@getstrata/core 0.2.0

package/dist/index.js

@@ -0,0 +1,2187 @@
+// @bun
+// ../../src/bootstrap/contracts.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
+  }
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
+    }
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
+    }
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
+    }
+    throw new Error(`Service "${key}" is not registered.`);
+  }
+  resolve(key) {
+    return this.get(key);
+  }
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  }
+}
+
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
+  }
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
+  }
+}
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
+}
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/auth/policy.ts
+class Policy {
+  constructor() {}
+  view(_user, _resource) {
+    return false;
+  }
+  create(_user) {
+    return false;
+  }
+  update(_user, _resource) {
+    return false;
+  }
+  delete(_user, _resource) {
+    return false;
+  }
+}
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
+    }
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
+  }
+}
+// ../../src/core/cache/taggedCache.ts
+class TaggedCache {
+  store;
+  tags;
+  constructor(store, tags) {
+    this.store = store;
+    this.tags = tags;
+  }
+  async remember(key, callback, ttlMs) {
+    const value = await this.store.getOrSet(key, callback, ttlMs);
+    await this.store.attachTags(key, this.tags);
+    return value;
+  }
+  async flush() {
+    return this.store.flushTags(this.tags);
+  }
+}
+var taggedCache_default = TaggedCache;
+
+// ../../src/core/cache/repository.ts
+class CacheRepository {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  async get(key) {
+    return this.store.get(key);
+  }
+  async remember(key, callback, ttlMs) {
+    return this.store.getOrSet(key, callback, ttlMs);
+  }
+  async forget(key) {
+    return this.store.invalidate(key);
+  }
+  async flush() {
+    await this.store.clear();
+  }
+  tags(...names) {
+    return new taggedCache_default(this.store, names);
+  }
+  async getOrSet(key, loader, ttlMs) {
+    return this.remember(key, loader, ttlMs);
+  }
+  async invalidate(key) {
+    return this.forget(key);
+  }
+  async invalidateByPrefix(prefix) {
+    return this.store.invalidateByPrefix(prefix);
+  }
+  async clear() {
+    await this.flush();
+  }
+  async size() {
+    return this.store.size();
+  }
+}
+var repository_default = CacheRepository;
+// ../../src/core/cache/tags.ts
+var CACHE_TAGS = {
+  organizations: "organizations",
+  projects: "projects",
+  tasks: "tasks",
+  comments: "comments",
+  attachments: "attachments",
+  reports: "reports"
+};
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: createDatabaseConnection(databaseConfig)
+};
+function getDatabase() {
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  listeners = new Map;
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
+  }
+}
+var eventBus = new EventBus;
+
+// ../../src/core/events/index.ts
+function modelEventName(tableName, action) {
+  return `${tableName}.${action}`;
+}
+
+// ../../src/core/pagination/index.ts
+function buildPaginationMeta(input) {
+  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
+  return {
+    page: input.page,
+    per_page: input.perPage,
+    total: input.total,
+    last_page: lastPage
+  };
+}
+
+// ../../src/core/database/errors.ts
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
+  }
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
+  }
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
+  }
+  return;
+}
+function mapDatabaseError(error) {
+  if (error instanceof HttpError) {
+    return error;
+  }
+  if (!isPostgresError(error)) {
+    const message = error instanceof Error ? error.message : "Database operation failed.";
+    return new BadRequestError(message);
+  }
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      return new ConflictError(error.detail ?? "A record with these values already exists.", {
+        constraint: error.constraint
+      });
+    case "23503":
+      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
+        constraint: error.constraint
+      });
+    case "23502":
+      return new BadRequestError(error.detail ?? "Required field is missing.", {
+        constraint: error.constraint
+      });
+    case "23514":
+      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
+        constraint: error.constraint
+      });
+    default:
+      return new BadRequestError(error.message ?? "Database operation failed.", {
+        code: error.code,
+        sqlState
+      });
+  }
+}
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
+  }
+}
+
+// ../../src/core/database/query.ts
+function quoteIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return `"${identifier}"`;
+}
+function qualifyColumn(tableName, column) {
+  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
+}
+function normalizeDirection(direction = "ASC") {
+  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
+}
+function isQueryOperator(value) {
+  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
+}
+function pushParam(values, value) {
+  values.push(value);
+  return `$${values.length}`;
+}
+function buildInClause(column, values, params) {
+  if (values.length === 0) {
+    return "1 = 0";
+  }
+  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
+  return `${column} IN (${placeholders})`;
+}
+function buildOperatorClauses(column, operator, params) {
+  const clauses = [];
+  if (operator.isNull === true) {
+    clauses.push(`${column} IS NULL`);
+  }
+  if (operator.isNull === false) {
+    clauses.push(`${column} IS NOT NULL`);
+  }
+  if (operator.eq !== undefined) {
+    if (operator.eq === null) {
+      clauses.push(`${column} IS NULL`);
+    } else {
+      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
+    }
+  }
+  if (operator.in !== undefined) {
+    clauses.push(buildInClause(column, operator.in, params));
+  }
+  if (operator.gt !== undefined) {
+    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
+  }
+  if (operator.gte !== undefined) {
+    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
+  }
+  if (operator.lt !== undefined) {
+    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
+  }
+  if (operator.lte !== undefined) {
+    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
+  }
+  return clauses;
+}
+function buildWhereClause(tableName, where = {}) {
+  const clauses = [];
+  const params = [];
+  for (const [columnName, filterValue] of Object.entries(where)) {
+    if (filterValue === undefined) {
+      continue;
+    }
+    const column = qualifyColumn(tableName, columnName);
+    if (Array.isArray(filterValue)) {
+      clauses.push(buildInClause(column, filterValue, params));
+      continue;
+    }
+    if (isQueryOperator(filterValue)) {
+      clauses.push(...buildOperatorClauses(column, filterValue, params));
+      continue;
+    }
+    if (filterValue === null) {
+      clauses.push(`${column} IS NULL`);
+      continue;
+    }
+    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
+  }
+  return {
+    clause: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "",
+    params
+  };
+}
+function resolveSoftDeleteColumn(table) {
+  if (!table.softDeletes) {
+    return null;
+  }
+  if (table.softDeletes === true) {
+    return "deleted_at";
+  }
+  return table.softDeletes.column ?? "deleted_at";
+}
+function appendSoftDeleteScope(table, options, clauses) {
+  const column = resolveSoftDeleteColumn(table);
+  if (!column) {
+    return;
+  }
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  if (options.onlyTrashed) {
+    clauses.push(`${qualifiedColumn} IS NOT NULL`);
+    return;
+  }
+  if (!options.withTrashed) {
+    clauses.push(`${qualifiedColumn} IS NULL`);
+  }
+}
+function buildQueryWhereClause(table, options = {}) {
+  const { clause, params } = buildWhereClause(table.name, options.where ?? {});
+  const clauses = clause.length > 0 ? clause.replace(/^ WHERE /, "").split(" AND ") : [];
+  appendSoftDeleteScope(table, options, clauses);
+  return {
+    clause: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "",
+    params
+  };
+}
+function normalizeOrderBy(orderBy) {
+  if (!orderBy) {
+    return [];
+  }
+  return Array.isArray(orderBy) ? orderBy : [orderBy];
+}
+function buildOrderByClause(tableName, orderBy) {
+  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
+    return `${qualifyColumn(tableName, column)} ${normalizeDirection(direction)}`;
+  });
+  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
+}
+function buildLimitClause(limit) {
+  if (limit === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new Error("Query limit must be a positive integer.");
+  }
+  return ` LIMIT ${limit}`;
+}
+function buildOffsetClause(offset) {
+  if (offset === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(offset) || offset < 0) {
+    throw new Error("Query offset must be a non-negative integer.");
+  }
+  return ` OFFSET ${offset}`;
+}
+function buildReturningColumns(table) {
+  return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
+}
+function getDefinedColumnEntries(table, values, options = {}) {
+  const record = values;
+  const excluded = new Set(options.exclude ?? []);
+  return table.columns.flatMap((column) => {
+    if (excluded.has(column) || !Object.hasOwn(record, column)) {
+      return [];
+    }
+    const value = record[column];
+    if (value === undefined) {
+      return [];
+    }
+    return [[column, value]];
+  });
+}
+function buildSelectQuery(table, options = {}) {
+  const columns = buildReturningColumns(table);
+  const { clause, params } = buildQueryWhereClause(table, options);
+  const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
+  const limit = buildLimitClause(options.limit);
+  const offset = buildOffsetClause(options.offset);
+  return {
+    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${clause}${orderBy}${limit}${offset}`,
+    params
+  };
+}
+function buildCountQuery(table, where = {}, options = {}) {
+  const { clause, params } = buildQueryWhereClause(table, {
+    where,
+    ...options
+  });
+  return {
+    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${clause}`,
+    params
+  };
+}
+function buildProjectionQuery(table, expression, alias, options = {}) {
+  const { clause, params } = buildQueryWhereClause(table, options);
+  const orderBy = buildOrderByClause(table.name, options.orderBy);
+  const limit = buildLimitClause(options.limit);
+  return {
+    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${clause}${orderBy}${limit}`,
+    params
+  };
+}
+function buildGroupedCountQuery(table, column, where = {}, options = {}) {
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  const { clause, params } = buildQueryWhereClause(table, {
+    where,
+    ...options
+  });
+  return {
+    text: `SELECT ${qualifiedColumn} AS ${quoteIdentifier("value")}, COUNT(*) AS ${quoteIdentifier("count")} FROM ${quoteIdentifier(table.name)}${clause} GROUP BY ${qualifiedColumn} ORDER BY ${qualifiedColumn} ASC`,
+    params
+  };
+}
+function buildInsertQuery(table, values) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot insert into ${table.name} without any column values.`);
+  }
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildUpdateQuery(table, id, changes) {
+  const entries = getDefinedColumnEntries(table, changes, {
+    exclude: [table.primaryKey]
+  });
+  if (entries.length === 0) {
+    throw new Error(`Cannot update ${table.name} without any changed column values.`);
+  }
+  const params = [];
+  const setClause = entries.map(([column, value]) => `${quoteIdentifier(column)} = ${pushParam(params, value)}`).join(", ");
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildSoftDeleteByIdQuery(table, id, deletedAt) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
+    params: [deletedAt, id]
+  };
+}
+function buildRestoreByIdQuery(table, id) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
+    params: [null, id]
+  };
+}
+function buildDeleteByIdQuery(table, id) {
+  return {
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
+    params: [id]
+  };
+}
+
+// ../../src/core/database/relationships.ts
+function indexHasManyRelation(parents, children, relation) {
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.localKey], []);
+  }
+  for (const child of children) {
+    const key = child[relation.foreignKey];
+    const group = groups.get(key);
+    if (!group) {
+      continue;
+    }
+    group.push(child);
+  }
+  return groups;
+}
+function indexBelongsToRelation(children, parents, relation) {
+  const parentsById = new Map;
+  for (const parent of parents) {
+    parentsById.set(parent[relation.ownerKey], parent);
+  }
+  const result = new Map;
+  for (const child of children) {
+    const foreignKey = child[relation.foreignKey];
+    const parent = parentsById.get(foreignKey);
+    if (parent) {
+      result.set(foreignKey, parent);
+    }
+  }
+  return result;
+}
+
+// ../../src/core/database/baseRepository.ts
+class BaseRepository {
+  table;
+  connection;
+  constructor(table, connection = connection_default) {
+    this.table = table;
+    this.connection = connection;
+  }
+  async findAll(options = {}) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildSelectQuery(this.table, options);
+      return await this.connection.unsafe(text, params);
+    });
+  }
+  async paginate(options) {
+    const where = options.where ?? {};
+    const total = await this.countWhere(where, {
+      withTrashed: options.withTrashed,
+      onlyTrashed: options.onlyTrashed
+    });
+    const offset = (options.page - 1) * options.perPage;
+    const { page, perPage, ...queryOptions } = options;
+    const data = await this.findAll({
+      ...queryOptions,
+      where,
+      limit: perPage,
+      offset
+    });
+    return {
+      data,
+      meta: buildPaginationMeta({ page, perPage, total })
+    };
+  }
+  async findById(id) {
+    return await this.firstOrNull({
+      [this.table.primaryKey]: id
+    });
+  }
+  async findByIdOrThrow(id, errorFactory) {
+    const record = await this.findById(id);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async findByIds(ids) {
+    const uniqueIds = [...new Set(ids)];
+    if (uniqueIds.length === 0) {
+      return [];
+    }
+    return await this.findWhere({
+      [this.table.primaryKey]: uniqueIds
+    });
+  }
+  async firstOrNull(where, options = {}) {
+    const [record] = await this.findAll({ ...options, where, limit: 1 });
+    return record ?? null;
+  }
+  async create(values) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildInsertQuery(this.table, values);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        throw new Error(`Insert into ${this.table.name} did not return a record.`);
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "created"), entity);
+      return entity;
+    });
+  }
+  async updateById(id, changes) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildUpdateQuery(this.table, id, changes);
+      const [record] = await this.connection.unsafe(text, params);
+      const entity = record ?? null;
+      if (entity) {
+        await eventBus.dispatch(modelEventName(this.table.name, "updated"), entity);
+      }
+      return entity;
+    });
+  }
+  async updateByIdOrThrow(id, changes, errorFactory) {
+    const record = await this.updateById(id, changes);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async deleteById(id) {
+    if (resolveSoftDeleteColumn(this.table)) {
+      return await this.softDeleteById(id);
+    }
+    return await this.forceDeleteById(id);
+  }
+  async softDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "deleted"), record);
+      return true;
+    });
+  }
+  async forceDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildDeleteByIdQuery(this.table, id);
+      const [row] = await this.connection.unsafe(text, params);
+      if (!row) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "force-deleted"), {
+        id
+      });
+      return true;
+    });
+  }
+  async restoreById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildRestoreByIdQuery(this.table, id);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return null;
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "restored"), entity);
+      return entity;
+    });
+  }
+  withConnection(connection) {
+    const clone = Object.create(Object.getPrototypeOf(this));
+    Object.assign(clone, this);
+    clone.connection = connection;
+    return clone;
+  }
+  async findWhere(where, options = {}) {
+    return await this.findAll({ ...options, where });
+  }
+  async countWhere(where = {}, options = {}) {
+    const { text, params } = buildCountQuery(this.table, where, options);
+    const [row] = await this.connection.unsafe(text, params);
+    return Number(row?.count ?? 0);
+  }
+  async averageColumn(column, where = {}) {
+    const qualifiedColumn = qualifyColumn(this.table.name, column);
+    return await this.averageExpression(`AVG(${qualifiedColumn})`, "value", where);
+  }
+  async averageExpression(expression, alias, where = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
+    const [row] = await this.connection.unsafe(text, params);
+    return Math.round(Number(row?.[alias] ?? 0));
+  }
+  async pluckNumberValues(expression, alias, options = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.flatMap((row) => {
+      const value = row[alias];
+      return value === null || value === undefined ? [] : [Number(value)];
+    });
+  }
+  async countGroupedBy(column, where = {}) {
+    const { text, params } = buildGroupedCountQuery(this.table, column, where);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.map(({ value, count }) => ({
+      value,
+      count: Number(count)
+    }));
+  }
+  async findByHasManyRelation(relation, parentId, options = {}) {
+    return await this.findWhere({
+      [relation.foreignKey]: parentId
+    }, options);
+  }
+  async loadHasManyForParents(parents, relation, options = {}) {
+    if (parents.length === 0) {
+      return indexHasManyRelation(parents, [], relation);
+    }
+    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
+    const children = await this.findWhere({
+      [relation.foreignKey]: parentIds
+    }, options);
+    return indexHasManyRelation(parents, children, relation);
+  }
+  async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
+    if (children.length === 0) {
+      return new Map;
+    }
+    const ownerIds = [...new Set(children.map((child) => child[relation.foreignKey]))];
+    const parents = await parentRepository.withConnection(this.connection).findWhere({
+      [relation.ownerKey]: ownerIds
+    }, options);
+    return indexBelongsToRelation(children, parents, relation);
+  }
+}
+var baseRepository_default = BaseRepository;
+// ../../src/core/database/table.ts
+function defineTable(definition) {
+  return definition;
+}
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/bootstrap/config.ts
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return activeContext;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+
+// ../../src/core/mail/mailer.ts
+function resolveSmtpConfig() {
+  const host = process.env.MAIL_HOST?.trim();
+  if (!host) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_HOST to be set.');
+  }
+  const from = process.env.MAIL_FROM?.trim();
+  if (!from) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
+  }
+  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
+  }
+  return {
+    host,
+    port,
+    from,
+    secure: (process.env.MAIL_SECURE ?? "false") === "true",
+    ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
+    ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
+  };
+}
+function encodeBase64(value) {
+  return Buffer.from(value, "utf8").toString("base64");
+}
+function parseSmtpResponses(buffer) {
+  const responses = [];
+  let remainder = buffer;
+  while (remainder.includes(`\r
+`)) {
+    const index = remainder.indexOf(`\r
+`);
+    const line = remainder.slice(0, index);
+    remainder = remainder.slice(index + 2);
+    if (line.length >= 4 && line[3] === "-") {
+      continue;
+    }
+    responses.push(line);
+  }
+  return { responses, remainder };
+}
+async function waitForSmtpResponse(readResponse, expectedCodes) {
+  const response = await readResponse();
+  const code = response.slice(0, 3);
+  if (!expectedCodes.includes(code)) {
+    throw new Error(`Unexpected SMTP response: ${response}`);
+  }
+  return response;
+}
+async function openSmtpConnection(config) {
+  let buffer = "";
+  const waiters = [];
+  const readResponse = () => new Promise((resolve, reject) => {
+    const parsed = parseSmtpResponses(buffer);
+    if (parsed.responses.length > 0) {
+      buffer = parsed.remainder;
+      resolve(parsed.responses.shift());
+      return;
+    }
+    waiters.push({ resolve, reject });
+  });
+  const socket = await Bun.connect({
+    hostname: config.host,
+    port: config.port,
+    socket: {
+      open() {},
+      data(_socket, chunk) {
+        buffer += Buffer.from(chunk).toString("utf8");
+        const parsed = parseSmtpResponses(buffer);
+        buffer = parsed.remainder;
+        while (parsed.responses.length > 0 && waiters.length > 0) {
+          const response = parsed.responses.shift();
+          waiters.shift()?.resolve(response);
+        }
+      },
+      error(_socket, error) {
+        const pending = waiters.splice(0);
+        for (const waiter of pending) {
+          waiter.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+      }
+    }
+  });
+  return { socket, readResponse };
+}
+async function defaultSmtpTransport(config, message) {
+  const { socket, readResponse } = await openSmtpConnection(config);
+  try {
+    await waitForSmtpResponse(readResponse, ["220"]);
+    await socket.write(`EHLO workhub.local\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    if (config.username && config.password) {
+      await socket.write(`AUTH LOGIN\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.username)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.password)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["235"]);
+    }
+    await socket.write(`MAIL FROM:<${config.from}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`RCPT TO:<${message.to}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250", "251"]);
+    await socket.write(`DATA\r
+`);
+    await waitForSmtpResponse(readResponse, ["354"]);
+    const payload = [
+      `From: ${config.from}`,
+      `To: ${message.to}`,
+      `Subject: ${message.subject}`,
+      "MIME-Version: 1.0",
+      "Content-Type: text/plain; charset=utf-8",
+      "",
+      message.body,
+      ".",
+      ""
+    ].join(`\r
+`);
+    await socket.write(payload);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`QUIT\r
+`);
+    await waitForSmtpResponse(readResponse, ["221"]);
+  } finally {
+    socket.end();
+  }
+}
+
+class LogMailDriver {
+  async send(message) {
+    console.log(JSON.stringify({
+      level: "info",
+      channel: "mail",
+      to: message.to,
+      subject: message.subject,
+      body: message.body
+    }));
+  }
+}
+
+class SmtpMailDriver {
+  config;
+  transport;
+  constructor(config, transport = defaultSmtpTransport) {
+    this.config = config;
+    this.transport = transport;
+  }
+  send(message) {
+    return this.transport(this.config, message);
+  }
+}
+
+class Mailer {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  send(message) {
+    return this.driver.send(message);
+  }
+}
+function createMailDriver() {
+  const driver = process.env.MAIL_DRIVER ?? "log";
+  if (driver === "smtp") {
+    return new SmtpMailDriver(resolveSmtpConfig());
+  }
+  return new LogMailDriver;
+}
+var appMailer = new Mailer(createMailDriver());
+function mailer() {
+  return appMailer;
+}
+
+// ../../src/core/storage/storage.ts
+var {S3Client } = globalThis.Bun;
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolvePath(path) {
+    return join(this.rootDirectory, path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
+}
+var defaultStorage = new StorageManager(createStorageDriver());
+function storage() {
+  return defaultStorage;
+}
+
+// ../../src/core/facades/index.ts
+function cache() {
+  return resolveApplicationCache();
+}
+function auth() {
+  return resolveApplicationAuth();
+}
+function policyGate() {
+  return resolveApplicationPolicyGate();
+}
+function queue() {
+  return resolveApplicationQueue();
+}
+function events() {
+  return eventBus;
+}
+function config(key) {
+  return resolveApplicationConfig().get(key);
+}
+function log() {
+  return resolveApplicationLogger();
+}
+function mail() {
+  return mailer();
+}
+function storageFacade() {
+  return storage();
+}
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/core/view/etaViewEngine.ts
+import { join as join2 } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join2(process.cwd(), "resources/views");
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+// ../../src/modules/user/apiTokenTable.ts
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/password.ts
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
+  }
+  return decryptField(stored, key);
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage3;
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
+  }
+  return parsed;
+}
+
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2 } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
+  }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
+}
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
+  }
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage4;
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationTable.ts
+var notificationTable = defineTable({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+var oauthIdentityTable = defineTable({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/table.ts
+var userTable = defineTable({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_TTL_MS = 60 * 60 * 1000;
+
+// ../../src/core/http/flashSession.ts
+var FLASH_TTL_MS = 60 * 1000;
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
+}
+
+// ../../src/core/http/webErrorResponse.ts
+function normalizeFieldErrors(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return {};
+  }
+  const errors = {};
+  for (const [field, messages] of Object.entries(details)) {
+    if (Array.isArray(messages)) {
+      errors[field] = messages.map(String);
+      continue;
+    }
+    if (typeof messages === "string") {
+      errors[field] = [messages];
+    }
+  }
+  return errors;
+}
+function webErrorResponse(error, request) {
+  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
+    return null;
+  }
+  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
+  if (mappedError instanceof UnauthorizedError) {
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+  }
+  if (mappedError instanceof ValidationError) {
+    const errors = normalizeFieldErrors(mappedError.details);
+    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
+`);
+    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
+  }
+  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
+    status: mappedError.status
+  });
+}
+// ../../src/core/http/etag.ts
+import { createHash } from "crypto";
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+// ../../src/core/http/validation.ts
+function getQueryParams(request) {
+  if (!request) {
+    return new URLSearchParams;
+  }
+  return new URL(request.url).searchParams;
+}
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/formRequest.ts
+class FormRequest {
+  authorize(_request) {
+    return true;
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    return await parseJsonBody(request, (payload) => this.parse(payload));
+  }
+}
+// ../../src/core/http/pagination.ts
+var DEFAULT_PER_PAGE = 15;
+var MAX_PER_PAGE = 100;
+function parseRequiredPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  return parsed;
+}
+function parsePaginationQuery(request) {
+  const params = getQueryParams(request);
+  const pageParam = params.get("page");
+  const perPageParam = params.get("per_page");
+  const page = pageParam === null || pageParam.trim() === "" ? 1 : parseRequiredPositiveIntQueryParam(params, "page");
+  if (perPageParam === null || perPageParam.trim() === "") {
+    return { page, perPage: DEFAULT_PER_PAGE };
+  }
+  const perPage = parseRequiredPositiveIntQueryParam(params, "per_page");
+  if (perPage > MAX_PER_PAGE) {
+    throw new BadRequestError(`Invalid query parameter "per_page". Maximum allowed value is ${MAX_PER_PAGE}.`);
+  }
+  return { page, perPage };
+}
+function paginatedResponse(data, meta, init = {}) {
+  return Response.json({ data, meta }, init);
+}
+// ../../src/core/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth2 = resolveApplicationAuth();
+    gate.authorize(authorization.resource, authorization.action, await auth2.resolve(request), model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+// ../../src/config/uploads.ts
+var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var ALLOWED_UPLOAD_MIME_TYPES = new Set([
+  "application/pdf",
+  "application/json",
+  "application/zip",
+  "application/x-zip-compressed",
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "text/plain",
+  "text/csv"
+]);
+
+// ../../src/core/http/index.ts
+function jsonResponse(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
+  });
+}
+function createdResponse(data, init = {}) {
+  return jsonResponse(data, { ...init, status: init.status ?? 201 });
+}
+function noContentResponse() {
+  return new Response(null, { status: 204 });
+}
+function errorResponse(error) {
+  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
+  return Response.json({
+    error: mappedError.message,
+    ...mappedError.details === undefined ? {} : { details: mappedError.details }
+  }, { status: mappedError.status });
+}
+function withErrorHandling(handler) {
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (error) {
+      const request = args.find((arg) => arg instanceof Request);
+      const webResponse = webErrorResponse(error, request);
+      if (webResponse) {
+        return webResponse;
+      }
+      return errorResponse(error);
+    }
+  };
+}
+// ../../src/core/metrics/prometheus.ts
+class PrometheusRegistry {
+  httpRequestsTotal = new Map;
+  httpRequestDurationMs = new Map;
+  incrementHttpRequest(labels) {
+    const key = this.metricKey(labels);
+    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
+  }
+  observeHttpDuration(labels, durationMs) {
+    const key = this.metricKey(labels);
+    const samples = this.httpRequestDurationMs.get(key) ?? [];
+    samples.push(durationMs);
+    this.httpRequestDurationMs.set(key, samples);
+  }
+  renderMetrics() {
+    const lines = [
+      "# HELP http_requests_total Total HTTP requests processed.",
+      "# TYPE http_requests_total counter"
+    ];
+    for (const [key, value] of this.httpRequestsTotal) {
+      lines.push(`http_requests_total{${key}} ${value}`);
+    }
+    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
+    for (const [key, samples] of this.httpRequestDurationMs) {
+      const sum = samples.reduce((total, sample) => total + sample, 0);
+      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    }
+    return `${lines.join(`
+`)}
+`;
+  }
+  resetForTests() {
+    this.httpRequestsTotal.clear();
+    this.httpRequestDurationMs.clear();
+  }
+  getHttpRequestSummary() {
+    const byStatus = {};
+    const pathCounts = new Map;
+    let totalRequests = 0;
+    for (const [key, count] of this.httpRequestsTotal) {
+      totalRequests += count;
+      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
+      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
+      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      byStatus[status] = (byStatus[status] ?? 0) + count;
+      const pathKey = `${method} ${path}`;
+      const existing = pathCounts.get(pathKey);
+      if (existing) {
+        existing.count += count;
+      } else {
+        pathCounts.set(pathKey, { method, path, count });
+      }
+    }
+    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
+    return {
+      totalRequests,
+      byStatus,
+      topPaths
+    };
+  }
+  metricKey(labels) {
+    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+  }
+}
+var prometheusRegistry = new PrometheusRegistry;
+
+// ../../src/core/http/metricsMiddleware.ts
+function normalizeMetricPath(pathname) {
+  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
+}
+function createMetricsMiddleware() {
+  return async (request, next) => {
+    const startedAt = performance.now();
+    const response = await next();
+    const durationMs = performance.now() - startedAt;
+    const path = normalizeMetricPath(new URL(request.url).pathname);
+    const labels = {
+      method: request.method,
+      path,
+      status: String(response.status)
+    };
+    prometheusRegistry.incrementHttpRequest(labels);
+    prometheusRegistry.observeHttpDuration(labels, durationMs);
+    return response;
+  };
+}
+// ../../src/core/http/parseFormBody.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected a form submission.");
+  }
+  return formDataToRecord(await request.formData());
+}
+function formDataToRecord(formData) {
+  const values = {};
+  for (const [key, value] of formData.entries()) {
+    if (typeof value === "string") {
+      values[key] = value;
+    }
+  }
+  return values;
+}
+
+// ../../src/core/http/webFormRequest.ts
+class WebFormRequest {
+  authorize(_request) {
+    return true;
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    const payload = requestPrefersJson(request) ? await parseJsonBody(request, (body) => body) : await parseFormBody(request);
+    try {
+      return this.parse(payload);
+    } catch (error) {
+      if (error instanceof ValidationError) {
+        throw error;
+      }
+      throw error;
+    }
+  }
+}
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
+  }
+}
+
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
+}
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
+}
+export {
+  withErrorHandling,
+  storageFacade as storage,
+  securedBindRouteModel,
+  runWithAuthUser,
+  resolveService,
+  queue,
+  prometheusRegistry,
+  policyGate,
+  parsePaginationQuery,
+  paginatedResponse,
+  normalizeMetricPath,
+  noContentResponse,
+  mailer,
+  mail,
+  log,
+  jsonResponse,
+  isEtagEnabled,
+  events,
+  etagFromResource,
+  defineTable,
+  currentAuthUser,
+  createdResponse,
+  createQueue,
+  createMetricsMiddleware,
+  config,
+  cache,
+  auth,
+  assertIfMatch,
+  WebFormRequest,
+  ValidationError,
+  UnprocessableEntityError,
+  UnauthorizedError,
+  SyncQueue,
+  StorageManager,
+  ServiceContainer,
+  PrometheusRegistry,
+  PreconditionFailedError,
+  Policy,
+  NotFoundError,
+  Mailer,
+  LogMailDriver,
+  LocalStorageDriver,
+  Job,
+  FormRequest,
+  ForbiddenError,
+  EventBus,
+  ConflictError,
+  ConfigStore,
+  repository_default as CacheRepository,
+  CACHE_TAGS,
+  baseRepository_default as BaseRepository,
+  BadRequestError,
+  AsyncQueue
+};