTo",
-      as,
-      relation,
-      repository: parentRepository,
-      options
-    });
-    return this;
-  }
-  withMorphMany(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphMany",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withMorphOne(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphOne",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withMorphTo(as, relation, repositoriesByType, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphTo",
-      as,
-      relation,
-      repository: this.repository,
-      morphRepositories: repositoriesByType,
-      options
-    });
-    return this;
-  }
-  async get() {
-    const rows = await this.repository.findAll(this.buildOptions());
-    return await this.attach(rows);
-  }
-  async first() {
-    const rows = await this.get();
-    return rows[0] ?? null;
-  }
-  async paginate(options) {
-    return await this.repository.paginate({
-      ...this.buildOptions(),
-      page: options.page,
-      perPage: options.perPage
-    });
-  }
-  buildOptions() {
-    return {
-      ...this.queryOptions,
-      where: this.whereClause,
-      whereNodes: this.whereNodes
-    };
-  }
-  addJoin(type, left, right) {
-    const leftRef = parseQualifiedColumn(left);
-    const rightRef = parseQualifiedColumn(right);
-    const table = type === "inner" ? rightRef.table : rightRef.table;
-    const joins = this.queryOptions.joins ?? [];
-    const existing = joins.find((join3) => join3.table === table && join3.type === type);
-    if (existing) {
-      existing.on.push({ left: leftRef, right: rightRef });
-      return this;
-    }
-    this.queryOptions = {
-      ...this.queryOptions,
-      joins: [
-        ...joins,
-        {
-          type,
-          table,
-          on: [{ left: leftRef, right: rightRef }]
-        }
-      ]
-    };
-    return this;
-  }
-  async attach(rows) {
-    if (rows.length === 0 || this.eagerLoads.length === 0) {
-      return rows.map((row) => ({ ...row }));
-    }
-    let result = rows.map((row) => ({ ...row }));
-    for (const load of this.eagerLoads) {
-      if (load.kind === "hasMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
-        }));
-        continue;
-      }
-      if (load.kind === "morphMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
-        }));
-        continue;
-      }
-      if (load.kind === "morphOne") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey])
-        }));
-        continue;
-      }
-      if (load.kind === "morphTo") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.morphIdKey])
-        }));
-        continue;
-      }
-      const relation = load.relation;
-      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
-      result = result.map((row) => ({
-        ...row,
-        [load.as]: grouped.get(row[relation.foreignKey])
-      }));
-    }
-    return result;
-  }
-}
-
-// ../../src/core/database/baseRepository.ts
-class BaseRepository5 {
-  table;
-  connection;
-  constructor(table, connection = repositoryConnection) {
-    this.table = table;
-    this.connection = connection;
-  }
-  async findAll(options = {}) {
-    return await withDatabaseErrorHandling(async () => {
-      const { whereNodes, ...queryOptions } = options;
-      const { text, params } = buildSelectQuery(this.table, queryOptions, whereNodes ?? []);
-      return await this.connection.unsafe(text, params);
-    });
-  }
-  async paginate(options) {
-    const { whereNodes, where = {}, page, perPage, ...queryOptions } = options;
-    const total = await this.countWhere(where, {
-      withTrashed: options.withTrashed,
-      onlyTrashed: options.onlyTrashed,
-      joins: options.joins,
-      groupBy: options.groupBy
-    }, whereNodes);
-    const offset = (page - 1) * perPage;
-    const data = await this.findAll({
-      ...queryOptions,
-      where,
-      whereNodes,
-      limit: perPage,
-      offset
-    });
-    return {
-      data,
-      meta: buildPaginationMeta({ page, perPage, total })
-    };
-  }
-  async chunk(count, callback, options = {}) {
-    if (!Number.isInteger(count) || count <= 0) {
-      throw new Error("Chunk size must be a positive integer.");
-    }
-    let offset = 0;
-    while (true) {
-      const rows = await this.findAll({
-        ...options,
-        limit: count,
-        offset
-      });
-      if (rows.length === 0) {
-        return;
-      }
-      const shouldContinue = await callback(rows);
-      if (shouldContinue === false || rows.length < count) {
-        return;
-      }
-      offset += count;
-    }
-  }
-  async cursorPaginate(options) {
-    const {
-      perPage,
-      cursor,
-      cursorColumn = this.table.primaryKey,
-      direction = "asc",
-      where = {},
-      whereNodes,
-      ...queryOptions
-    } = options;
-    if (!Number.isInteger(perPage) || perPage <= 0) {
-      throw new Error("Cursor page size must be a positive integer.");
-    }
-    const cursorWhere = { ...where };
-    if (cursor !== undefined) {
-      cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
-    }
-    const rows = await this.findAll({
-      ...queryOptions,
-      where: cursorWhere,
-      whereNodes,
-      orderBy: { [cursorColumn]: direction },
-      limit: perPage + 1
-    });
-    const hasMore = rows.length > perPage;
-    const data = hasMore ? rows.slice(0, perPage) : rows;
-    const nextCursor = hasMore ? data[data.length - 1]?.[cursorColumn] ?? null : null;
-    const prevCursor = cursor ?? null;
-    return {
-      data,
-      meta: {
-        per_page: perPage,
-        next_cursor: nextCursor,
-        prev_cursor: prevCursor,
-        has_more: hasMore
-      }
-    };
-  }
-  async findById(id) {
-    return await this.firstOrNull({
-      [this.table.primaryKey]: id
-    });
-  }
-  async findByIdOrThrow(id, errorFactory) {
-    const record = await this.findById(id);
-    if (record) {
-      return record;
-    }
-    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
-  }
-  async findByIds(ids) {
-    const uniqueIds = [...new Set(ids)];
-    if (uniqueIds.length === 0) {
-      return [];
-    }
-    return await this.findWhere({
-      [this.table.primaryKey]: uniqueIds
-    });
-  }
-  async firstOrNull(where, options = {}) {
-    const [record] = await this.findAll({ ...options, where, limit: 1 });
-    return record ?? null;
-  }
-  async create(values) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildInsertQuery(this.table, values);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        throw new Error(`Insert into ${this.table.name} did not return a record.`);
-      }
-      const entity = record;
-      await eventBus.dispatch(modelEventName(this.table.name, "created"), entity);
-      return entity;
-    });
-  }
-  async updateById(id, changes) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildUpdateQuery(this.table, id, changes);
-      const [record] = await this.connection.unsafe(text, params);
-      const entity = record ?? null;
-      if (entity) {
-        await eventBus.dispatch(modelEventName(this.table.name, "updated"), entity);
-      }
-      return entity;
-    });
-  }
-  async updateByIdOrThrow(id, changes, errorFactory) {
-    const record = await this.updateById(id, changes);
-    if (record) {
-      return record;
-    }
-    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
-  }
-  async deleteById(id) {
-    if (resolveSoftDeleteColumn(this.table)) {
-      return await this.softDeleteById(id);
-    }
-    return await this.forceDeleteById(id);
-  }
-  async softDeleteById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        return false;
-      }
-      await eventBus.dispatch(modelEventName(this.table.name, "deleted"), record);
-      return true;
-    });
-  }
-  async forceDeleteById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildDeleteByIdQuery(this.table, id);
-      const [row] = await this.connection.unsafe(text, params);
-      if (!row) {
-        return false;
-      }
-      await eventBus.dispatch(modelEventName(this.table.name, "force-deleted"), {
-        id
-      });
-      return true;
-    });
-  }
-  async restoreById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildRestoreByIdQuery(this.table, id);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        return null;
-      }
-      const entity = record;
-      await eventBus.dispatch(modelEventName(this.table.name, "restored"), entity);
-      return entity;
-    });
-  }
-  withConnection(connection) {
-    const clone = Object.create(Object.getPrototypeOf(this));
-    Object.assign(clone, this);
-    clone.connection = connection;
-    return clone;
-  }
-  getConnection() {
-    return this.connection;
-  }
-  getTable() {
-    return this.table;
-  }
-  query(where = {}) {
-    return new RepositoryQuery(this, where);
-  }
-  async findWhere(where, options = {}) {
-    return await this.findAll({ ...options, where });
-  }
-  async countWhere(where = {}, options = {}, whereNodes = []) {
-    const { text, params } = buildCountQuery(this.table, where, options, whereNodes);
-    const [row] = await this.connection.unsafe(text, params);
-    return Number(row?.count ?? 0);
-  }
-  async averageColumn(column, where = {}) {
-    const qualifiedColumn = qualifyColumn(this.table.name, column);
-    return await this.averageExpression(`AVG(${qualifiedColumn})`, "value", where);
-  }
-  async averageExpression(expression, alias, where = {}) {
-    const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
-    const [row] = await this.connection.unsafe(text, params);
-    return Math.round(Number(row?.[alias] ?? 0));
-  }
-  async pluckNumberValues(expression, alias, options = {}) {
-    const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
-    const rows = await this.connection.unsafe(text, params);
-    return rows.flatMap((row) => {
-      const value = row[alias];
-      return value === null || value === undefined ? [] : [Number(value)];
-    });
-  }
-  async countGroupedBy(column, where = {}) {
-    const { text, params } = buildGroupedCountQuery(this.table, column, where);
-    const rows = await this.connection.unsafe(text, params);
-    return rows.map(({ value, count }) => ({
-      value,
-      count: Number(count)
-    }));
-  }
-  async findByHasManyRelation(relation, parentId, options = {}) {
-    return await this.findWhere({
-      [relation.foreignKey]: parentId
-    }, options);
-  }
-  async loadHasManyForParents(parents, relation, options = {}) {
-    if (parents.length === 0) {
-      return indexHasManyRelation(parents, [], relation);
-    }
-    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
-    const children = await this.findWhere({
-      [relation.foreignKey]: parentIds
-    }, options);
-    return indexHasManyRelation(parents, children, relation);
-  }
-  async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
-    if (children.length === 0) {
-      return new Map;
-    }
-    const ownerIds = [...new Set(children.map((child) => child[relation.foreignKey]))];
-    const parents = await parentRepository.withConnection(this.connection).findWhere({
-      [relation.ownerKey]: ownerIds
-    }, options);
-    return indexBelongsToRelation(children, parents, relation);
-  }
-  async loadMorphManyForParents(parents, relation, options = {}) {
-    if (parents.length === 0) {
-      return indexMorphManyRelation(parents, [], relation);
-    }
-    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
-    const children = await this.findWhere({
-      [relation.morphTypeKey]: relation.morphType,
-      [relation.morphIdKey]: parentIds
-    }, options);
-    return indexMorphManyRelation(parents, children, relation);
-  }
-  async loadMorphOneForParents(parents, relation, options = {}) {
-    const grouped = await this.loadMorphManyForParents(parents, relation, options);
-    const result = new Map;
-    for (const parent of parents) {
-      const matches = grouped.get(parent[relation.localKey]) ?? [];
-      result.set(parent[relation.localKey], matches[0]);
-    }
-    return result;
-  }
-  async loadMorphToForChildren(children, relation, repositoriesByType, options = {}) {
-    if (children.length === 0) {
-      return new Map;
-    }
-    const idsByType = new Map;
-    for (const child of children) {
-      const morphType = String(child[relation.morphTypeKey]);
-      const morphId = child[relation.morphIdKey];
-      const ids = idsByType.get(morphType) ?? new Set;
-      ids.add(morphId);
-      idsByType.set(morphType, ids);
-    }
-    const parentsByType = new Map;
-    for (const [morphType, ids] of idsByType) {
-      const repository = repositoriesByType.get(morphType);
-      if (!repository) {
-        continue;
-      }
-      const ownerKey = repository.getTable().primaryKey;
-      const parents = await repository.withConnection(this.connection).findWhere({
-        [ownerKey]: [...ids]
-      }, options);
-      const indexed = new Map;
-      for (const parent of parents) {
-        indexed.set(parent[ownerKey], parent);
-      }
-      parentsByType.set(morphType, indexed);
-    }
-    return indexMorphToRelation(children, parentsByType, relation);
-  }
-}
-var baseRepository_default = BaseRepository5;
-// ../../src/core/database/model.ts
-var modelRepositories = new WeakMap;
-var modelGlobalScopes = new WeakMap;
-var modelBooted = new WeakSet;
-// ../../src/core/database/schema/columnDefinition.ts
-class ColumnDefinition {
-  name;
-  kind;
-  length;
-  isNullable = false;
-  isPrimary = false;
-  isUnique = false;
-  autoIncrement = false;
-  defaultValue;
-  checkExpression;
-  foreignKey;
-  constructor(name, kind) {
-    this.name = name;
-    this.kind = kind;
-  }
-  nullable() {
-    this.isNullable = true;
-    return this;
-  }
-  notNullable() {
-    this.isNullable = false;
-    return this;
-  }
-  default(value) {
-    if (typeof value === "boolean") {
-      this.defaultValue = value ? "TRUE" : "FALSE";
-      return this;
-    }
-    if (typeof value === "number") {
-      this.defaultValue = String(value);
-      return this;
-    }
-    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
-    return this;
-  }
-  defaultRaw(expression) {
-    this.defaultValue = expression;
-    return this;
-  }
-  unique() {
-    this.isUnique = true;
-    return this;
-  }
-  primary() {
-    this.isPrimary = true;
-    return this;
-  }
-  check(expression) {
-    this.checkExpression = expression;
-    return this;
-  }
-}
-
-class ForeignIdColumnDefinition extends ColumnDefinition {
-  constructor(name) {
-    super(name, "foreignId");
-    this.notNullable();
-  }
-  references(table, column = "id") {
-    this.foreignKey = {
-      referencesTable: table,
-      referencesColumn: column
-    };
-    return this;
-  }
-  constrained(table) {
-    const referencesTable = table ?? inferReferencedTable(this.name);
-    return this.references(referencesTable);
-  }
-  cascadeOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
-    }
-    this.foreignKey.onDelete = "cascade";
-    return this;
-  }
-  nullOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
-    }
-    this.foreignKey.onDelete = "set null";
-    return this;
-  }
-}
-function inferReferencedTable(columnName) {
-  if (!columnName.endsWith("_id")) {
-    throw new Error(`Cannot infer referenced table from column ${columnName}`);
-  }
-  return columnName.slice(0, -3);
-}
-
-// ../../src/core/database/schema/blueprint.ts
-class Blueprint {
-  table;
-  action;
-  columns = [];
-  indexes = [];
-  droppedColumns = [];
-  droppedIndexes = [];
-  constructor(table, action) {
-    this.table = table;
-    this.action = action;
-  }
-  id(name = "id") {
-    const column = new ColumnDefinition(name, "id");
-    column.primary();
-    column.autoIncrement = true;
-    this.columns.push(column);
-    return column;
-  }
-  string(name, length) {
-    const column = new ColumnDefinition(name, "string");
-    column.length = length;
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  text(name) {
-    const column = new ColumnDefinition(name, "text");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  boolean(name) {
-    const column = new ColumnDefinition(name, "boolean");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  integer(name) {
-    const column = new ColumnDefinition(name, "integer");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  bigInteger(name) {
-    const column = new ColumnDefinition(name, "bigInteger");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  timestamp(name) {
-    const column = new ColumnDefinition(name, "timestamp");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  json(name) {
-    const column = new ColumnDefinition(name, "json");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  jsonb(name) {
-    const column = new ColumnDefinition(name, "jsonb");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  foreignId(name) {
-    const column = new ForeignIdColumnDefinition(name);
-    this.columns.push(column);
-    return column;
-  }
-  timestamps() {
-    this.timestamp("created_at").defaultRaw("NOW()");
-    this.timestamp("updated_at").defaultRaw("NOW()");
-  }
-  softDeletes() {
-    this.timestamp("deleted_at").nullable();
-  }
-  dropColumn(name) {
-    this.droppedColumns.push(name);
-  }
-  dropSoftDeletes() {
-    this.dropColumn("deleted_at");
-    this.dropIndex(`idx_${this.table}_deleted_at`);
-  }
-  dropIndex(name) {
-    this.droppedIndexes.push(name);
-  }
-  unique(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "unique"
-    });
-  }
-  index(columns, options = {}) {
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "index",
-      order: options.order
-    });
-  }
-  partialIndex(columns, where, nameOrOptions) {
-    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: options.unique ? "uniquePartial" : "partial",
-      where
-    });
-  }
-  fullText(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "fullText"
-    });
-  }
-  ginIndex(column, name) {
-    this.indexes.push({
-      name,
-      columns: [column],
-      kind: "gin"
-    });
-  }
-}
-// ../../src/core/database/schema/errors.ts
-class UnsupportedSchemaFeatureError extends Error {
-  constructor(feature, driver) {
-    super(`${feature} is not supported for the ${driver} driver`);
-    this.name = "UnsupportedSchemaFeatureError";
-  }
-}
-// ../../src/core/database/schema/grammars/grammar.ts
-function compileColumnType(driver, column) {
-  switch (column.kind) {
-    case "id":
-      return compileIdType(driver);
-    case "string":
-      return compileStringType(driver, column.length);
-    case "text":
-      return compileTextType(driver);
-    case "boolean":
-      return compileBooleanType(driver);
-    case "integer":
-    case "foreignId":
-      return compileIntegerType(driver);
-    case "bigInteger":
-      return compileBigIntegerType(driver);
-    case "timestamp":
-      return compileTimestampType(driver);
-    case "json":
-      return compileJsonType(driver);
-    case "jsonb":
-      return compileJsonbType(driver);
-    default:
-      throw new Error(`Unsupported column kind: ${column.kind}`);
-  }
-}
-function compileIdType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "SERIAL";
-    case "mysql":
-      return "BIGINT UNSIGNED";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileStringType(driver, length) {
-  switch (driver) {
-    case "pgsql":
-      return "TEXT";
-    case "mysql":
-      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileTextType(driver) {
-  switch (driver) {
-    case "pgsql":
-    case "sqlite":
-      return "TEXT";
-    case "mysql":
-      return "TEXT";
-  }
-}
-function compileBooleanType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BOOLEAN";
-    case "mysql":
-      return "BOOLEAN";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "INTEGER";
-    case "mysql":
-      return "INT";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileBigIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BIGINT";
-    case "mysql":
-      return "BIGINT";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileTimestampType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "TIMESTAMPTZ";
-    case "mysql":
-      return "TIMESTAMP";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileJsonType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileJsonbType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-
-// ../../src/core/database/schema/grammars/compileStatements.ts
-function compileCreateTable(driver, blueprint) {
-  const table = quoteIdentifier(blueprint.table);
-  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length > 1) {
-      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-      parts.push(`UNIQUE (${columns})`);
-    }
-  }
-  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
-  ${parts.join(`,
-  `)}
-)`];
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length === 1) {
-      continue;
-    }
-    if (index.kind === "index") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
-}
-function compileAlterTable(driver, blueprint) {
-  const statements = [];
-  const table = quoteIdentifier(blueprint.table);
-  for (const column of blueprint.columns) {
-    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
-    statements.push(`ALTER TABLE ${table}
-${addPrefix} ${compileColumn(driver, column, "alter")}`);
-  }
-  for (const columnName of blueprint.droppedColumns) {
-    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
-    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
-  }
-  for (const indexName of blueprint.droppedIndexes) {
-    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
-  }
-  for (const index of blueprint.indexes) {
-    if (index.kind === "index" || index.kind === "unique") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
-}
-function compileDropTable(driver, tableName) {
-  const cascade = driver === "pgsql" ? " CASCADE" : "";
-  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
-}
-function compileColumn(driver, column, mode) {
-  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
-  if (column.autoIncrement && driver === "mysql") {
-    parts[1] = `${parts[1]} AUTO_INCREMENT`;
-  }
-  if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
-      parts.push("PRIMARY KEY AUTOINCREMENT");
-    } else {
-      parts.push("PRIMARY KEY");
-    }
-  } else if (!column.isNullable) {
-    parts.push("NOT NULL");
-  } else if (column.isNullable) {
-    parts.push("NULL");
-  }
-  if (column.defaultValue !== undefined) {
-    parts.push(`DEFAULT ${column.defaultValue}`);
-  }
-  if (column.isUnique) {
-    parts.push("UNIQUE");
-  }
-  if (column.checkExpression) {
-    parts.push(`CHECK (${column.checkExpression})`);
-  }
-  if (column.foreignKey) {
-    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
-    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
-    let clause = `REFERENCES ${reference}`;
-    if (onDelete === "cascade") {
-      clause += " ON DELETE CASCADE";
-    } else if (onDelete === "set null") {
-      clause += " ON DELETE SET NULL";
-    }
-    parts.push(clause);
-  }
-  return parts.join(" ");
-}
-function compileIndex(_driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
-  const columns = index.columns.map((column) => {
-    const quoted = quoteIdentifier(column);
-    if (index.order === "desc") {
-      return `${quoted} DESC`;
-    }
-    return quoted;
-  }).join(", ");
-  const unique = index.kind === "unique" ? "UNIQUE " : "";
-  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
-}
-function compileSpecialIndex(driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
-  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-  switch (index.kind) {
-    case "partial":
-    case "uniquePartial": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
-      }
-      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
-      return [
-        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
-      ];
-    }
-    case "gin": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
-      }
-      return [
-        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
-      ];
-    }
-    case "fullText": {
-      if (driver === "mysql") {
-        return [
-          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
-        ];
-      }
-      if (driver === "pgsql") {
-        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
-      }
-      throw new UnsupportedSchemaFeatureError("fullText()", driver);
-    }
-    default:
-      return [];
-  }
-}
-function defaultIndexName(tableName, columns, kind) {
-  return `idx_${tableName}_${columns.join("_")}_${kind}`;
-}
-function compileBlueprint(driver, blueprint) {
-  switch (blueprint.action) {
-    case "create":
-      return compileCreateTable(driver, blueprint);
-    case "alter":
-      return compileAlterTable(driver, blueprint);
-    case "drop":
-      return compileDropTable(driver, blueprint.table);
-    default:
-      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
-  }
-}
-// ../../src/core/database/schema/grammars/createGrammar.ts
-function createGrammar(driver) {
-  return {
-    driver,
-    compile(blueprint) {
-      return compileBlueprint(driver, blueprint);
-    }
-  };
-}
-
-// ../../src/core/database/schema/grammars/mysqlGrammar.ts
-var MySqlGrammar = createGrammar("mysql");
-
-// ../../src/core/database/schema/grammars/postgresGrammar.ts
-var PostgresGrammar = createGrammar("pgsql");
-
-// ../../src/core/database/schema/grammars/sqliteGrammar.ts
-var SqliteGrammar = createGrammar("sqlite");
-
-// ../../src/core/database/schema/grammars/index.ts
-function grammarForDriver(driver) {
-  switch (driver) {
-    case "pgsql":
-      return PostgresGrammar;
-    case "mysql":
-      return MySqlGrammar;
-    case "sqlite":
-      return SqliteGrammar;
-    default:
-      throw new Error(`Unsupported database driver: ${driver}`);
-  }
-}
-// ../../src/core/database/schema/schema.ts
-class SchemaBuilder {
-  #driver;
-  #statements = [];
-  constructor(driver) {
-    this.#driver = driver;
-  }
-  create(table, callback) {
-    const blueprint = new Blueprint(table, "create");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  table(table, callback) {
-    const blueprint = new Blueprint(table, "alter");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  drop(table) {
-    const blueprint = new Blueprint(table, "drop");
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  toSql() {
-    return [...this.#statements];
-  }
-  async execute(db2) {
-    for (const statement of this.#statements) {
-      await db2.unsafe(statement);
-    }
-  }
-}
-// ../../src/core/database/table.ts
-function defineTable5(definition) {
-  return definition;
-}
-// ../../src/core/queue/failedJobTable.ts
-var failedJobTable = defineTable5({
-  name: "failed_job",
-  primaryKey: "id",
-  columns: ["id", "job_name", "payload", "exception", "failed_at"],
-  defaultOrderBy: { column: "failed_at", direction: "DESC" }
-});
-
-// ../../src/core/queue/failedJobRepository.ts
-class FailedJobRepository extends baseRepository_default {
-  constructor() {
-    super(failedJobTable);
-  }
-}
-var failedJobRepository_default = FailedJobRepository;
-
-// ../../src/core/queue/failedJobService.ts
-class FailedJobService {
-  repository;
-  constructor(repository) {
-    this.repository = repository;
-  }
-  async recordFailure(input) {
-    return await this.repository.create({
-      job_name: input.jobName,
-      payload: input.payload,
-      exception: input.exception,
-      failed_at: new Date
-    });
-  }
-  listRecent(limit = 50) {
-    return this.repository.findAll({
-      limit,
-      orderBy: { column: "failed_at", direction: "DESC" }
-    });
-  }
-  async retry(id) {
-    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
-    await this.repository.deleteById(id);
-    return failedJob;
-  }
-  async delete(id) {
-    const deleted = await this.repository.deleteById(id);
-    if (!deleted) {
-      throw new Error(`Failed job ${id} not found.`);
-    }
-  }
-  async flush() {
-    const jobs = await this.repository.findAll();
-    let deleted = 0;
-    for (const job of jobs) {
-      if (await this.repository.deleteById(job.id)) {
-        deleted += 1;
-      }
-    }
-    return deleted;
-  }
-}
-var failedJobService_default = FailedJobService;
-
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
-}
-var jobRegistry = readSharedJobRegistry();
-
-// ../../src/core/queue/jobRunner.ts
-async function runQueueJob(envelope, failedJobs) {
-  const job = jobRegistry.create(envelope.name);
-  if (!job) {
-    throw new Error(`Unknown job "${envelope.name}".`);
-  }
-  const attempts = envelope.attempts ?? 0;
-  try {
-    await job.handle(envelope.payload);
-  } catch (error) {
-    const nextAttempt = attempts + 1;
-    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
-    if (nextAttempt < maxAttempts) {
-      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
-      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
-      await runQueueJob({
-        ...envelope,
-        attempts: nextAttempt
-      }, failedJobs);
-      return;
-    }
-    await failedJobs.recordFailure({
-      jobName: envelope.name,
-      payload: envelope.payload,
-      exception: error instanceof Error ? error.stack ?? error.message : String(error)
-    });
-    throw error;
-  }
-}
-
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
-function queueKeyForPriority(priority = "default") {
-  switch (priority) {
-    case "high":
-      return QUEUE_HIGH_KEY;
-    case "low":
-      return QUEUE_LOW_KEY;
-    default:
-      return QUEUE_LIST_KEY;
-  }
-}
-class RedisQueue {
-  client;
-  constructor(redisUrl) {
-    this.client = new RedisClient2(redisUrl);
-  }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
-    }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    const queueKey = queueKeyForPriority(job.priority);
-    await this.client.lpush(queueKey, JSON.stringify(envelope));
-  }
-}
-
-// ../../src/core/queue/resilientQueue.ts
-class ResilientQueue {
-  failedJobs;
-  asyncDispatch;
-  constructor(failedJobs, asyncDispatch = false) {
-    this.failedJobs = failedJobs;
-    this.asyncDispatch = asyncDispatch;
-  }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
-    }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    if (this.asyncDispatch) {
-      setTimeout(() => {
-        runQueueJob(envelope, this.failedJobs).catch((error) => {
-          console.error("[ResilientQueue] Job failed:", error);
-        });
-      }, 0);
-      return;
-    }
-    await runQueueJob(envelope, this.failedJobs);
+// ../../src/bootstrap/providers/events.ts
+import { eventBus } from "@getstrata/core/events";
+var eventsProvider = {
+  name: "core.events",
+  register({ container }) {
+    container.set(CORE_EVENT_BUS_TOKEN, eventBus);
   }
-}
+};
+var events_default = eventsProvider;
 
-// ../../src/core/queue/publicQueue.ts
-function createFailedJobService() {
-  return new failedJobService_default(new failedJobRepository_default);
-}
-function createTrackedJob(name, job) {
-  return jobRegistry.track(name, job);
-}
-function createProductionQueue(driver, options = {}) {
-  options.registerJobs?.();
-  const failedJobs = options.failedJobs ?? createFailedJobService();
-  if (driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+// ../../src/bootstrap/discoverListeners.ts
+import { readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadDiscoveredListeners() {
+  const listenersDirectory = join2(import.meta.dir, "../listeners");
+  let entries;
+  try {
+    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
     }
-    return new RedisQueue(options.redisUrl);
+    throw error;
   }
-  return new ResilientQueue(failedJobs, driver === "async");
+  const listeners = await Promise.all(entries.map(async (fileName) => {
+    const moduleUrl = pathToFileURL2(join2(listenersDirectory, fileName)).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return listeners.filter((listener) => typeof listener === "function");
 }
-
-// ../../src/core/queue/createAppQueue.ts
-var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
-function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
-  return createProductionQueue(driver, {
-    redisUrl,
-    failedJobs,
-    registerJobs
-  });
+var appListeners = await loadDiscoveredListeners();
+function discoverListeners() {
+  return appListeners;
 }
 
 // ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
+import { eventBus as eventBus2, modelEventName } from "@getstrata/core/events";
+import InvalidateCacheTagsJob from "@getstrata/core/jobs/invalidateCacheTagsJob";
+import { createTrackedJob } from "@getstrata/core/queue/createAppQueue";
 var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
-function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
+function registerInvalidateCacheOnModelWriteListeners(bus = eventBus2) {
   for (const tableName of discoverModelTableNames()) {
     for (const action of MODEL_WRITE_ACTIONS) {
       bus.listen(modelEventName(tableName, action), async () => {
@@ -4043,7 +1284,7 @@ function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
         } catch {
           return;
         }
-        const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
+        const job = createTrackedJob("cache.invalidate-tags", new InvalidateCacheTagsJob(cache));
         await queue.dispatch(job, { tags });
       });
     }
@@ -4072,46 +1313,8 @@ var listenersProvider = {
 };
 var listeners_default = listenersProvider;
 
-// ../../src/core/auth/policy.ts
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
-
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
-  }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
-    }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
-  }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
-  }
-}
-
 // ../../src/bootstrap/providers/policy.ts
+import { PolicyGate } from "@getstrata/core/auth/policy";
 var policyProvider = {
   name: "core.policy",
   register({ container }) {
@@ -4120,116 +1323,23 @@ var policyProvider = {
 };
 var policy_default = policyProvider;
 
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac as createHmac2 } from "crypto";
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/contracts/di.ts
-function getRequiredDependency2(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_POLICY_GATE_TOKEN2 = "core.policyGate";
-var CORE_AUTH_TOKEN2 = "core.auth";
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return context;
-}
-function resolveApplicationCache2() {
-  return getRequiredDependency2(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationAuth2() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN2);
-}
-function resolveApplicationPolicyGate2() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN2);
-}
+// ../../src/bootstrap/providers/queue.ts
+import {
+  createAppQueue,
+  createFailedJobService,
+  FAILED_JOB_SERVICE_TOKEN
+} from "@getstrata/core/queue/createAppQueue";
 
 // ../../src/bootstrap/queue/defaultJobs.ts
+import DispatchWebhookJob from "@getstrata/core/jobs/dispatchWebhookJob";
+import InvalidateCacheTagsJob2 from "@getstrata/core/jobs/invalidateCacheTagsJob";
+import { jobRegistry } from "@getstrata/core/queue/jobRegistry";
+import { resolveApplicationCache as resolveApplicationCache2 } from "@getstrata/core/runtime/applicationRegistry";
 function registerDefaultJobs() {
   jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache2());
+    return new InvalidateCacheTagsJob2(resolveApplicationCache2());
   });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
+  jobRegistry.register("webhook.dispatch", () => new DispatchWebhookJob);
 }
 
 // ../../src/bootstrap/providers/queue.ts
@@ -4246,120 +1356,8 @@ var queueProvider = {
 };
 var queue_default = queueProvider;
 
-// ../../src/core/storage/storage.ts
-import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join3 } from "path";
-var {S3Client } = globalThis.Bun;
-
-class LocalStorageDriver {
-  rootDirectory;
-  constructor(rootDirectory) {
-    this.rootDirectory = rootDirectory;
-  }
-  resolveRootDirectory() {
-    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
-  }
-  resolvePath(path) {
-    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
-  }
-  async put(path, contents) {
-    const absolutePath = this.resolvePath(path);
-    await mkdir(dirname(absolutePath), { recursive: true });
-    await writeFile(absolutePath, contents);
-    return path;
-  }
-  async get(path) {
-    try {
-      return await readFile(this.resolvePath(path));
-    } catch {
-      return null;
-    }
-  }
-  async delete(path) {
-    try {
-      await unlink(this.resolvePath(path));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-
-class S3StorageDriver {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async put(path, contents) {
-    await this.client.write(path.replace(/^\/+/, ""), contents);
-    return path;
-  }
-  async get(path) {
-    const normalizedPath = path.replace(/^\/+/, "");
-    const file = this.client.file(normalizedPath);
-    if (!await file.exists()) {
-      return null;
-    }
-    return new Uint8Array(await file.arrayBuffer());
-  }
-  async delete(path) {
-    try {
-      await this.client.unlink(path.replace(/^\/+/, ""));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-
-class StorageManager {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
-  }
-  put(path, contents) {
-    return this.driver.put(path, contents);
-  }
-  get(path) {
-    return this.driver.get(path);
-  }
-  delete(path) {
-    return this.driver.delete(path);
-  }
-}
-function resolveS3Config() {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
-  const bucket = process.env.AWS_BUCKET?.trim();
-  if (!accessKeyId || !secretAccessKey || !bucket) {
-    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
-  }
-  return {
-    accessKeyId,
-    secretAccessKey,
-    bucket,
-    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
-    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
-  };
-}
-function createS3Client(config = resolveS3Config()) {
-  return new S3Client({
-    accessKeyId: config.accessKeyId,
-    secretAccessKey: config.secretAccessKey,
-    bucket: config.bucket,
-    ...config.region ? { region: config.region } : {},
-    ...config.endpoint ? { endpoint: config.endpoint } : {}
-  });
-}
-function createStorageDriver() {
-  const driver = process.env.STORAGE_DRIVER ?? "local";
-  if (driver === "s3") {
-    return new S3StorageDriver(createS3Client());
-  }
-  return new LocalStorageDriver;
-}
-
 // ../../src/bootstrap/providers/storage.ts
+import { createStorageDriver, StorageManager } from "@getstrata/core/storage/storage";
 var storageProvider = {
   name: "core.storage",
   register({ dependencies }) {
@@ -4368,215 +1366,9 @@ var storageProvider = {
 };
 var storage_default = storageProvider;
 
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/view/etaViewEngine.ts
-import { join as join4 } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
-    }
-  }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
-  }
-  return null;
-}
-
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
-  }
-  return createCsrfTokenCookie();
-}
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
-  }
-  return resolveCsrfToken(request).token;
-}
-
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-
-// ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return { authUser: null, csrfToken, flash };
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
-  }
-  if (!container.has(tokenServiceToken)) {
-    return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  }
-  const tokenService = container.resolve(tokenServiceToken);
-  try {
-    const user = await tokenService.findByIdOrThrow(userId);
-    return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  } catch {
-    return { authUser: null, csrfToken, flash };
-  }
-}
 // ../../src/bootstrap/providers/view.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, resolveWebLayoutData } from "@getstrata/core/view";
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -4696,8 +1488,8 @@ function createAppContext() {
   return appContext;
 }
 // ../../src/bootstrap/createWebRoutes.ts
-import { join as join5 } from "path";
-import { htmlResponse as htmlResponse2 } from "@getstrata/core/view";
+import { join as join3 } from "path";
+import { htmlResponse } from "@getstrata/core/view";
 function registerRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
@@ -4713,9 +1505,9 @@ function createWebRoutes(dependencies) {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join5(process.cwd(), "public", relativePath));
+    const file = Bun.file(join3(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
-      return htmlResponse2("Not Found", { status: 404 });
+      return htmlResponse("Not Found", { status: 404 });
     }
     return new Response(file);
   };
@@ -4735,178 +1527,17 @@ function mergeWebRoutes(dependencies, routes) {
 function createAppDependencies() {
   return createAppContext().dependencies;
 }
-// ../../src/core/crypto/nonCryptographicHash.ts
-function nonCryptographicDigest(input) {
-  return Bun.hash(input).toString(16);
-}
-
-// ../../src/core/http/etag.ts
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
-}
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
-}
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
-  return formatWeakEtag(digest);
-}
-function normalizeEtag(value) {
-  return value.trim();
-}
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
-}
-function parseEtagList(header) {
-  if (!header) {
-    return [];
-  }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
-}
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
-    }
-    return;
-  }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
-  }
-}
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
-}
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
-  });
-}
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
-  }
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
-  }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-
-// ../../src/core/http/validation.ts
-function parsePositiveIntParam(value, name = "id") {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
-  }
-  return parsed;
-}
-
-// ../../src/core/http/securedRouteModelBinding.ts
-function isMutatingPolicyAction(action) {
-  return action === "update" || action === "delete";
-}
-function securedBindRouteModel(param, resolver, authorization, handler) {
-  return async (request) => {
-    const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
-    const gate = resolveApplicationPolicyGate2();
-    const auth = resolveApplicationAuth2();
-    const user = currentAuthUser() ?? await auth.resolve(request);
-    gate.authorize(authorization.resource, authorization.action, user, model);
-    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
-      assertIfMatch(request, etagFromResource(model), {
-        required: authorization.requireIfMatch ?? true
-      });
-    }
-    const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
-      return applyConditionalGet(request, response, etagFromResource(model));
-    }
-    return response;
-  };
-}
-function securedBindRouteModelByKey(param, resolver, authorization, handler) {
-  return async (request) => {
-    const key = String(request.params[param] ?? "").trim();
-    if (!key) {
-      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
-    }
-    const model = await resolver(key, request);
-    const gate = resolveApplicationPolicyGate2();
-    const auth = resolveApplicationAuth2();
-    const user = currentAuthUser() ?? await auth.resolve(request);
-    gate.authorize(authorization.resource, authorization.action, user, model);
-    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
-      assertIfMatch(request, etagFromResource(model), {
-        required: authorization.requireIfMatch ?? true
-      });
-    }
-    const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
-      return applyConditionalGet(request, response, etagFromResource(model));
-    }
-    return response;
-  };
-}
+// ../../src/bootstrap/http/securedRouteModelBinding.ts
+import {
+  securedBindRouteModel,
+  securedBindRouteModelByKey
+} from "@getstrata/core/http/securedRouteModelBinding";
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
-// ../../src/core/http/csrfProtection.ts
-var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
-function createCsrfProtection(secret, options = {}) {
-  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
-  const maxAge = options.maxAge ?? expiresIn;
-  return {
-    generate(_sessionKey) {
-      return Bun.CSRF.generate(secret, { expiresIn });
-    },
-    verify(token, _sessionKey) {
-      if (!token) {
-        return false;
-      }
-      return Bun.CSRF.verify(token, { secret, maxAge });
-    },
-    secret
-  };
-}
-
 // ../../src/bootstrap/web/forms.ts
+import {
+  createCsrfProtection
+} from "@getstrata/core/http/csrfProtection";
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type") ?? "";
   const fields = {};
@@ -5034,6 +1665,8 @@ function createWebServer(options) {
 }
 // ../../src/bootstrap/web/session.ts
 import { createHash, randomBytes } from "crypto";
+import { readRequestCookie } from "@getstrata/core/http/cookies";
+
 class CookieSessionStore {
   sql;
   secret;
@@ -5151,7 +1784,7 @@ export {
   buildModuleRoutes,
   assertProductionSecrets,
   assertAppDependenciesComplete,
-  appSchedule2 as appSchedule,
+  appSchedule3 as appSchedule,
   ServiceContainer,
   Schedule2 as Schedule,
   RouteRegistry,