@getstrata/core 0.3.9 → 0.5.0

package/dist/index.js

@@ -135,6 +135,13 @@ class UnauthorizedError extends HttpError {
     super(401, message, details);
   }
 }
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
 class PreconditionFailedError extends HttpError {
   constructor(message = "Precondition Failed", details) {
     super(412, message, details);
@@ -157,6 +164,15 @@ class Policy {
     return false;
   }
 }
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
 
 class PolicyGate {
   constructor() {}
@@ -169,6 +185,9 @@ class PolicyGate {
     if (!policy) {
       return false;
     }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
     const handler = policy[action];
     if (typeof handler !== "function") {
       return false;
@@ -248,76 +267,6 @@ var CACHE_TAGS = {
   attachments: "attachments",
   reports: "reports"
 };
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var activeConnection = new AsyncLocalStorage2;
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-function resetDatabaseConnectionForTests(connection) {
-  connectionHolder.connection = connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
 // ../../src/core/events/eventBus.ts
 class EventBus {
   constructor() {}
@@ -428,6 +377,23 @@ function quoteIdentifier(identifier) {
 function qualifyColumn(tableName, column) {
   return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
 }
+function resolveQualifiedColumn(defaultTable, columnName) {
+  if (columnName.includes(".")) {
+    const [table, column] = columnName.split(".", 2);
+    if (!table || !column) {
+      throw new Error(`Invalid qualified column: ${columnName}`);
+    }
+    return qualifyColumn(table, column);
+  }
+  return qualifyColumn(defaultTable, columnName);
+}
+function parseQualifiedColumn(reference) {
+  const [table, column] = reference.split(".", 2);
+  if (!table || !column) {
+    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
+  }
+  return { table, column };
+}
 function normalizeDirection(direction = "ASC") {
   return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
 }
@@ -475,16 +441,21 @@ function buildOperatorClauses(column, operator, params) {
   if (operator.lte !== undefined) {
     clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
   }
+  if (operator.ilike !== undefined) {
+    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
+  }
+  if (operator.tsMatch !== undefined) {
+    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
+  }
   return clauses;
 }
-function buildWhereClause(tableName, where = {}) {
+function appendWhereParts(tableName, where, params) {
   const clauses = [];
-  const params = [];
   for (const [columnName, filterValue] of Object.entries(where)) {
     if (filterValue === undefined) {
       continue;
     }
-    const column = qualifyColumn(tableName, columnName);
+    const column = resolveQualifiedColumn(tableName, columnName);
     if (Array.isArray(filterValue)) {
       clauses.push(buildInClause(column, filterValue, params));
       continue;
@@ -499,8 +470,54 @@ function buildWhereClause(tableName, where = {}) {
     }
     clauses.push(`${column} = ${pushParam(params, filterValue)}`);
   }
+  return clauses.join(" AND ");
+}
+function buildWhereClause(tableName, where = {}) {
+  const params = [];
+  const body = appendWhereParts(tableName, where, params);
+  return {
+    clause: body.length > 0 ? ` WHERE ${body}` : "",
+    params
+  };
+}
+function buildWhereNodeClause(tableName, node, params) {
+  if ("where" in node) {
+    return appendWhereParts(tableName, node.where, params);
+  }
+  const grouped = buildWhereGroupClause(tableName, node.group, params);
+  if (!grouped) {
+    return "";
+  }
+  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
+}
+function buildWhereGroupClause(tableName, nodes, params) {
+  let result = "";
+  for (const node of nodes) {
+    const part = buildWhereNodeClause(tableName, node, params);
+    if (!part) {
+      continue;
+    }
+    if (!result) {
+      result = part;
+      continue;
+    }
+    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
+  }
+  if (!result) {
+    return "";
+  }
+  return result;
+}
+function buildAdvancedWhereClause(tableName, where = {}, whereNodes = []) {
+  const params = [];
+  const nodes = [];
+  if (Object.keys(where).length > 0) {
+    nodes.push({ kind: "and", where });
+  }
+  nodes.push(...whereNodes);
+  const combined = buildWhereGroupClause(tableName, nodes, params);
   return {
-    clause: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "",
+    clause: combined ? ` WHERE ${combined}` : "",
     params
   };
 }
@@ -527,12 +544,17 @@ function appendSoftDeleteScope(table, options, clauses) {
     clauses.push(`${qualifiedColumn} IS NULL`);
   }
 }
-function buildQueryWhereClause(table, options = {}) {
-  const { clause, params } = buildWhereClause(table.name, options.where ?? {});
-  const clauses = clause.length > 0 ? clause.replace(/^ WHERE /, "").split(" AND ") : [];
-  appendSoftDeleteScope(table, options, clauses);
+function buildQueryWhereClause(table, options = {}, whereNodes = []) {
+  const { clause, params } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes);
+  const softDeleteClauses = [];
+  appendSoftDeleteScope(table, options, softDeleteClauses);
+  if (softDeleteClauses.length === 0) {
+    return { clause, params };
+  }
+  const base = clause.replace(/^ WHERE /, "");
+  const scope = softDeleteClauses.join(" AND ");
   return {
-    clause: clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "",
+    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
     params
   };
 }
@@ -556,10 +578,32 @@ function normalizeOrderBy(orderBy) {
 }
 function buildOrderByClause(tableName, orderBy) {
   const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
-    return `${qualifyColumn(tableName, column)} ${normalizeDirection(direction)}`;
+    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
   });
   return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
 }
+function buildGroupByClause(tableName, groupBy) {
+  if (!groupBy) {
+    return "";
+  }
+  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
+  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
+  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
+}
+function buildHavingClause(tableName, having, params) {
+  if (!having) {
+    return "";
+  }
+  const body = appendWhereParts(tableName, having, params);
+  return body.length > 0 ? ` HAVING ${body}` : "";
+}
+function buildJoinClause(joins = []) {
+  return joins.map((join) => {
+    const joinType = join.type === "left" ? "LEFT JOIN" : "INNER JOIN";
+    const onClause = join.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
+    return ` ${joinType} ${quoteIdentifier(join.table)} ON ${onClause}`;
+  }).join("");
+}
 function buildLimitClause(limit) {
   if (limit === undefined) {
     return "";
@@ -581,6 +625,23 @@ function buildOffsetClause(offset) {
 function buildReturningColumns(table) {
   return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
 }
+function buildSelectList(table, select, params = []) {
+  if (!select || select.length === 0) {
+    return buildReturningColumns(table);
+  }
+  return select.map((item) => {
+    if (item.kind === "column") {
+      const column2 = qualifyColumn(item.table, item.column);
+      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+    }
+    if (item.kind === "literalText") {
+      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+    }
+    const column = qualifyColumn(item.table, item.column);
+    const placeholder = pushParam(params, item.query);
+    return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
+  }).join(", ");
+}
 function getDefinedColumnEntries(table, values, options = {}) {
   const record = values;
   const excluded = new Set(options.exclude ?? []);
@@ -595,36 +656,57 @@ function getDefinedColumnEntries(table, values, options = {}) {
     return [[column, value]];
   });
 }
-function buildSelectQuery(table, options = {}) {
-  const columns = buildReturningColumns(table);
-  const { clause, params } = buildQueryWhereClause(table, options);
+function buildSelectQuery(table, options = {}, whereNodes = []) {
+  const params = [];
+  const columns = buildSelectList(table, options.select, params);
+  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  const havingClause = buildHavingClause(table.name, options.having, params);
   const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
   const limit = buildLimitClause(options.limit);
   const offset = buildOffsetClause(options.offset);
   return {
-    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${clause}${orderBy}${limit}${offset}`,
+    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${havingClause}${orderBy}${limit}${offset}`,
     params
   };
 }
-function buildCountQuery(table, where = {}, options = {}) {
-  const { clause, params } = buildQueryWhereClause(table, {
+function buildCountQuery(table, where = {}, options = {}, whereNodes = []) {
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, {
     where,
-    ...options
-  });
+    withTrashed: options.withTrashed,
+    onlyTrashed: options.onlyTrashed
+  }, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
   return {
-    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${clause}`,
+    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}`,
     params
   };
 }
-function buildProjectionQuery(table, expression, alias, options = {}) {
-  const { clause, params } = buildQueryWhereClause(table, options);
+function buildProjectionQuery(table, expression, alias, options = {}, whereNodes = []) {
+  assertSafeProjectionExpression(expression);
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
   const orderBy = buildOrderByClause(table.name, options.orderBy);
   const limit = buildLimitClause(options.limit);
   return {
-    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${clause}${orderBy}${limit}`,
+    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${orderBy}${limit}`,
     params
   };
 }
+var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
+function assertSafeProjectionExpression(expression) {
+  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
+    throw new Error(`Unsafe projection expression: ${expression}`);
+  }
+}
 function buildGroupedCountQuery(table, column, where = {}, options = {}) {
   const qualifiedColumn = qualifyColumn(table.name, column);
   const { clause, params } = buildQueryWhereClause(table, {
@@ -708,12 +790,24 @@ function hasMany(definition) {
     ...definition
   };
 }
+function hasOne(definition) {
+  return {
+    type: "hasOne",
+    ...definition
+  };
+}
 function belongsTo(definition) {
   return {
     type: "belongsTo",
     ...definition
   };
 }
+function belongsToMany(definition) {
+  return {
+    type: "belongsToMany",
+    ...definition
+  };
+}
 function indexHasManyRelation(parents, children, relation) {
   const groups = new Map;
   for (const parent of parents) {
@@ -729,6 +823,15 @@ function indexHasManyRelation(parents, children, relation) {
   }
   return groups;
 }
+function indexHasOneRelation(parents, children, relation) {
+  const grouped = indexHasManyRelation(parents, children, relation);
+  const result = new Map;
+  for (const parent of parents) {
+    const matches = grouped.get(parent[relation.localKey]) ?? [];
+    result.set(parent[relation.localKey], matches[0]);
+  }
+  return result;
+}
 function indexBelongsToRelation(children, parents, relation) {
   const parentsById = new Map;
   for (const parent of parents) {
@@ -744,6 +847,149 @@ function indexBelongsToRelation(children, parents, relation) {
   }
   return result;
 }
+function indexBelongsToManyRelation(parents, pivotRows, relatedRows, relation) {
+  const relatedById = new Map;
+  for (const related of relatedRows) {
+    relatedById.set(related[relation.relatedKey], related);
+  }
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.parentKey], []);
+  }
+  for (const pivot of pivotRows) {
+    const parentId = pivot[relation.foreignPivotKey];
+    const relatedId = pivot[relation.relatedPivotKey];
+    const group = groups.get(parentId);
+    const related = relatedById.get(relatedId);
+    if (!group || !related) {
+      continue;
+    }
+    group.push(related);
+  }
+  return groups;
+}
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function bindDatabaseConnection(connection) {
+  boundConnectionHolder.connection = connection;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? connection_default;
+}
+var repositoryConnection = new Proxy({}, {
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/database/whereBuilder.ts
+class WhereBuilder {
+  nodes = [];
+  where(where) {
+    this.nodes.push({ kind: "and", where });
+    return this;
+  }
+  orWhere(where) {
+    this.nodes.push({ kind: "or", where });
+    return this;
+  }
+  whereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "and", group: nested.nodes });
+    }
+    return this;
+  }
+  orWhereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "or", group: nested.nodes });
+    }
+    return this;
+  }
+}
 
 // ../../src/core/database/repositoryQuery.ts
 class RepositoryQuery {
@@ -751,13 +997,32 @@ class RepositoryQuery {
   whereClause;
   queryOptions;
   eagerLoads = [];
+  whereNodes = [];
   constructor(repository, whereClause = {}, queryOptions = {}) {
     this.repository = repository;
     this.whereClause = whereClause;
     this.queryOptions = queryOptions;
   }
-  where(where) {
-    this.whereClause = { ...this.whereClause, ...where };
+  where(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      this.whereNodes.push(...builder.nodes);
+      return this;
+    }
+    this.whereClause = { ...this.whereClause, ...input };
+    return this;
+  }
+  orWhere(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      if (builder.nodes.length > 0) {
+        this.whereNodes.push({ kind: "or", group: builder.nodes });
+      }
+      return this;
+    }
+    this.whereNodes.push({ kind: "or", where: input });
     return this;
   }
   orderBy(orderBy) {
@@ -768,6 +1033,24 @@ class RepositoryQuery {
     this.queryOptions = { ...this.queryOptions, limit };
     return this;
   }
+  offset(offset) {
+    this.queryOptions = { ...this.queryOptions, offset };
+    return this;
+  }
+  join(left, right) {
+    return this.addJoin("inner", left, right);
+  }
+  leftJoin(left, right) {
+    return this.addJoin("left", left, right);
+  }
+  groupBy(groupBy) {
+    this.queryOptions = { ...this.queryOptions, groupBy };
+    return this;
+  }
+  having(having) {
+    this.queryOptions = { ...this.queryOptions, having };
+    return this;
+  }
   withHasMany(as, relation, childRepository, options = {}) {
     this.eagerLoads.push({
       kind: "hasMany",
@@ -789,16 +1072,50 @@ class RepositoryQuery {
     return this;
   }
   async get() {
-    const rows = await this.repository.findAll({
-      ...this.queryOptions,
-      where: this.whereClause
-    });
+    const rows = await this.repository.findAll(this.buildOptions());
     return await this.attach(rows);
   }
   async first() {
     const rows = await this.get();
     return rows[0] ?? null;
   }
+  async paginate(options) {
+    return await this.repository.paginate({
+      ...this.buildOptions(),
+      page: options.page,
+      perPage: options.perPage
+    });
+  }
+  buildOptions() {
+    return {
+      ...this.queryOptions,
+      where: this.whereClause,
+      whereNodes: this.whereNodes
+    };
+  }
+  addJoin(type, left, right) {
+    const leftRef = parseQualifiedColumn(left);
+    const rightRef = parseQualifiedColumn(right);
+    const table = type === "inner" ? rightRef.table : rightRef.table;
+    const joins = this.queryOptions.joins ?? [];
+    const existing = joins.find((join) => join.table === table && join.type === type);
+    if (existing) {
+      existing.on.push({ left: leftRef, right: rightRef });
+      return this;
+    }
+    this.queryOptions = {
+      ...this.queryOptions,
+      joins: [
+        ...joins,
+        {
+          type,
+          table,
+          on: [{ left: leftRef, right: rightRef }]
+        }
+      ]
+    };
+    return this;
+  }
   async attach(rows) {
     if (rows.length === 0 || this.eagerLoads.length === 0) {
       return rows.map((row) => ({ ...row }));
@@ -829,27 +1146,30 @@ class RepositoryQuery {
 class BaseRepository {
   table;
   connection;
-  constructor(table, connection = connection_default) {
+  constructor(table, connection = repositoryConnection) {
     this.table = table;
     this.connection = connection;
   }
   async findAll(options = {}) {
     return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildSelectQuery(this.table, options);
+      const { whereNodes, ...queryOptions } = options;
+      const { text, params } = buildSelectQuery(this.table, queryOptions, whereNodes ?? []);
       return await this.connection.unsafe(text, params);
     });
   }
   async paginate(options) {
-    const where = options.where ?? {};
+    const { whereNodes, where = {}, page, perPage, ...queryOptions } = options;
     const total = await this.countWhere(where, {
       withTrashed: options.withTrashed,
-      onlyTrashed: options.onlyTrashed
-    });
-    const offset = (options.page - 1) * options.perPage;
-    const { page, perPage, ...queryOptions } = options;
+      onlyTrashed: options.onlyTrashed,
+      joins: options.joins,
+      groupBy: options.groupBy
+    }, whereNodes);
+    const offset = (page - 1) * perPage;
     const data = await this.findAll({
       ...queryOptions,
       where,
+      whereNodes,
       limit: perPage,
       offset
     });
@@ -858,6 +1178,65 @@ class BaseRepository {
       meta: buildPaginationMeta({ page, perPage, total })
     };
   }
+  async chunk(count, callback, options = {}) {
+    if (!Number.isInteger(count) || count <= 0) {
+      throw new Error("Chunk size must be a positive integer.");
+    }
+    let offset = 0;
+    while (true) {
+      const rows = await this.findAll({
+        ...options,
+        limit: count,
+        offset
+      });
+      if (rows.length === 0) {
+        return;
+      }
+      const shouldContinue = await callback(rows);
+      if (shouldContinue === false || rows.length < count) {
+        return;
+      }
+      offset += count;
+    }
+  }
+  async cursorPaginate(options) {
+    const {
+      perPage,
+      cursor,
+      cursorColumn = this.table.primaryKey,
+      direction = "asc",
+      where = {},
+      whereNodes,
+      ...queryOptions
+    } = options;
+    if (!Number.isInteger(perPage) || perPage <= 0) {
+      throw new Error("Cursor page size must be a positive integer.");
+    }
+    const cursorWhere = { ...where };
+    if (cursor !== undefined) {
+      cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
+    }
+    const rows = await this.findAll({
+      ...queryOptions,
+      where: cursorWhere,
+      whereNodes,
+      orderBy: { [cursorColumn]: direction },
+      limit: perPage + 1
+    });
+    const hasMore = rows.length > perPage;
+    const data = hasMore ? rows.slice(0, perPage) : rows;
+    const nextCursor = hasMore ? data[data.length - 1]?.[cursorColumn] ?? null : null;
+    const prevCursor = cursor ?? null;
+    return {
+      data,
+      meta: {
+        per_page: perPage,
+        next_cursor: nextCursor,
+        prev_cursor: prevCursor,
+        has_more: hasMore
+      }
+    };
+  }
   async findById(id) {
     return await this.firstOrNull({
       [this.table.primaryKey]: id
@@ -964,14 +1343,17 @@ class BaseRepository {
   getConnection() {
     return this.connection;
   }
+  getTable() {
+    return this.table;
+  }
   query(where = {}) {
     return new RepositoryQuery(this, where);
   }
   async findWhere(where, options = {}) {
     return await this.findAll({ ...options, where });
   }
-  async countWhere(where = {}, options = {}) {
-    const { text, params } = buildCountQuery(this.table, where, options);
+  async countWhere(where = {}, options = {}, whereNodes = []) {
+    const { text, params } = buildCountQuery(this.table, where, options, whereNodes);
     const [row] = await this.connection.unsafe(text, params);
     return Number(row?.count ?? 0);
   }
@@ -1028,8 +1410,18 @@ class BaseRepository {
 }
 var baseRepository_default = BaseRepository;
 // ../../src/core/database/bindConnection.ts
-function bindDatabaseConnection(connection) {
-  resetDatabaseConnectionForTests(connection);
+function bindDatabaseConnection2(connection) {
+  bindDatabaseConnection(connection);
+}
+// ../../src/core/database/migrations/advisoryLock.ts
+var MIGRATION_LOCK_KEY = 42424242;
+async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
+  await db2.unsafe("SELECT pg_advisory_lock($1)", [lockKey]);
+  try {
+    return await callback();
+  } finally {
+    await db2.unsafe("SELECT pg_advisory_unlock($1)", [lockKey]);
+  }
 }
 // ../../src/core/database/migrations/runner.ts
 import { readdir } from "fs/promises";
@@ -1055,7 +1447,7 @@ async function getAppliedMigrations(db2) {
 }
 async function loadMigrationsFromDirectory(directory) {
   const entries = await readdir(directory);
-  const migrationFiles = entries.filter((entry) => entry.endsWith(".ts") && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
   const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
     const moduleUrl = pathToFileURL(join(directory, fileName)).href;
     const module = await import(moduleUrl);
@@ -1072,7 +1464,7 @@ async function getMigrationStatus(db2, migrations) {
     batch: appliedByName.get(name) ?? null
   }));
 }
-async function migrateDatabase(db2, migrations, options = {}) {
+async function runPendingMigrations(db2, migrations, options = {}) {
   const applied = await getAppliedMigrations(db2);
   const appliedNames = new Set(applied.map(({ name }) => name));
   const nextBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0) + 1;
@@ -1080,10 +1472,20 @@ async function migrateDatabase(db2, migrations, options = {}) {
   for (const migration of pendingMigrations) {
     options.onMigration?.(migration.name);
     await migration.up(db2);
-    await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING`, [migration.name, nextBatch]);
+    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
+    if (inserted.length === 0) {
+      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
+    }
   }
   return pendingMigrations.length;
 }
+async function migrateDatabase(db2, migrations, options = {}) {
+  const { advisoryLock = false, onMigration } = options;
+  if (advisoryLock) {
+    return withMigrationLock(db2, () => runPendingMigrations(db2, migrations, { onMigration }));
+  }
+  return runPendingMigrations(db2, migrations, { onMigration });
+}
 async function rollbackDatabase(db2, migrations, options = {}) {
   const applied = await getAppliedMigrations(db2);
   if (applied.length === 0) {
@@ -1104,20 +1506,29 @@ async function rollbackDatabase(db2, migrations, options = {}) {
   return rolledBack;
 }
 async function freshDatabase(db2, migrations, options = {}) {
-  const applied = await getAppliedMigrations(db2);
-  const appliedNames = new Set(applied.map(({ name }) => name));
-  const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
-  for (const migration of [...appliedMigrations].reverse()) {
-    options.onMigration?.(migration.name);
-    await migration.down(db2);
-  }
-  if (appliedMigrations.length > 0) {
-    await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
+  const runFresh = async () => {
+    const applied = await getAppliedMigrations(db2);
+    const appliedNames = new Set(applied.map(({ name }) => name));
+    const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
+    for (const migration of [...appliedMigrations].reverse()) {
+      options.onMigration?.(migration.name);
+      await migration.down(db2);
+    }
+    if (appliedMigrations.length > 0) {
+      await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
+    }
+    await runPendingMigrations(db2, migrations, options);
+  };
+  if (options.advisoryLock) {
+    await withMigrationLock(db2, runFresh);
+    return;
   }
-  await migrateDatabase(db2, migrations, options);
+  await runFresh();
 }
 // ../../src/core/database/model.ts
 var modelRepositories = new WeakMap;
+var modelGlobalScopes = new WeakMap;
+var modelBooted = new WeakSet;
 function resolveModelRepository(model) {
   const repository = modelRepositories.get(model);
   if (!repository) {
@@ -1125,13 +1536,121 @@ function resolveModelRepository(model) {
   }
   return repository;
 }
+function modelStatics(model) {
+  return model;
+}
+function ensureBooted(model) {
+  if (modelBooted.has(model)) {
+    return;
+  }
+  modelBooted.add(model);
+  const boot = model.boot;
+  if (typeof boot === "function") {
+    boot.call(model);
+  }
+}
+function getGlobalScopes(model) {
+  return modelGlobalScopes.get(model) ?? [];
+}
+function hydrateValue(value, cast) {
+  if (value === null || value === undefined) {
+    return value;
+  }
+  switch (cast) {
+    case "date":
+    case "datetime":
+      return value instanceof Date ? value : new Date(String(value));
+    case "json":
+      return typeof value === "string" ? JSON.parse(value) : value;
+    case "bool":
+    case "boolean":
+      return value === true || value === 1 || value === "1" || value === "true";
+    default:
+      return value;
+  }
+}
+function dehydrateValue(value, cast) {
+  if (value === null || value === undefined) {
+    return value;
+  }
+  switch (cast) {
+    case "date":
+    case "datetime":
+      return value instanceof Date ? value : new Date(String(value));
+    case "json":
+      return typeof value === "string" ? value : JSON.stringify(value);
+    case "bool":
+    case "boolean":
+      return Boolean(value);
+    default:
+      return value;
+  }
+}
+function filterMassAssignable(fillable, guarded, input) {
+  const resolvedGuarded = guarded ?? true;
+  if (fillable && fillable.length > 0) {
+    const allowed = new Set(fillable);
+    return Object.fromEntries(Object.entries(input).filter(([key]) => allowed.has(key)));
+  }
+  if (resolvedGuarded === true || resolvedGuarded.includes("*")) {
+    return {};
+  }
+  const blocked = new Set(resolvedGuarded);
+  return Object.fromEntries(Object.entries(input).filter(([key]) => !blocked.has(key)));
+}
+function applyCasts(values, casts, direction) {
+  if (Object.keys(casts).length === 0) {
+    return values;
+  }
+  const result = { ...values };
+  const castFn = direction === "hydrate" ? hydrateValue : dehydrateValue;
+  for (const [key, cast] of Object.entries(casts)) {
+    if (key in result && cast) {
+      result[key] = castFn(result[key], cast);
+    }
+  }
+  return result;
+}
+function applyTimestampsOnCreate(columns, values, enabled) {
+  if (!enabled) {
+    return values;
+  }
+  const now = new Date;
+  const result = { ...values };
+  if (columns.includes("created_at")) {
+    result.created_at = now;
+  }
+  if (columns.includes("updated_at")) {
+    result.updated_at = now;
+  }
+  return result;
+}
+function applyTimestampsOnUpdate(columns, values, enabled) {
+  if (!enabled) {
+    return values;
+  }
+  const result = { ...values };
+  if (columns.includes("updated_at")) {
+    result.updated_at = new Date;
+  }
+  return result;
+}
 
 class Model {
   attributes;
   repository;
-  constructor(attributes, repository) {
+  static $fillable;
+  static $guarded;
+  static $casts = {};
+  static $timestamps = true;
+  _exists;
+  constructor(attributes, repository, exists = true) {
     this.attributes = attributes;
     this.repository = repository;
+    this._exists = exists;
+  }
+  get $exists() {
+    return this._exists;
   }
   get(key) {
     return this.attributes[key];
@@ -1145,43 +1664,169 @@ class Model {
   primaryKey() {
     throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
   }
+  static primaryKeyField() {
+    return resolveModelRepository(Model).getTable().primaryKey;
+  }
+  static hydrateAttributes(attributes) {
+    const casts = Model.$casts ?? {};
+    return applyCasts(attributes, casts, "hydrate");
+  }
+  static dehydrateAttributes(attributes) {
+    const casts = Model.$casts ?? {};
+    return applyCasts(attributes, casts, "dehydrate");
+  }
+  static fromRecord(record, repository, exists = true) {
+    const hydrated = Model.hydrateAttributes(record);
+    return new Model(hydrated, repository, exists);
+  }
+  static boot() {}
+  static addGlobalScope(_name, scope) {
+    ensureBooted(Model);
+    const existing = modelGlobalScopes.get(Model) ?? [];
+    modelGlobalScopes.set(Model, [
+      ...existing,
+      scope
+    ]);
+  }
   static repository() {
     return resolveModelRepository(this);
   }
   static query() {
-    return resolveModelRepository(this).query();
+    ensureBooted(this);
+    const repository = resolveModelRepository(Model);
+    let query = repository.query();
+    for (const scope of getGlobalScopes(Model)) {
+      query = scope(query);
+    }
+    return query;
+  }
+  static async create(attributes) {
+    const statics = modelStatics(this);
+    ensureBooted(Model);
+    const repository = resolveModelRepository(Model);
+    const table = repository.getTable();
+    const timestamps = statics.$timestamps ?? true;
+    const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
+    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
+    const payload = statics.dehydrateAttributes(withTimestamps);
+    const record = await repository.create(payload);
+    return statics.fromRecord(record, repository, true);
   }
   static async find(id) {
-    const repository = resolveModelRepository(this);
-    const record = await repository.findById(id);
-    return record ? new this(record, repository) : null;
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(Model);
+    const primaryKey = statics.primaryKeyField();
+    const record = await Model.query.call(Model).where({ [primaryKey]: id }).first();
+    return record ? statics.fromRecord(record, repository, true) : null;
   }
   static async findOrFail(id, errorFactory) {
-    const repository = resolveModelRepository(this);
-    const record = await repository.findByIdOrThrow(id, errorFactory ?? ((value) => new Error(`Record ${String(value)} not found.`)));
-    return new this(record, repository);
+    const model = await Model.find.call(Model, id);
+    if (model) {
+      return model;
+    }
+    throw errorFactory?.(id) ?? new NotFoundError(`${Model.name} ${String(id)} not found.`);
   }
   static async all(options = {}) {
-    const repository = resolveModelRepository(this);
-    const rows = await repository.findAll(options);
-    return rows.map((row) => new this(row, repository));
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model);
+    if (options.orderBy) {
+      query = query.orderBy(options.orderBy);
+    }
+    if (options.limit !== undefined) {
+      query = query.limit(options.limit);
+    }
+    const rows = await query.get();
+    return rows.map((row) => statics.fromRecord(row, repository, true));
   }
   static async firstWhere(where, options = {}) {
-    const repository = resolveModelRepository(this);
-    const rows = await repository.findAll({ ...options, where, limit: 1 });
-    const record = rows[0];
-    return record ? new this(record, repository) : null;
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(Model);
+    let query = Model.query.call(Model).where(where);
+    if (options.orderBy) {
+      query = query.orderBy(options.orderBy);
+    }
+    const record = await query.first();
+    return record ? statics.fromRecord(record, repository, true) : null;
+  }
+  async save() {
+    const ModelClass = modelStatics(this.constructor);
+    const timestamps = ModelClass.$timestamps ?? true;
+    const casts = ModelClass.$casts ?? {};
+    const table = this.repository.getTable();
+    if (this.$exists) {
+      const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
+      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
+      this.attributes = ModelClass.hydrateAttributes(record2);
+      return this;
+    }
+    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, this.attributes);
+    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
+    const payload = ModelClass.dehydrateAttributes(withTimestamps);
+    const record = await this.repository.create(payload);
+    this.attributes = ModelClass.hydrateAttributes(record);
+    this._exists = true;
+    return this;
+  }
+  async update(changes) {
+    const ModelClass = modelStatics(this.constructor);
+    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, changes);
+    Object.assign(this.attributes, assignable);
+    return await this.save();
+  }
+  async delete() {
+    if (resolveSoftDeleteColumn(this.repository.getTable())) {
+      return await this.repository.deleteById(this.id);
+    }
+    return await this.repository.forceDeleteById(this.id);
+  }
+  async forceDelete() {
+    return await this.repository.forceDeleteById(this.id);
+  }
+  async restore() {
+    const ModelClass = modelStatics(this.constructor);
+    const record = await this.repository.restoreById(this.id);
+    if (!record) {
+      return null;
+    }
+    this.attributes = ModelClass.hydrateAttributes(record);
+    return this;
   }
   async loadHasMany(as, relation, childRepository, options = {}) {
     const grouped = await childRepository.withConnection(this.repository.getConnection()).loadHasManyForParents([this.attributes], relation, options);
     const loaded = grouped.get(this.attributes[relation.localKey]) ?? [];
     return Object.assign(this, { [as]: loaded });
   }
+  async loadHasOne(as, relation, childRepository, options = {}) {
+    const loaded = await this.loadHasMany(as, relation, childRepository, { ...options, limit: 1 });
+    const value = loaded[as]?.[0];
+    return Object.assign(this, { [as]: value });
+  }
   async loadBelongsTo(as, relation, parentRepository, options = {}) {
     const grouped = await this.repository.loadBelongsToForParents([this.attributes], relation, parentRepository, options);
     const loaded = grouped.get(this.attributes[relation.foreignKey]);
     return Object.assign(this, { [as]: loaded });
   }
+  async loadBelongsToMany(as, relation, relatedRepository, options = {}) {
+    const connection = this.repository.getConnection();
+    const parentId = this.attributes[relation.parentKey];
+    const pivotRows = await connection.unsafe(`SELECT * FROM ${relation.pivotTable} WHERE ${String(relation.foreignPivotKey)} = $1`, [parentId]);
+    if (pivotRows.length === 0) {
+      return Object.assign(this, { [as]: [] });
+    }
+    const relatedIds = [
+      ...new Set(pivotRows.map((row) => row[relation.relatedPivotKey]))
+    ];
+    const relatedRows = await relatedRepository.withConnection(connection).findAll({
+      ...options,
+      where: {
+        [relation.relatedKey]: relatedIds
+      }
+    });
+    const grouped = indexBelongsToManyRelation([this.attributes], pivotRows, relatedRows, relation);
+    const loaded = grouped.get(parentId) ?? [];
+    return Object.assign(this, { [as]: loaded });
+  }
   mergeAttributes(patch) {
     Object.assign(this.attributes, patch);
     return this;
@@ -1189,12 +1834,676 @@ class Model {
 }
 function registerModelRepository(model, repository) {
   modelRepositories.set(model, repository);
+  ensureBooted(model);
   return model;
 }
+// ../../src/core/database/schema/columnDefinition.ts
+class ColumnDefinition {
+  name;
+  kind;
+  length;
+  isNullable = false;
+  isPrimary = false;
+  isUnique = false;
+  autoIncrement = false;
+  defaultValue;
+  checkExpression;
+  foreignKey;
+  constructor(name, kind) {
+    this.name = name;
+    this.kind = kind;
+  }
+  nullable() {
+    this.isNullable = true;
+    return this;
+  }
+  notNullable() {
+    this.isNullable = false;
+    return this;
+  }
+  default(value) {
+    if (typeof value === "boolean") {
+      this.defaultValue = value ? "TRUE" : "FALSE";
+      return this;
+    }
+    if (typeof value === "number") {
+      this.defaultValue = String(value);
+      return this;
+    }
+    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
+    return this;
+  }
+  defaultRaw(expression) {
+    this.defaultValue = expression;
+    return this;
+  }
+  unique() {
+    this.isUnique = true;
+    return this;
+  }
+  primary() {
+    this.isPrimary = true;
+    return this;
+  }
+  check(expression) {
+    this.checkExpression = expression;
+    return this;
+  }
+}
+
+class ForeignIdColumnDefinition extends ColumnDefinition {
+  constructor(name) {
+    super(name, "foreignId");
+    this.notNullable();
+  }
+  references(table, column = "id") {
+    this.foreignKey = {
+      referencesTable: table,
+      referencesColumn: column
+    };
+    return this;
+  }
+  constrained(table) {
+    const referencesTable = table ?? inferReferencedTable(this.name);
+    return this.references(referencesTable);
+  }
+  cascadeOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "cascade";
+    return this;
+  }
+  nullOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "set null";
+    return this;
+  }
+}
+function inferReferencedTable(columnName) {
+  if (!columnName.endsWith("_id")) {
+    throw new Error(`Cannot infer referenced table from column ${columnName}`);
+  }
+  return columnName.slice(0, -3);
+}
+
+// ../../src/core/database/schema/blueprint.ts
+class Blueprint {
+  table;
+  action;
+  columns = [];
+  indexes = [];
+  droppedColumns = [];
+  droppedIndexes = [];
+  constructor(table, action) {
+    this.table = table;
+    this.action = action;
+  }
+  id(name = "id") {
+    const column = new ColumnDefinition(name, "id");
+    column.primary();
+    column.autoIncrement = true;
+    this.columns.push(column);
+    return column;
+  }
+  string(name, length) {
+    const column = new ColumnDefinition(name, "string");
+    column.length = length;
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  text(name) {
+    const column = new ColumnDefinition(name, "text");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  boolean(name) {
+    const column = new ColumnDefinition(name, "boolean");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  integer(name) {
+    const column = new ColumnDefinition(name, "integer");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  bigInteger(name) {
+    const column = new ColumnDefinition(name, "bigInteger");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  timestamp(name) {
+    const column = new ColumnDefinition(name, "timestamp");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  json(name) {
+    const column = new ColumnDefinition(name, "json");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  jsonb(name) {
+    const column = new ColumnDefinition(name, "jsonb");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  foreignId(name) {
+    const column = new ForeignIdColumnDefinition(name);
+    this.columns.push(column);
+    return column;
+  }
+  timestamps() {
+    this.timestamp("created_at").defaultRaw("NOW()");
+    this.timestamp("updated_at").defaultRaw("NOW()");
+  }
+  softDeletes() {
+    this.timestamp("deleted_at").nullable();
+  }
+  dropColumn(name) {
+    this.droppedColumns.push(name);
+  }
+  dropSoftDeletes() {
+    this.dropColumn("deleted_at");
+    this.dropIndex(`idx_${this.table}_deleted_at`);
+  }
+  dropIndex(name) {
+    this.droppedIndexes.push(name);
+  }
+  unique(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "unique"
+    });
+  }
+  index(columns, options = {}) {
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "index",
+      order: options.order
+    });
+  }
+  partialIndex(columns, where, nameOrOptions) {
+    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: options.unique ? "uniquePartial" : "partial",
+      where
+    });
+  }
+  fullText(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "fullText"
+    });
+  }
+  ginIndex(column, name) {
+    this.indexes.push({
+      name,
+      columns: [column],
+      kind: "gin"
+    });
+  }
+}
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+// ../../src/core/database/schema/errors.ts
+class UnsupportedSchemaFeatureError extends Error {
+  constructor(feature, driver) {
+    super(`${feature} is not supported for the ${driver} driver`);
+    this.name = "UnsupportedSchemaFeatureError";
+  }
+}
+// ../../src/core/database/schema/grammars/grammar.ts
+function compileColumnType(driver, column) {
+  switch (column.kind) {
+    case "id":
+      return compileIdType(driver);
+    case "string":
+      return compileStringType(driver, column.length);
+    case "text":
+      return compileTextType(driver);
+    case "boolean":
+      return compileBooleanType(driver);
+    case "integer":
+    case "foreignId":
+      return compileIntegerType(driver);
+    case "bigInteger":
+      return compileBigIntegerType(driver);
+    case "timestamp":
+      return compileTimestampType(driver);
+    case "json":
+      return compileJsonType(driver);
+    case "jsonb":
+      return compileJsonbType(driver);
+    default:
+      throw new Error(`Unsupported column kind: ${column.kind}`);
+  }
+}
+function compileIdType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "SERIAL";
+    case "mysql":
+      return "BIGINT UNSIGNED";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileStringType(driver, length) {
+  switch (driver) {
+    case "pgsql":
+      return "TEXT";
+    case "mysql":
+      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileTextType(driver) {
+  switch (driver) {
+    case "pgsql":
+    case "sqlite":
+      return "TEXT";
+    case "mysql":
+      return "TEXT";
+  }
+}
+function compileBooleanType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BOOLEAN";
+    case "mysql":
+      return "BOOLEAN";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "INTEGER";
+    case "mysql":
+      return "INT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileBigIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BIGINT";
+    case "mysql":
+      return "BIGINT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileTimestampType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "TIMESTAMPTZ";
+    case "mysql":
+      return "TIMESTAMP";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonbType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+
+// ../../src/core/database/schema/grammars/compileStatements.ts
+function compileCreateTable(driver, blueprint) {
+  const table = quoteIdentifier(blueprint.table);
+  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length > 1) {
+      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+      parts.push(`UNIQUE (${columns})`);
+    }
+  }
+  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
+  ${parts.join(`,
+  `)}
+)`];
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length === 1) {
+      continue;
+    }
+    if (index.kind === "index") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileAlterTable(driver, blueprint) {
+  const statements = [];
+  const table = quoteIdentifier(blueprint.table);
+  for (const column of blueprint.columns) {
+    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
+    statements.push(`ALTER TABLE ${table}
+${addPrefix} ${compileColumn(driver, column, "alter")}`);
+  }
+  for (const columnName of blueprint.droppedColumns) {
+    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
+    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
+  }
+  for (const indexName of blueprint.droppedIndexes) {
+    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
+  }
+  for (const index of blueprint.indexes) {
+    if (index.kind === "index" || index.kind === "unique") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileDropTable(driver, tableName) {
+  const cascade = driver === "pgsql" ? " CASCADE" : "";
+  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
+}
+function compileColumn(driver, column, mode) {
+  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
+  if (column.autoIncrement && driver === "mysql") {
+    parts[1] = `${parts[1]} AUTO_INCREMENT`;
+  }
+  if (column.isPrimary && mode === "create") {
+    if (driver === "sqlite") {
+      parts.push("PRIMARY KEY AUTOINCREMENT");
+    } else {
+      parts.push("PRIMARY KEY");
+    }
+  } else if (!column.isNullable) {
+    parts.push("NOT NULL");
+  } else if (column.isNullable) {
+    parts.push("NULL");
+  }
+  if (column.defaultValue !== undefined) {
+    parts.push(`DEFAULT ${column.defaultValue}`);
+  }
+  if (column.isUnique) {
+    parts.push("UNIQUE");
+  }
+  if (column.checkExpression) {
+    parts.push(`CHECK (${column.checkExpression})`);
+  }
+  if (column.foreignKey) {
+    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
+    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
+    let clause = `REFERENCES ${reference}`;
+    if (onDelete === "cascade") {
+      clause += " ON DELETE CASCADE";
+    } else if (onDelete === "set null") {
+      clause += " ON DELETE SET NULL";
+    }
+    parts.push(clause);
+  }
+  return parts.join(" ");
+}
+function compileIndex(_driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
+  const columns = index.columns.map((column) => {
+    const quoted = quoteIdentifier(column);
+    if (index.order === "desc") {
+      return `${quoted} DESC`;
+    }
+    return quoted;
+  }).join(", ");
+  const unique = index.kind === "unique" ? "UNIQUE " : "";
+  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
+}
+function compileSpecialIndex(driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
+  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+  switch (index.kind) {
+    case "partial":
+    case "uniquePartial": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
+      }
+      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
+      return [
+        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
+      ];
+    }
+    case "gin": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
+      }
+      return [
+        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
+      ];
+    }
+    case "fullText": {
+      if (driver === "mysql") {
+        return [
+          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
+        ];
+      }
+      if (driver === "pgsql") {
+        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
+      }
+      throw new UnsupportedSchemaFeatureError("fullText()", driver);
+    }
+    default:
+      return [];
+  }
+}
+function defaultIndexName(tableName, columns, kind) {
+  return `idx_${tableName}_${columns.join("_")}_${kind}`;
+}
+function compileBlueprint(driver, blueprint) {
+  switch (blueprint.action) {
+    case "create":
+      return compileCreateTable(driver, blueprint);
+    case "alter":
+      return compileAlterTable(driver, blueprint);
+    case "drop":
+      return compileDropTable(driver, blueprint.table);
+    default:
+      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+  }
+}
+// ../../src/core/database/schema/grammars/createGrammar.ts
+function createGrammar(driver) {
+  return {
+    driver,
+    compile(blueprint) {
+      return compileBlueprint(driver, blueprint);
+    }
+  };
+}
+
+// ../../src/core/database/schema/grammars/mysqlGrammar.ts
+var MySqlGrammar = createGrammar("mysql");
+
+// ../../src/core/database/schema/grammars/postgresGrammar.ts
+var PostgresGrammar = createGrammar("pgsql");
+
+// ../../src/core/database/schema/grammars/sqliteGrammar.ts
+var SqliteGrammar = createGrammar("sqlite");
+
+// ../../src/core/database/schema/grammars/index.ts
+function grammarForDriver(driver) {
+  switch (driver) {
+    case "pgsql":
+      return PostgresGrammar;
+    case "mysql":
+      return MySqlGrammar;
+    case "sqlite":
+      return SqliteGrammar;
+    default:
+      throw new Error(`Unsupported database driver: ${driver}`);
+  }
+}
+// ../../src/core/database/schema/schema.ts
+class SchemaBuilder {
+  #driver;
+  #statements = [];
+  constructor(driver) {
+    this.#driver = driver;
+  }
+  create(table, callback) {
+    const blueprint = new Blueprint(table, "create");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  table(table, callback) {
+    const blueprint = new Blueprint(table, "alter");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  drop(table) {
+    const blueprint = new Blueprint(table, "drop");
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  toSql() {
+    return [...this.#statements];
+  }
+  async execute(db2) {
+    for (const statement of this.#statements) {
+      await db2.unsafe(statement);
+    }
+  }
+}
+
+class Schema {
+  static builder(driver) {
+    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
+  }
+  static async run(db2, driver, callback) {
+    const schema = Schema.builder(driver);
+    await callback(schema);
+    await schema.execute(db2);
+  }
+}
+function createSchemaBuilder(db2, driver) {
+  const builder = Schema.builder(driver);
+  return Object.assign(builder, {
+    async commit() {
+      await builder.execute(db2);
+    }
+  });
+}
+// ../../src/core/database/seeders/runner.ts
+import { readdir as readdir2 } from "fs/promises";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadSeedersFromDirectory(directory) {
+  const entries = await readdir2(directory);
+  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL2(join2(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
+}
+async function runSeedersFromDirectory(directory, db2, options) {
+  const seeders = await loadSeedersFromDirectory(directory);
+  if (seeders.length === 0) {
+    return 0;
+  }
+  for (const seeder of seeders) {
+    options?.onSeeder?.(seeder.name);
+    await seeder.run(db2);
+  }
+  return seeders.length;
+}
 // ../../src/core/database/table.ts
 function defineTable(definition) {
   return definition;
 }
+// ../../src/core/database/connection.ts
+function createDatabaseConnection2(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+
+// ../../src/core/database/transaction.ts
+async function runInTransaction(operation) {
+  return await connection_default.begin(async (transaction) => {
+    return await operation(createDatabaseConnection2(transaction));
+  });
+}
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -1235,6 +2544,8 @@ var appLogger = new Logger("app");
 var CORE_QUEUE_TOKEN = "core.queue";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var DEFAULT_QUEUE_DRIVER = "sync";
 
 // ../../src/bootstrap/applicationRegistry.ts
 var activeContext;
@@ -1262,6 +2573,9 @@ function resolveApplicationConfig() {
 function resolveApplicationLogger() {
   return appLogger;
 }
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
 
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
@@ -1446,7 +2760,7 @@ function mailer() {
 // ../../src/core/storage/storage.ts
 var {S3Client } = globalThis.Bun;
 import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 
 class LocalStorageDriver {
   rootDirectory;
@@ -1454,7 +2768,7 @@ class LocalStorageDriver {
     this.rootDirectory = rootDirectory;
   }
   resolvePath(path) {
-    return join2(this.rootDirectory, path.replace(/^\/+/, ""));
+    return join3(this.rootDirectory, path.replace(/^\/+/, ""));
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);
@@ -1585,14 +2899,466 @@ function mail() {
 function storageFacade() {
   return storage();
 }
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
+// ../../src/core/http/bodySizeLimitMiddleware.ts
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+function resolveMaxBodyBytes() {
+  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_BODY_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_BODY_BYTES;
+  }
+  return parsed;
+}
+function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
+  return async (request, next) => {
+    const contentLength = request.headers.get("content-length");
+    if (contentLength) {
+      const bytes = Number.parseInt(contentLength, 10);
+      if (Number.isInteger(bytes) && bytes > maxBytes) {
+        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+    }
+    return await next();
+  };
+}
+// ../../src/core/http/csrfToken.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage3;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function signCsrfToken(token, issuedAt) {
+  const payload = `${token}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCsrfCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === CSRF_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseSignedCsrfValue(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [token, issuedAtRaw, cookieSignature] = parts;
+  if (!token || !issuedAtRaw || !cookieSignature) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > CSRF_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return { token, issuedAt };
+}
+function createCsrfTokenCookie() {
+  const token = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  const value = signCsrfToken(token, issuedAt);
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readCsrfCookie(request);
+  if (cookieValue) {
+    const parsed = parseSignedCsrfValue(cookieValue);
+    if (parsed) {
+      return { token: parsed.token };
+    }
+  }
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+  }
+  return null;
+}
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readCsrfCookie(request);
+  if (!cookieValue) {
+    return false;
+  }
+  const parsed = parseSignedCsrfValue(cookieValue);
+  if (!parsed) {
+    return false;
+  }
+  const submittedBuffer = Buffer.from(submittedToken);
+  const expectedBuffer = Buffer.from(parsed.token);
+  if (submittedBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(submittedBuffer, expectedBuffer);
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function appendSetCookie(response, cookie) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", cookie);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function createCsrfMiddleware() {
+  return async (request, next) => {
+    const method = request.method.toUpperCase();
+    if (!MUTATING_METHODS.has(method)) {
+      const csrf = resolveCsrfToken(request);
+      const meta = currentRequestMeta();
+      meta.csrfToken = csrf.token;
+      const response = await next();
+      if (!csrf.cookie) {
+        return response;
+      }
+      return appendSetCookie(response, csrf.cookie);
+    }
+    const submitted = await readSubmittedCsrfTokenFromBody(request);
+    if (!verifyCsrfToken(request, submitted)) {
+      throw new ForbiddenError("Invalid or missing CSRF token.");
+    }
+    return await next();
+  };
+}
+// ../../src/core/http/etag.ts
+import { createHash } from "crypto";
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function computeEtagFromJson(data) {
+  const digest = createHash("sha256").update(JSON.stringify(data)).digest("hex").slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage4;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/http/validation.ts
+function buildRequestCacheKey(fallbackPath, request) {
+  if (!request) {
+    return fallbackPath;
+  }
+  const url = new URL(request.url);
+  const user = currentAuthUser();
+  const authScope = user ? `u:${user.id}` : "guest";
+  const tenantScope = `t:${currentTenantId()}`;
+  return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
+}
+function getQueryParams(request) {
+  if (!request) {
+    return new URLSearchParams;
+  }
+  return new URL(request.url).searchParams;
+}
+function parseOptionalPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  return parsed;
+}
+function parseOptionalBooleanQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  switch (value.toLowerCase()) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
+  }
+}
+function parseOptionalEnumQueryParam(params, name, allowedValues) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function expectObject(value, label = "request body") {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new BadRequestError(`${label} must be a JSON object.`);
+  }
+  return value;
+}
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+function readRequiredString(payload, field, options = {}) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new BadRequestError(`"${field}" is required and must be a string.`);
+  }
+  const trimmed = value.trim();
+  if (options.minLength !== undefined && trimmed.length < options.minLength) {
+    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
+  }
+  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
+    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
+  }
+  if (options.pattern && !options.pattern.test(trimmed)) {
+    throw new BadRequestError(`"${field}" has an invalid format.`);
+  }
+  return trimmed;
+}
+function readOptionalString(payload, field, options = {}) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredString(payload, field, options);
+}
+function readRequiredEnum(payload, field, allowedValues) {
+  const value = readRequiredString(payload, field);
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function readOptionalEnum(payload, field, allowedValues) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredEnum(payload, field, allowedValues);
+}
+function readRequiredPositiveInt(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
+  }
+  return value;
+}
+function readOptionalPositiveInt(payload, field) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredPositiveInt(payload, field);
+}
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/formRequest.ts
+class FormRequest {
+  authorize(_request) {
+    return true;
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    return await parseJsonBody(request, (payload) => this.parse(payload));
+  }
+}
+
+class QueryFormRequest {
+  validate(request) {
+    return this.parseQuery(request);
+  }
+}
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
   }
   return "api";
 }
@@ -1601,9 +3367,37 @@ function isViewsEnabled() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
 // ../../src/core/view/htmlResponse.ts
 function htmlResponse(html, init = {}) {
   return new Response(html, {
@@ -1614,6 +3408,145 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
+}
+// ../../src/core/auth/oauth/oidcProvider.ts
+class OidcProvider {
+  options;
+  name;
+  constructor(options) {
+    this.options = options;
+    this.name = options.name;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      response_type: "code",
+      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
+      state
+    });
+    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.options.redirectUri,
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
+      headers: { authorization: `Bearer ${tokenBody.access_token}` }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: profile.sub,
+      email: profile.email ?? `${profile.sub}@oidc.local`,
+      name: profile.name ?? profile.sub
+    };
+  }
+}
+
+// ../../src/core/auth/oauth/providers.ts
+class GitHubOAuthProvider {
+  options;
+  name = "github";
+  constructor(options) {
+    this.options = options;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      scope: "read:user user:email",
+      state
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret,
+        code,
+        redirect_uri: this.options.redirectUri
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("GitHub OAuth token exchange failed.");
+    }
+    const profileResponse = await fetch("https://api.github.com/user", {
+      headers: {
+        authorization: `Bearer ${tokenBody.access_token}`,
+        accept: "application/json",
+        "user-agent": "workhub"
+      }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: String(profile.id),
+      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
+      name: profile.name ?? profile.login
+    };
+  }
+}
+
+class MockOAuthProvider {
+  profile;
+  name = "mock";
+  constructor(profile) {
+    this.profile = profile;
+  }
+  getAuthorizationUrl(state) {
+    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (code !== "valid-code") {
+      throw new Error("Invalid OAuth code.");
+    }
+    return this.profile;
+  }
+}
+
+// ../../src/core/auth/oauth/samlProvider.ts
+class SamlProvider {
+  loginUrl;
+  name = "saml";
+  constructor(loginUrl) {
+    this.loginUrl = loginUrl;
+  }
+  getAuthorizationUrl(state) {
+    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (!code.startsWith("saml:")) {
+      throw new Error("Invalid SAML assertion reference.");
+    }
+    const [, email, name] = code.split(":");
+    return {
+      providerUserId: email ?? "saml-user",
+      email: email ?? "saml-user@workhub.test",
+      name: name ?? "SAML User"
+    };
+  }
+}
+
 // ../../src/config/features.ts
 function readFeatureFlags() {
   return {
@@ -1652,12 +3585,18 @@ var apiTokenTable = defineTable({
 });
 
 // ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
 async function verifyPassword(password, passwordHash) {
   return await Bun.password.verify(password, passwordHash);
 }
 
 // ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+import { createCipheriv, createDecipheriv, createHmac as createHmac2, randomBytes as randomBytes2 } from "crypto";
 var ENCRYPTION_PREFIX = "enc:v1:";
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
@@ -1685,6 +3624,14 @@ function isFieldEncryptionEnabled() {
   }
   return (process.env.APP_ENV ?? "local") === "production";
 }
+function encryptField(plaintext, key) {
+  const iv = randomBytes2(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
 function decryptField(value, key) {
   if (!value.startsWith(ENCRYPTION_PREFIX)) {
     return value;
@@ -1697,8 +3644,47 @@ function decryptField(value, key) {
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
+function hashLookupValue(normalizedValue, key) {
+  return createHmac2("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
 
 // ../../src/core/crypto/mfaSecret.ts
+function protectMfaSecret(secret) {
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key) {
+    return secret;
+  }
+  return encryptField(secret, key);
+}
 function revealMfaSecret(stored) {
   if (!stored) {
     return null;
@@ -1710,16 +3696,6 @@ function revealMfaSecret(stored) {
   return decryptField(stored, key);
 }
 
-// ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage3;
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
 // ../../src/core/security/securityEvents.ts
 function logSecurityEvent(event, details = {}) {
   const meta = currentRequestMeta();
@@ -1749,7 +3725,7 @@ function resolveDefaultTokenExpiryDays() {
 }
 
 // ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -1771,7 +3747,7 @@ function generateTotp(secret, counter, digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
   buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const digest = createHmac3("sha1", key).update(buffer).digest();
   const lastByte = digest[digest.length - 1] ?? 0;
   const offset = lastByte & 15;
   const b0 = digest[offset] ?? 0;
@@ -1795,16 +3771,6 @@ function verifyTotp(secret, token, window = 1) {
   return false;
 }
 
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage4;
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-
 // ../../src/domain/abilities.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
@@ -1972,11 +3938,160 @@ var userTable = defineTable({
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
-// ../../src/core/http/csrfToken.ts
-var CSRF_TTL_MS = 60 * 60 * 1000;
+// ../../src/core/auth/tokenHash.ts
+import { createHash as createHash2, createHmac as createHmac4 } from "crypto";
+function resolveTokenPepper() {
+  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+}
+function hashApiToken(token) {
+  const pepper = resolveTokenPepper();
+  if (pepper && pepper !== "workhub-dev-token-pepper") {
+    return createHmac4("sha256", pepper).update(token).digest("hex");
+  }
+  return createHash2("sha256").update(token).digest("hex");
+}
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
 // ../../src/core/http/flashSession.ts
+import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac5("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createFlashCookie(message) {
+  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
+  const issuedAt = Date.now();
+  const value = signFlashPayload(payload, issuedAt);
+  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function flashResponse(response, message) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", createFlashCookie(message));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {
@@ -2036,127 +4151,123 @@ function webErrorResponse(error, request) {
     status: mappedError.status
   });
 }
-// ../../src/core/http/etag.ts
-import { createHash } from "crypto";
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
-}
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
-}
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = createHash("sha256").update(`${String(resource.id ?? "0")}:${versionText}`).digest("hex").slice(0, 32);
-  return formatWeakEtag(digest);
-}
-function normalizeEtag(value) {
-  return value.trim();
-}
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
-}
-function parseEtagList(header) {
-  if (!header) {
-    return [];
-  }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
-}
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+// ../../src/core/http/authMiddleware.ts
+function createAuthMiddleware(auth2) {
+  return async (request, next) => {
+    const user = await auth2.resolve(request);
+    return await runWithAuthUser(user, async () => {
+      const response = await next();
+      if (user) {
+        const headers = new Headers(response.headers);
+        headers.set("x-authenticated-user-id", String(user.id));
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      }
+      return response;
+    });
+  };
 }
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
+// ../../src/core/http/authorizeMiddleware.ts
+function createAuthorizeMiddleware(gate, auth2, resource, action) {
+  return async (request, next) => {
+    const user = await auth2.resolve(request);
+    if (!gate.allows(resource, action, user)) {
+      const error = new ForbiddenError;
+      return Response.json({ error: error.message }, { status: error.status });
     }
-    return;
-  }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
-  }
-}
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
+    return await next();
+  };
 }
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
+// ../../src/core/http/conditionalResponse.ts
+function jsonResponse(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
   });
 }
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
+function conditionalJsonResponse(request, data, init = {}) {
+  if (!request || !isEtagEnabled()) {
+    return jsonResponse(data, init);
   }
+  const etag = computeEtagFromJson(data);
   if (ifNoneMatchSatisfied(request, etag)) {
     return notModifiedResponse(etag);
   }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  const response = jsonResponse(data, init);
+  const headers = new Headers(response.headers);
+  headers.set("ETag", etag);
+  headers.set("Cache-Control", "private, must-revalidate");
+  headers.append("Vary", "Authorization");
+  headers.append("Vary", "X-Tenant-Id");
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
     headers
   });
 }
-// ../../src/core/http/validation.ts
-function getQueryParams(request) {
-  if (!request) {
-    return new URLSearchParams;
-  }
-  return new URL(request.url).searchParams;
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
 }
-async function parseJsonBody(request, validator) {
-  let payload;
-  try {
-    payload = await request.json();
-  } catch {
-    throw new BadRequestError("Request body must be valid JSON.");
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
   }
-  return validator(payload);
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
 }
-function parsePositiveIntParam(value, name = "id") {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
-  }
-  return parsed;
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
 }
-
-// ../../src/core/http/formRequest.ts
-class FormRequest {
-  authorize(_request) {
-    return true;
-  }
-  async validate(request) {
-    if (!await this.authorize(request)) {
-      throw new ForbiddenError;
+async function requestIdMiddleware(request, next) {
+  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+  const response = await next();
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
     }
-    return await parseJsonBody(request, (payload) => this.parse(payload));
+    return wrapped;
+  }
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
+  }
+  return handler;
+}
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
   }
+  return wrapped;
 }
 // ../../src/core/http/pagination.ts
 var DEFAULT_PER_PAGE = 15;
@@ -2189,14 +4300,74 @@ function parsePaginationQuery(request) {
 function paginatedResponse(data, meta, init = {}) {
   return Response.json({ data, meta }, init);
 }
+// ../../src/core/http/requireAuthMiddleware.ts
+function createRequireAuthMiddleware(auth2) {
+  return async (request, next) => {
+    if (!await auth2.check(request)) {
+      const error = new UnauthorizedError;
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
+// ../../src/core/http/resources.ts
+function serializeDate(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function toResourceCollection(items, transformer) {
+  return items.map(transformer);
+}
+function toPaginatedResourceCollection(items, meta, transformer) {
+  return {
+    data: toResourceCollection(items, transformer),
+    meta
+  };
+}
+// ../../src/core/http/routeMiddleware.ts
+function withMiddleware(...middleware) {
+  const wrap = composeMiddleware(...middleware);
+  return (handler) => {
+    return wrap(handler);
+  };
+}
+// ../../src/core/http/routeModelBinding.ts
+function bindRouteModel(param, resolver, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    return await handler(request, model);
+  };
+}
 // ../../src/core/http/securedRouteModelBinding.ts
 function isMutatingPolicyAction(action) {
   return action === "update" || action === "delete";
 }
-function securedBindRouteModel(param, resolver, authorization, handler) {
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth2 = resolveApplicationAuth();
+    gate.authorize(authorization.resource, authorization.action, await auth2.resolve(request), model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
   return async (request) => {
-    const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
     const gate = resolveApplicationPolicyGate();
     const auth2 = resolveApplicationAuth();
     gate.authorize(authorization.resource, authorization.action, await auth2.resolve(request), model);
@@ -2226,16 +4397,79 @@ var ALLOWED_UPLOAD_MIME_TYPES = new Set([
   "text/plain",
   "text/csv"
 ]);
+function resolveMaxUploadBytes() {
+  const raw = process.env.MAX_UPLOAD_BYTES?.trim() ?? process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
+  }
+  return parsed;
+}
+function normalizeMimeType(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+function isAllowedMimeType(mimeType) {
+  const normalized = normalizeMimeType(mimeType);
+  if (!normalized || normalized === "application/octet-stream") {
+    return true;
+  }
+  return ALLOWED_UPLOAD_MIME_TYPES.has(normalized);
+}
+
+// ../../src/core/http/parseMultipartUpload.ts
+function normalizeMimeType2(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() || "application/octet-stream";
+}
+function sanitizeUploadFileName(name) {
+  const base = name.split(/[/\\]/).pop()?.trim() ?? "upload";
+  const sanitized = base.replace(/[^\w.\-()+ ]+/g, "_").slice(0, 200);
+  return sanitized.length > 0 ? sanitized : "upload";
+}
+async function parseMultipartUpload(request, fieldName = "file") {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected multipart form data.");
+  }
+  const formData = await request.formData();
+  const value = formData.get(fieldName);
+  if (!(value instanceof File)) {
+    throw new BadRequestError(`Missing upload field "${fieldName}".`);
+  }
+  if (value.size <= 0) {
+    throw new BadRequestError("Uploaded file is empty.");
+  }
+  const maxBytes = resolveMaxUploadBytes();
+  if (value.size > maxBytes) {
+    throw new PayloadTooLargeError(`Upload exceeds the ${maxBytes} byte limit.`);
+  }
+  const mimeType = normalizeMimeType2(value.type.trim() || "application/octet-stream");
+  if (!isAllowedMimeType(mimeType)) {
+    throw new BadRequestError(`File type "${mimeType}" is not allowed.`);
+  }
+  return {
+    fileName: sanitizeUploadFileName(value.name),
+    mimeType,
+    size: value.size,
+    contents: new Uint8Array(await value.arrayBuffer())
+  };
+}
+// ../../src/core/http/route.ts
+function getRouteParams(request) {
+  return request.params;
+}
 
 // ../../src/core/http/index.ts
-function jsonResponse(data, init = {}) {
+function jsonResponse2(data, init = {}) {
   return Response.json(data, {
     status: init.status ?? 200,
     headers: init.headers
   });
 }
 function createdResponse(data, init = {}) {
-  return jsonResponse(data, { ...init, status: init.status ?? 201 });
+  return jsonResponse2(data, { ...init, status: init.status ?? 201 });
 }
 function noContentResponse() {
   return new Response(null, { status: 204 });
@@ -2261,6 +4495,73 @@ function withErrorHandling(handler) {
     }
   };
 }
+// ../../src/core/http/loginThrottleMiddleware.ts
+var {RedisClient } = globalThis.Bun;
+function resolveLoginIdentity(request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+async function resolveLoginEmail(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  try {
+    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await request.clone().formData();
+      const email = formData.get("email");
+      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
+    }
+    const payload = await request.clone().json();
+    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function createLoginThrottleMiddleware(options) {
+  const client = new RedisClient(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    if (attempts > options.maxAttempts) {
+      return Response.json({ error: "Too many login attempts. Try again later." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+// ../../src/core/http/memoryThrottleMiddleware.ts
+var buckets = new Map;
+function createMemoryThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  return async (request, next) => {
+    const path = new URL(request.url).pathname;
+    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
+    const key = `${prefix}${identity}:${path}`;
+    const now = Date.now();
+    const existing = buckets.get(key);
+    if (!existing || existing.resetAt <= now) {
+      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
+      return await next();
+    }
+    existing.count += 1;
+    if (existing.count > options.maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
 // ../../src/core/metrics/prometheus.ts
 class PrometheusRegistry {
   httpRequestsTotal = new Map;
@@ -2347,6 +4648,128 @@ function createMetricsMiddleware() {
     return response;
   };
 }
+// ../../src/core/http/requireWebAuthMiddleware.ts
+function createRequireWebAuthMiddleware(auth2) {
+  return async (request, next) => {
+    const user = await auth2.resolve(request);
+    if (user) {
+      return await next();
+    }
+    if (requestPrefersJson(request)) {
+      throw new UnauthorizedError;
+    }
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+  };
+}
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/contentSecurityPolicy.ts
+function strictApiContentSecurityPolicy() {
+  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
+}
+function serverHtmxContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' https://unpkg.com",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function spaContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function resolveContentSecurityPolicy(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
+  }
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return serverHtmxContentSecurityPolicy();
+  }
+  if (frontendMode === "spa-react") {
+    return spaContentSecurityPolicy();
+  }
+  return strictApiContentSecurityPolicy();
+}
+
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware() {
+  return async (_request, next) => {
+    const response = await next();
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-XSS-Protection", "0");
+    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
+    if (appConfig.env === "production") {
+      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+// ../../src/core/http/throttleMiddleware.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function createThrottleMiddleware(options) {
+  const client = new RedisClient2(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  return async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    const path = new URL(request.url).pathname;
+    const throttleKey = `${prefix}${identity}:${path}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
 // ../../src/core/http/parseFormBody.ts
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
@@ -2388,6 +4811,49 @@ class WebFormRequest {
     }
   }
 }
+// ../../src/core/lifecycle/gracefulShutdown.ts
+var shutdownHandlers = new Map;
+var shutdownInstalled = false;
+var shuttingDown = false;
+function registerShutdownHandler(name, handler) {
+  shutdownHandlers.set(name, handler);
+  return () => {
+    shutdownHandlers.delete(name);
+  };
+}
+async function runGracefulShutdown(signal) {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
+  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
+  for (const [name, handler] of shutdownHandlers) {
+    try {
+      await handler();
+      console.log(`[shutdown] Completed ${name}`);
+    } catch (error) {
+      console.error(`[shutdown] Failed ${name}:`, error);
+    }
+  }
+}
+function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
+  if (shutdownInstalled) {
+    return;
+  }
+  shutdownInstalled = true;
+  for (const signal of signals) {
+    process.on(signal, () => {
+      runGracefulShutdown(signal).finally(() => {
+        process.exit(0);
+      });
+    });
+  }
+}
+function resetGracefulShutdownForTests() {
+  shutdownHandlers.clear();
+  shutdownInstalled = false;
+  shuttingDown = false;
+}
 // ../../src/core/queue/index.ts
 class Job {
   maxAttempts;
@@ -2413,6 +4879,333 @@ class AsyncQueue {
 function createQueue(driver) {
   return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
+// ../../src/core/queue/failedJobTable.ts
+var failedJobTable = defineTable({
+  name: "failed_job",
+  primaryKey: "id",
+  columns: ["id", "job_name", "payload", "exception", "failed_at"],
+  defaultOrderBy: { column: "failed_at", direction: "DESC" }
+});
+
+// ../../src/core/queue/failedJobRepository.ts
+class FailedJobRepository extends baseRepository_default {
+  constructor() {
+    super(failedJobTable);
+  }
+}
+var failedJobRepository_default = FailedJobRepository;
+
+// ../../src/core/queue/failedJobService.ts
+class FailedJobService {
+  repository;
+  constructor(repository) {
+    this.repository = repository;
+  }
+  async recordFailure(input) {
+    return await this.repository.create({
+      job_name: input.jobName,
+      payload: input.payload,
+      exception: input.exception,
+      failed_at: new Date
+    });
+  }
+  listRecent(limit = 50) {
+    return this.repository.findAll({
+      limit,
+      orderBy: { column: "failed_at", direction: "DESC" }
+    });
+  }
+  async retry(id) {
+    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
+    await this.repository.deleteById(id);
+    return failedJob;
+  }
+  async flush() {
+    const jobs = await this.repository.findAll();
+    let deleted = 0;
+    for (const job of jobs) {
+      if (await this.repository.deleteById(job.id)) {
+        deleted += 1;
+      }
+    }
+    return deleted;
+  }
+}
+var failedJobService_default = FailedJobService;
+
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  constructor() {}
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var jobRegistry = new JobRegistry;
+
+// ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient3 } = globalThis.Bun;
+
+// ../../src/config/queue.ts
+var queueConfig = {
+  driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
+  maxAttempts: Number(process.env.QUEUE_MAX_ATTEMPTS ?? "3"),
+  backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
+};
+
+// ../../src/core/queue/jobRunner.ts
+async function runQueueJob(envelope, failedJobs) {
+  const job = jobRegistry.create(envelope.name);
+  if (!job) {
+    throw new Error(`Unknown job "${envelope.name}".`);
+  }
+  const attempts = envelope.attempts ?? 0;
+  try {
+    await job.handle(envelope.payload);
+  } catch (error) {
+    const nextAttempt = attempts + 1;
+    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
+    if (nextAttempt < maxAttempts) {
+      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
+      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
+      await runQueueJob({
+        ...envelope,
+        attempts: nextAttempt
+      }, failedJobs);
+      return;
+    }
+    await failedJobs.recordFailure({
+      jobName: envelope.name,
+      payload: envelope.payload,
+      exception: error instanceof Error ? error.stack ?? error.message : String(error)
+    });
+    throw error;
+  }
+}
+
+// ../../src/core/queue/redisQueue.ts
+var QUEUE_LIST_KEY = "workhub:queue:default";
+var QUEUE_HIGH_KEY = "workhub:queue:high";
+var QUEUE_LOW_KEY = "workhub:queue:low";
+var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
+function queueKeyForPriority(priority = "default") {
+  switch (priority) {
+    case "high":
+      return QUEUE_HIGH_KEY;
+    case "low":
+      return QUEUE_LOW_KEY;
+    default:
+      return QUEUE_LIST_KEY;
+  }
+}
+function parseQueueJobEnvelope(rawPayload) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    console.error("[QueueWorker] Ignoring malformed queue payload");
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    console.error("[QueueWorker] Ignoring non-object queue payload");
+    return null;
+  }
+  const envelope = parsed;
+  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
+    console.error("[QueueWorker] Ignoring queue payload without job name");
+    return null;
+  }
+  if (!jobRegistry.create(envelope.name)) {
+    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
+    return null;
+  }
+  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
+    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
+    return null;
+  }
+  return {
+    name: envelope.name,
+    payload: envelope.payload ?? {},
+    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
+  };
+}
+
+class RedisQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient3(redisUrl);
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    const queueKey = queueKeyForPriority(job.priority);
+    await this.client.lpush(queueKey, JSON.stringify(envelope));
+  }
+}
+
+class QueueWorker {
+  failedJobs;
+  timeoutSeconds;
+  running = false;
+  stopping = false;
+  client;
+  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
+    this.failedJobs = failedJobs;
+    this.timeoutSeconds = timeoutSeconds;
+    this.client = new RedisClient3(redisUrl);
+  }
+  requestStop() {
+    this.stopping = true;
+  }
+  isRunning() {
+    return this.running;
+  }
+  async processNext() {
+    let result = null;
+    for (const queueKey of QUEUE_KEYS) {
+      result = await this.client.brpop(queueKey, 1);
+      if (result) {
+        break;
+      }
+    }
+    if (!result) {
+      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
+    }
+    if (!result) {
+      return false;
+    }
+    const [, rawPayload] = result;
+    const envelope = parseQueueJobEnvelope(rawPayload);
+    if (!envelope) {
+      return true;
+    }
+    try {
+      await runQueueJob(envelope, this.failedJobs);
+    } catch (error) {
+      console.error("[QueueWorker] Job failed:", error);
+    }
+    return true;
+  }
+  async run() {
+    this.running = true;
+    while (!this.stopping) {
+      await this.processNext();
+    }
+    this.running = false;
+  }
+  close() {
+    this.client.close();
+  }
+}
+
+// ../../src/core/queue/resilientQueue.ts
+class ResilientQueue {
+  failedJobs;
+  asyncDispatch;
+  constructor(failedJobs, asyncDispatch = false) {
+    this.failedJobs = failedJobs;
+    this.asyncDispatch = asyncDispatch;
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    if (this.asyncDispatch) {
+      setTimeout(() => {
+        runQueueJob(envelope, this.failedJobs).catch((error) => {
+          console.error("[ResilientQueue] Job failed:", error);
+        });
+      }, 0);
+      return;
+    }
+    await runQueueJob(envelope, this.failedJobs);
+  }
+}
+
+// ../../src/core/queue/publicQueue.ts
+function createFailedJobService() {
+  return new failedJobService_default(new failedJobRepository_default);
+}
+function createTrackedJob(name, job) {
+  return jobRegistry.track(name, job);
+}
+function createProductionQueue(driver, options = {}) {
+  options.registerJobs?.();
+  const failedJobs = options.failedJobs ?? createFailedJobService();
+  if (driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new RedisQueue(options.redisUrl);
+  }
+  return new ResilientQueue(failedJobs, driver === "async");
+}
+function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
+  return new QueueWorker(redisUrl, failedJobs);
+}
+// ../../src/core/scheduler/schedule.ts
+class Schedule {
+  tasks = [];
+  command(expression, name, run) {
+    this.tasks.push({ expression, name, run });
+    return this;
+  }
+  dueTasks(now = new Date) {
+    const minute = now.getMinutes();
+    return this.tasks.filter((task) => {
+      if (task.expression === "* * * * *") {
+        return true;
+      }
+      if (task.expression.startsWith("*/")) {
+        const interval = Number.parseInt(task.expression.slice(2), 10);
+        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
+      }
+      return false;
+    });
+  }
+  tasksList() {
+    return [...this.tasks];
+  }
+}
+var appSchedule = new Schedule;
+async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
+  const due = schedule.dueTasks(now);
+  for (const task of due) {
+    await task.run();
+  }
+  return due.length;
+}
 // ../../src/core/validation/rules.ts
 function required() {
   return (field, value) => {
@@ -2455,6 +5248,45 @@ function maxLength(maximum) {
     return;
   };
 }
+function pattern(expression) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!expression.test(value.trim())) {
+      return `"${field}" has an invalid format.`;
+    }
+    return;
+  };
+}
+function enumRule(allowedValues) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!allowedValues.includes(value)) {
+      return `"${field}" must be one of: ${allowedValues.join(", ")}.`;
+    }
+    return;
+  };
+}
+function optional() {
+  return () => {
+    return;
+  };
+}
+function integerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed)) {
+      return `"${field}" must be an integer.`;
+    }
+    return;
+  };
+}
 function emailRule() {
   return (field, value) => {
     if (typeof value !== "string") {
@@ -2467,6 +5299,40 @@ function emailRule() {
     return;
   };
 }
+function confirmed(fieldName) {
+  return (field, value, payload) => {
+    const confirmationKey = `${fieldName}_confirmation`;
+    const confirmation = payload[confirmationKey];
+    if (value !== confirmation) {
+      return `"${field}" confirmation does not match.`;
+    }
+    return;
+  };
+}
+function positiveIntegerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      return `"${field}" must be a positive integer.`;
+    }
+    return;
+  };
+}
+function integerRange(minimum, maximum) {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
+      return `"${field}" must be an integer between ${minimum} and ${maximum}.`;
+    }
+    return;
+  };
+}
 function validateObject(payload, schema) {
   if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
     throw new ValidationError("Request body must be a JSON object.");
@@ -2491,15 +5357,29 @@ function validateObject(payload, schema) {
   return output;
 }
 export {
+  withMigrationLock,
+  withMiddleware,
   withErrorHandling,
   validateObject,
+  toResourceCollection,
+  toPaginatedResourceCollection,
   stringRule,
   storageFacade as storage,
+  serializeDate,
+  securedBindRouteModelByKey,
   securedBindRouteModel,
+  runWithDatabaseConnection,
   runWithAuthUser,
+  runSeedersFromDirectory,
+  runInTransaction,
+  runGracefulShutdown,
+  runDueScheduledTasks,
   rollbackDatabase,
+  resolveWebLayoutData,
   resolveService,
+  resolveDatabaseDriver,
   required,
+  registerShutdownHandler,
   registerModelRepository,
   queue,
   prometheusRegistry,
@@ -2514,53 +5394,105 @@ export {
   mailer,
   mail,
   log,
+  loadSeedersFromDirectory,
   loadMigrationsFromDirectory,
-  jsonResponse,
+  jsonResponse2 as jsonResponse,
+  jobRegistry,
+  isHtmxRequest,
   isEtagEnabled,
+  installGracefulShutdownSignals,
+  inferReferencedTable,
+  indexHasOneRelation,
   indexHasManyRelation,
   indexBelongsToRelation,
+  indexBelongsToManyRelation,
+  hydrateValue,
+  htmlResponse,
+  hasOne,
   hasMany,
+  grammarForDriver,
   getMigrationStatus,
+  getActiveDatabaseConnection,
   freshDatabase,
+  filterMassAssignable,
   events,
   etagFromResource,
   emailRule,
+  dehydrateValue,
   defineTable,
   currentAuthUser,
   createdResponse,
+  createTrackedJob,
+  createThrottleMiddleware,
+  createSecurityHeadersMiddleware,
+  createSchemaBuilder,
+  createRequireWebAuthMiddleware,
+  createRequireAuthMiddleware,
+  createQueueWorker,
   createQueue,
+  createProductionQueue,
   createMetricsMiddleware,
+  createMemoryThrottleMiddleware,
+  createLoginThrottleMiddleware,
+  createFailedJobService,
+  createCsrfMiddleware,
+  createBodySizeLimitMiddleware,
+  createAuthorizeMiddleware,
+  createAuthMiddleware,
   config,
+  composeMiddleware,
+  compileBlueprint,
   cache,
-  bindDatabaseConnection,
+  bindDatabaseConnection2 as bindDatabaseConnection,
+  belongsToMany,
   belongsTo,
   auth,
   assertIfMatch,
+  applyMiddlewareToRoutes,
+  applyCasts,
+  appSchedule,
+  WhereBuilder,
   WebFormRequest,
   ValidationError,
+  UnsupportedSchemaFeatureError,
   UnprocessableEntityError,
   UnauthorizedError,
   SyncQueue,
   StorageManager,
+  SqliteGrammar,
   ServiceContainer,
+  Schema,
+  Schedule,
+  ResilientQueue,
   RepositoryQuery,
+  RedisQueue,
+  QueueWorker,
   PrometheusRegistry,
   PreconditionFailedError,
+  PostgresGrammar,
   PolicyGate,
   Policy,
   NotFoundError,
+  MySqlGrammar,
   Model,
   Mailer,
   LogMailDriver,
   LocalStorageDriver,
   Job,
   FormRequest,
+  ForeignIdColumnDefinition,
   ForbiddenError,
+  failedJobService_default as FailedJobService,
+  failedJobRepository_default as FailedJobRepository,
   EventBus,
+  EtaViewEngine,
+  DEFAULT_VIEWS_DIRECTORY,
   ConflictError,
   ConfigStore,
+  ColumnDefinition,
   repository_default as CacheRepository,
   CACHE_TAGS,
+  Blueprint,
   baseRepository_default as BaseRepository,
   BadRequestError,
   AsyncQueue