@getstrata/core 0.5.101 → 0.7.3

package/dist/index.js

@@ -211,37 +211,101 @@ function resolveAuthUserDirectory(container) {
   return null;
 }
 
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/core/auth/password.ts
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/auth/basicAuthGuard.ts
+class BasicAuthGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const credentials = readBasicCredentials(request);
+    if (!credentials) {
+      return null;
+    }
+    const directory = resolveAuthUserDirectory(this.container);
+    if (!directory) {
+      return null;
+    }
+    if (typeof directory.verifyCredentials === "function") {
+      return await directory.verifyCredentials(credentials.username, credentials.password);
+    }
+    if (typeof directory.findByEmail !== "function") {
+      return null;
+    }
+    const record = await directory.findByEmail(credentials.username);
+    if (!record?.password) {
+      return null;
+    }
+    if (!await verifyPassword(credentials.password, record.password)) {
+      return null;
+    }
+    return {
+      id: record.id,
+      role: record.role,
+      emailVerifiedAt: record.email_verified_at ?? null
+    };
+  }
+}
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
-  "organizations:read",
-  "organizations:create",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
+  "profile:read",
   "auth:tokens:read",
   "auth:tokens:write",
   "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
   "webhooks:read",
   "webhooks:write",
-  "audit:read"
+  "audit:read",
+  "audit:export"
 ];
 var PLATFORM_ADMIN_ABILITIES = ["*"];
 function resolveAbilitiesForRole(role) {
@@ -292,12 +356,8 @@ class ApiTokenGuard {
     this.options = options;
   }
   resolve(request) {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return null;
-    }
-    const token = authorization.slice("Bearer ".length).trim();
-    if (token !== this.options.token) {
+    const token = readBearerToken(request);
+    if (!token || token !== this.options.token) {
       return null;
     }
     return this.options.user;
@@ -310,12 +370,8 @@ class DatabaseTokenGuard {
     this.container = container;
   }
   async resolve(request) {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return null;
-    }
-    const token = authorization.slice("Bearer ".length).trim();
-    if (!token) {
+    const token = readBearerToken(request);
+    if (!token || token.split(".").length === 3) {
       return null;
     }
     const tokenService = resolveAuthUserDirectory(this.container);
@@ -341,15 +397,38 @@ class CompositeGuard {
     return null;
   }
 }
+var BEARER_GUARD_NAMES = ["api", "access_token", "token", "jwt"];
+var BASIC_GUARD_NAMES = ["basic"];
+var SESSION_GUARD_NAMES = ["web", "session", "default"];
 
 class AuthManager {
   guard;
+  namedGuards = new Map;
   constructor(guard) {
     this.guard = guard;
+    this.namedGuards.set("default", guard);
+  }
+  registerGuard(name, next) {
+    const trimmed = name.trim();
+    if (!trimmed) {
+      throw new Error("Auth guard name must not be empty.");
+    }
+    this.namedGuards.set(trimmed, next);
+    return this;
+  }
+  use(name = "default") {
+    const found = this.namedGuards.get(name);
+    if (!found) {
+      throw new Error(`Unknown auth guard "${name}".`);
+    }
+    return found;
+  }
+  guardNames() {
+    return [...this.namedGuards.keys()];
   }
   async resolve(request) {
     if (request) {
-      return await Promise.resolve(this.guard.resolve(request));
+      return await this.authenticateRequest(request);
     }
     return currentAuthUser();
   }
@@ -366,6 +445,167 @@ class AuthManager {
     }
     return user;
   }
+  async authenticateRequest(request) {
+    const scheme = authorizationScheme(request);
+    if (scheme === "bearer") {
+      const fromBearer = await this.tryNamedGuards(request, BEARER_GUARD_NAMES);
+      if (fromBearer) {
+        return fromBearer;
+      }
+    } else if (scheme === "basic") {
+      const fromBasic = await this.tryNamedGuards(request, BASIC_GUARD_NAMES);
+      if (fromBasic) {
+        return fromBasic;
+      }
+    } else {
+      const fromSession = await this.tryNamedGuards(request, SESSION_GUARD_NAMES);
+      if (fromSession) {
+        return fromSession;
+      }
+    }
+    return await Promise.resolve(this.guard.resolve(request));
+  }
+  async tryNamedGuards(request, names) {
+    const seen = new Set;
+    for (const name of names) {
+      const named = this.namedGuards.get(name);
+      if (!named || seen.has(named)) {
+        continue;
+      }
+      seen.add(named);
+      const user = await Promise.resolve(named.resolve(request));
+      if (user) {
+        return user;
+      }
+    }
+    return null;
+  }
+}
+// ../../src/core/auth/jwt.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+
+// ../../src/core/auth/jwt.ts
+function resolveJwtSecret(secret) {
+  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+}
+function jwtTtlSeconds(override) {
+  if (typeof override === "number" && Number.isInteger(override) && override > 0) {
+    return override;
+  }
+  const parsed = Number.parseInt(process.env.JWT_TTL_SECONDS ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 3600;
+}
+function encodeJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function decodeJson(value) {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function signPart(headerAndPayload, secret) {
+  return createHmac("sha256", secret).update(headerAndPayload).digest("base64url");
+}
+function signaturesMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function signJwt(payload, options = {}) {
+  const now = Math.floor(Date.now() / 1000);
+  const body = {
+    ...payload,
+    iat: now,
+    exp: now + jwtTtlSeconds(options.ttlSeconds)
+  };
+  const header = encodeJson({ alg: "HS256", typ: "JWT" });
+  const data = encodeJson(body);
+  const unsigned = `${header}.${data}`;
+  const signature = signPart(unsigned, resolveJwtSecret(options.secret));
+  return `${unsigned}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [header, data, signature] = parts;
+  if (!header || !data || !signature) {
+    return null;
+  }
+  const expected = signPart(`${header}.${data}`, resolveJwtSecret(secret));
+  if (!signaturesMatch(signature, expected)) {
+    return null;
+  }
+  const parsedHeader = decodeJson(header);
+  if (parsedHeader?.alg !== "HS256") {
+    return null;
+  }
+  const payload = decodeJson(data);
+  if (!payload || payload.sub === undefined || payload.sub === null) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+    return null;
+  }
+  return payload;
+}
+// ../../src/core/auth/jwtGuard.ts
+function authUserFromJwt(payload) {
+  return {
+    id: payload.sub,
+    ...payload.role ? { role: String(payload.role) } : {},
+    ...Array.isArray(payload.abilities) ? { abilities: payload.abilities.map(String) } : {},
+    ...payload.emailVerifiedAt !== undefined ? { emailVerifiedAt: payload.emailVerifiedAt } : {}
+  };
+}
+
+class JwtGuard {
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  resolve(request) {
+    const token = readBearerToken(request);
+    if (token?.split(".").length !== 3) {
+      return null;
+    }
+    const payload = verifyJwt(token, this.options.secret);
+    if (!payload) {
+      return null;
+    }
+    return authUserFromJwt(payload);
+  }
 }
 // ../../src/core/auth/membershipContext.ts
 var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
@@ -841,14 +1081,14 @@ function getDefaultDatabaseQuery() {
 }
 
 // ../../src/core/security/timingSafeCompare.ts
-import { timingSafeEqual } from "crypto";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 function timingSafeCompareString(left, right) {
   const leftBuffer = Buffer.from(left);
   const rightBuffer = Buffer.from(right);
   if (leftBuffer.length !== rightBuffer.length) {
     return false;
   }
-  return timingSafeEqual(leftBuffer, rightBuffer);
+  return timingSafeEqual2(leftBuffer, rightBuffer);
 }
 
 // ../../src/core/security/scimTenantTokens.ts
@@ -988,35 +1228,26 @@ function jsonScimError(detail, status) {
     headers: { "content-type": "application/scim+json" }
   });
 }
-// ../../src/core/cache/redisCacheStore.ts
-var {RedisClient } = globalThis.Bun;
-
-// ../../src/core/runtime/appKeyPrefix.ts
-function appKeyPrefix() {
-  return process.env.APP_KEY_PREFIX?.trim() || "strata";
-}
-function appCookieName(kind) {
-  return `${appKeyPrefix()}_${kind}`;
-}
-function appDevSecret(kind) {
-  return `${appKeyPrefix()}-dev-${kind}`;
-}
-function namespacedRedisKey(kind) {
-  return `${appKeyPrefix()}:${kind}`;
-}
-function smtpEhloHost() {
-  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
-  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
-  return safe || "strata.local";
-}
-function otelServiceName() {
-  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+// ../../src/core/auth/tokenAbilityChecker.ts
+function tokenCan(user, ability) {
+  if (!user) {
+    return false;
+  }
+  const abilities = user.abilities ?? [];
+  return abilities.includes("*") || abilities.includes(ability);
 }
-function appEnv() {
-  return process.env.APP_ENV?.trim() || "local";
+function createTokenAbilityChecker() {
+  return {
+    tokenCan,
+    requireAbility(user, ability) {
+      if (!tokenCan(user, ability)) {
+        throw new ForbiddenError(`Missing ability: ${ability}`);
+      }
+    }
+  };
 }
-
 // ../../src/core/cache/redisCacheStore.ts
+var {RedisClient } = globalThis.Bun;
 function cacheKeyPrefix() {
   return namespacedRedisKey("cache:");
 }
@@ -1455,7 +1686,13 @@ var CACHE_TAGS = {
   tasks: "tasks",
   comments: "comments",
   attachments: "attachments",
-  reports: "reports"
+  reports: "reports",
+  users: "users",
+  departments: "departments",
+  positions: "positions",
+  applications: "applications",
+  careers: "careers",
+  offers: "offers"
 };
 // ../../src/core/contracts/container.ts
 class ServiceContainer {
@@ -1644,12 +1881,155 @@ async function withDatabaseErrorHandling(operation) {
   }
 }
 
-// ../../src/core/database/query.ts
-function quoteIdentifier(identifier) {
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
     throw new Error(`Invalid SQL identifier: ${identifier}`);
   }
-  return `"${identifier}"`;
+  return identifier;
+}
+var postgresDialect = {
+  driver: "pgsql",
+  placeholder(index) {
+    return `$${index}`;
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "NOW()";
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "ILIKE";
+  },
+  nullsLastSuffix() {
+    return " NULLS LAST";
+  },
+  castToText(expression) {
+    return `${expression}::text`;
+  }
+};
+var mysqlDialect = {
+  driver: "mysql",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `\`${assertSafeIdentifier(identifier)}\``;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  returningClause() {
+    return "";
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS CHAR)`;
+  }
+};
+var sqliteDialect = {
+  driver: "sqlite",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS TEXT)`;
+  }
+};
+var dialects = {
+  pgsql: postgresDialect,
+  mysql: mysqlDialect,
+  sqlite: sqliteDialect
+};
+var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+var dialectOverride = null;
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+function useSqlDialect(driver) {
+  dialectOverride = dialectFor(driver);
+  return dialectOverride;
+}
+function resetSqlDialect() {
+  dialectOverride = null;
+}
+function runWithSqlDialect(driver, callback) {
+  return dialectContext.run(dialectFor(driver), callback);
+}
+
+// ../../src/core/database/query.ts
+function quoteIdentifier(identifier) {
+  return currentSqlDialect().quoteIdentifier(identifier);
+}
+function returningSuffix(columns) {
+  return currentSqlDialect().returningClause(columns);
 }
 function qualifyColumn(tableName, column) {
   return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
@@ -1679,7 +2059,7 @@ function isQueryOperator(value) {
 }
 function pushParam(values, value) {
   values.push(value);
-  return `$${values.length}`;
+  return currentSqlDialect().placeholder(values.length);
 }
 function buildInClause(column, values, params) {
   if (values.length === 0) {
@@ -1719,9 +2099,12 @@ function buildOperatorClauses(column, operator, params) {
     clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
   }
   if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, operator.ilike)}`);
+    clauses.push(`${column} ${currentSqlDialect().ilikeOperator()} ${pushParam(params, operator.ilike)}`);
   }
   if (operator.tsMatch !== undefined) {
+    if (currentSqlDialect().driver !== "pgsql") {
+      throw new Error("Full-text search (tsMatch) is only available on PostgreSQL.");
+    }
     clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
   }
   return clauses;
@@ -1912,7 +2295,7 @@ function buildSelectList(table, select, params = []) {
       return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
     }
     if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+      return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
@@ -2004,7 +2387,7 @@ function buildInsertQuery(table, values) {
   const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
   const returningColumns = buildReturningColumns(table);
   return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -2023,7 +2406,7 @@ function buildUpdateQuery(table, id, changes) {
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
     params
   };
 }
@@ -2036,9 +2419,12 @@ function buildSoftDeleteByIdQuery(table, id, deletedAt) {
   const scopeClauses = [];
   appendSoftDeleteScope(table, {}, scopeClauses);
   const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, deletedAt);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildRestoreByIdQuery(table, id) {
@@ -2047,15 +2433,21 @@ function buildRestoreByIdQuery(table, id) {
     throw new Error(`Table ${table.name} does not support soft deletes.`);
   }
   const returningColumns = buildReturningColumns(table);
+  const params = [];
+  const deletedAtPlaceholder = pushParam(params, null);
+  const idPlaceholder = pushParam(params, id);
   return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = ${deletedAtPlaceholder} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder} AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL${returningSuffix(returningColumns)}`,
+    params
   };
 }
 function buildDeleteByIdQuery(table, id) {
+  const params = [];
+  const idPlaceholder = pushParam(params, id);
+  const returning = returningSuffix(`${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`);
   return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = ${idPlaceholder}${returning}`,
+    params
   };
 }
 
@@ -2106,6 +2498,19 @@ function relationMatchKey(value) {
   }
   return String(value);
 }
+var relationLookupCache = new WeakMap;
+function indexedRelationLookup(map) {
+  const cached = relationLookupCache.get(map);
+  if (cached) {
+    return cached;
+  }
+  const indexed = new Map;
+  for (const [existing, value] of map) {
+    indexed.set(relationMatchKey(existing), value);
+  }
+  relationLookupCache.set(map, indexed);
+  return indexed;
+}
 function getByRelationKey(map, key) {
   if (map.has(key)) {
     return map.get(key);
@@ -2114,12 +2519,7 @@ function getByRelationKey(map, key) {
   if (want === "") {
     return;
   }
-  for (const [existing, value] of map) {
-    if (relationMatchKey(existing) === want) {
-      return value;
-    }
-  }
-  return;
+  return indexedRelationLookup(map).get(want);
 }
 function indexHasManyRelation(parents, children, relation) {
   const groups = new Map;
@@ -2532,73 +2932,67 @@ class RepositoryQuery {
     return this;
   }
   async attach(rows) {
-    if (rows.length === 0 || this.eagerLoads.length === 0) {
-      return rows.map((row) => ({ ...row }));
-    }
-    let result = rows.map((row) => ({ ...row }));
-    for (const load of this.eagerLoads) {
-      if (load.kind === "hasMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey]) ?? []
-        }));
-        continue;
+    const result = rows.map((row) => ({ ...row }));
+    if (result.length === 0 || this.eagerLoads.length === 0) {
+      return result;
+    }
+    await Promise.all(this.eagerLoads.map((load) => this.hydrateEagerLoad(rows, result, load)));
+    return result;
+  }
+  async hydrateEagerLoad(rows, result, load) {
+    if (load.kind === "hasMany") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "morphMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey]) ?? []
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "morphMany") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "morphOne") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey])
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "morphOne") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]);
       }
-      if (load.kind === "hasManyThrough") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.localKey]) ?? []
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "hasManyThrough") {
+      const relation2 = load.relation;
+      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
       }
-      if (load.kind === "belongsToMany") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.parentKey]) ?? []
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "belongsToMany") {
+      const relation2 = load.relation;
+      const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.parentKey]) ?? [];
       }
-      if (load.kind === "morphTo") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: getByRelationKey(grouped2, row[relation2.morphIdKey])
-        }));
-        continue;
+      return;
+    }
+    if (load.kind === "morphTo") {
+      const relation2 = load.relation;
+      const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+      for (const row of result) {
+        row[load.as] = getByRelationKey(grouped2, row[relation2.morphIdKey]);
       }
-      const relation = load.relation;
-      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
-      result = result.map((row) => ({
-        ...row,
-        [load.as]: getByRelationKey(grouped, row[relation.foreignKey])
-      }));
+      return;
+    }
+    const relation = load.relation;
+    const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
+    for (const row of result) {
+      row[load.as] = getByRelationKey(grouped, row[relation.foreignKey]);
     }
-    return result;
   }
 }
 
@@ -2953,10 +3347,10 @@ class BaseRepository {
       idsByType.set(morphType, ids);
     }
     const parentsByType = new Map;
-    for (const [morphType, ids] of idsByType) {
+    await Promise.all([...idsByType.entries()].map(async ([morphType, ids]) => {
       const repository = repositoriesByType.get(morphType);
       if (!repository) {
-        continue;
+        return;
       }
       const ownerKey = repository.getTable().primaryKey;
       const parents = await repository.withConnection(this.connection).findWhere({
@@ -2967,7 +3361,7 @@ class BaseRepository {
         indexed.set(relationMatchKey(parent[ownerKey]), parent);
       }
       parentsByType.set(morphType, indexed);
-    }
+    }));
     return indexMorphToRelation(children, parentsByType, relation);
   }
   async loadBelongsToManyForParents(parents, relation, relatedRepository, options = {}) {
@@ -3169,10 +3563,11 @@ class Factory {
     return made;
   }
   async createOne(overrides = {}) {
-    const created = await this.persist(this.insertable(this.makeOne(overrides)));
-    for (const child of this.children) {
-      await child.factory.for(created, child.foreignKey).create();
-    }
+    return this.persistCreated(this.makeOne(overrides));
+  }
+  async persistCreated(record) {
+    const created = await this.persist(this.insertable(record));
+    await Promise.all(this.children.map((child) => child.factory.for(created, child.foreignKey).create()));
     for (const callback of this.afterCreatingCallbacks) {
       await callback(created);
     }
@@ -3410,11 +3805,7 @@ class HasManyRelationQuery {
     return this.create(related);
   }
   async createMany(records) {
-    const created = [];
-    for (const attributes of records) {
-      created.push(await this.create(attributes));
-    }
-    return created;
+    return Promise.all(records.map((attributes) => this.create(attributes)));
   }
 }
 
@@ -3920,12 +4311,12 @@ async function eagerLoadOnModels(models, paths) {
     }
     grouped.set(head, existing);
   }
-  for (const [head, nested] of grouped) {
+  await Promise.all([...grouped.entries()].map(async ([head, nested]) => {
     const unloaded = models.filter((model) => model.loaded(head) === undefined);
     if (unloaded.length > 0) {
       const first = unloaded[0];
       if (!first) {
-        continue;
+        return;
       }
       const method = first[head];
       if (typeof method !== "function") {
@@ -3941,14 +4332,14 @@ async function eagerLoadOnModels(models, paths) {
       }
     }
     if (nested.length === 0) {
-      continue;
+      return;
     }
     const children = models.flatMap((model) => {
       const loaded = model.loaded(head);
       return Array.isArray(loaded) ? loaded : loaded ? [loaded] : [];
     });
     await eagerLoadOnModels(children.filter(isLoadableModel), nested);
-  }
+  }));
 }
 async function loadNested(model, path) {
   await eagerLoadOnModels([model], [path]);
@@ -4226,12 +4617,12 @@ class ModelQuery {
     const models = [];
     for (const row of rows) {
       const model = statics.newFromRecord(row, true);
-      await runObservers(model, "retrieved");
       for (const { name, relationQuery } of this.eager) {
         model.setLoaded(name, relationQuery.hydrateEager(row, name));
       }
       models.push(model);
     }
+    await Promise.all(models.map((model) => runObservers(model, "retrieved")));
     const nested = this.eager.filter((item) => item.path.includes(".")).map((item) => item.path);
     await eagerLoadOnModels(models.filter(isLoadableModel), nested);
     return models;
@@ -4688,7 +5079,7 @@ class Model {
   morphTo(relatedByType, morphName, typeKey, idKey) {
     const resolvedName = morphName ?? inferRelationMethodName("morphTo");
     if (!resolvedName) {
-      throw new Error(`${this.constructor.name}.morphTo() needs an explicit morph name (Laravel infers it from the relation method).`);
+      throw new Error(`${this.constructor.name}.morphTo() needs an explicit morph name (the calling method name is not available at runtime).`);
     }
     const resolvedMap = Object.fromEntries(Object.entries(relatedByType).map(([type, related]) => [type, resolveRelated(related)]));
     return new MorphToRelationQuery(this, resolvedMap, morphTo({
@@ -4737,6 +5128,74 @@ function registerModelRepository(model, repository) {
   ensureBooted(model);
   return model;
 }
+// ../../src/core/database/mysqlConnection.ts
+import mysql from "mysql2/promise";
+function rowsFromResult(result) {
+  if (Array.isArray(result)) {
+    return result;
+  }
+  if (result && typeof result === "object") {
+    return [result];
+  }
+  return [];
+}
+function createMysqlConnectionFromPool(pool) {
+  return {
+    async unsafe(query, params = []) {
+      const [result] = await pool.execute(query, [...params]);
+      return rowsFromResult(result);
+    },
+    async close() {
+      if (typeof pool.end === "function") {
+        await pool.end();
+      }
+    }
+  };
+}
+function createMysqlConnection(url) {
+  if (!url.trim()) {
+    throw new Error("MYSQL_URL is not configured. Set url before creating a MySQL pool.");
+  }
+  return createMysqlConnectionFromPool(mysql.createPool(url));
+}
+// ../../src/core/database/namedConnections.ts
+var REGISTRY_KEY = Symbol.for("@getstrata/namedConnections");
+function registry() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[REGISTRY_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = new Map;
+  globalRecord[REGISTRY_KEY] = created;
+  return created;
+}
+function registerNamedConnection(name, driver, connection) {
+  if (!name.trim()) {
+    throw new Error("Named database connection requires a non-empty name.");
+  }
+  registry().set(name, { name, driver, connection });
+}
+function unregisterNamedConnection(name) {
+  return registry().delete(name);
+}
+function hasNamedConnection(name) {
+  return registry().has(name);
+}
+function getNamedConnection(name) {
+  const entry = registry().get(name);
+  if (!entry) {
+    throw new Error(`Named database connection "${name}" is not registered.`);
+  }
+  return entry;
+}
+function resetNamedConnections() {
+  registry().clear();
+}
+function runOnNamedConnection(name, callback) {
+  const entry = getNamedConnection(name);
+  return runWithSqlDialect(entry.driver, () => runWithDatabaseConnection(entry.connection, callback));
+}
 // ../../src/core/database/schema/columnDefinition.ts
 class ColumnDefinition {
   name;
@@ -4958,45 +5417,6 @@ class Blueprint {
     });
   }
 }
-// ../../src/core/database/schema/driver.ts
-function normalizeConnectionName(connection) {
-  const normalized = connection.trim().toLowerCase();
-  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
-    return "pgsql";
-  }
-  if (normalized === "mysql" || normalized === "mariadb") {
-    return "mysql";
-  }
-  if (normalized === "sqlite") {
-    return "sqlite";
-  }
-  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
-}
-function resolveDriverFromUrl(url) {
-  const normalized = url.trim().toLowerCase();
-  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
-    return "pgsql";
-  }
-  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
-    return "mysql";
-  }
-  if (normalized.startsWith("sqlite:")) {
-    return "sqlite";
-  }
-  return null;
-}
-function resolveDatabaseDriver(options = {}) {
-  const connection = options.connection ?? process.env.DB_CONNECTION;
-  if (connection) {
-    return normalizeConnectionName(connection);
-  }
-  const url = options.url ?? process.env.DATABASE_URL ?? "";
-  const fromUrl = resolveDriverFromUrl(url);
-  if (fromUrl) {
-    return fromUrl;
-  }
-  return "pgsql";
-}
 // ../../src/core/database/schema/errors.ts
 class UnsupportedSchemaFeatureError extends Error {
   constructor(feature, driver) {
@@ -5385,6 +5805,36 @@ async function runSeedersFromDirectory(directory, db, options) {
   }
   return seeders.length;
 }
+// ../../src/core/database/sqliteConnection.ts
+import { Database } from "bun:sqlite";
+function isRowReturning(sql) {
+  const upper = sql.replace(/\s+/g, " ").trim().toUpperCase();
+  if (upper.includes(" RETURNING ")) {
+    return true;
+  }
+  return upper.startsWith("SELECT") || upper.startsWith("WITH") || upper.startsWith("PRAGMA") || upper.startsWith("EXPLAIN");
+}
+function createSqliteConnection(filename) {
+  if (!filename.trim()) {
+    throw new Error("SQLite path is not configured. Pass a filename or :memory:.");
+  }
+  const db = new Database(filename, { create: true });
+  db.exec("PRAGMA foreign_keys = ON");
+  return {
+    async unsafe(query, params = []) {
+      const statement = db.query(query);
+      const args = [...params];
+      if (isRowReturning(query)) {
+        return statement.all(...args);
+      }
+      statement.run(...args);
+      return [];
+    },
+    close() {
+      db.close();
+    }
+  };
+}
 // ../../src/core/database/table.ts
 function defineTable(definition) {
   return definition;
@@ -5563,7 +6013,7 @@ class LogMailDriver {
       to: message.to,
       subject: message.subject,
       body: message.body,
-      ...message.html ? { html: message.html } : {}
+      ...message.html ? { htmlBytes: Buffer.byteLength(message.html, "utf8") } : {}
     }));
   }
 }
@@ -5918,6 +6368,32 @@ function conditionalJsonResponse(request, data, init = {}) {
     headers
   });
 }
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
+  }
+  return "api";
+}
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
+}
+
 // ../../src/core/http/contentSecurityPolicy.ts
 var HTMX_2_0_4_INDICATOR_STYLE_HASH = "'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='";
 var API_DIRECTIVES = {
@@ -6005,11 +6481,10 @@ function applyNonce(directives, nonce) {
   return next;
 }
 function htmlBaselineDirectives() {
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
+  if (isViewsEnabled()) {
     return cloneDirectives(HTMX_HTML_DIRECTIVES);
   }
-  if (frontendMode === "spa-react") {
+  if (isSpaEnabled()) {
     return cloneDirectives(SPA_HTML_DIRECTIVES);
   }
   return cloneDirectives(API_DIRECTIVES);
@@ -6124,7 +6599,7 @@ function buildCorsHeaders(request) {
   return headers;
 }
 // ../../src/core/http/csrfToken.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { timingSafeEqual as timingSafeEqual3 } from "crypto";
 
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
@@ -6156,7 +6631,7 @@ function tokensMatch(left, right) {
   if (leftBuffer.length !== rightBuffer.length) {
     return false;
   }
-  return timingSafeEqual2(leftBuffer, rightBuffer);
+  return timingSafeEqual3(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
@@ -6233,6 +6708,9 @@ function appendSetCookie(response, cookie) {
 }
 function createCsrfMiddleware() {
   return async (request, next) => {
+    if (requestUsesHeaderCredentials(request)) {
+      return await next();
+    }
     const method = request.method.toUpperCase();
     if (!MUTATING_METHODS.has(method)) {
       const csrf = resolveCsrfToken(request);
@@ -6270,7 +6748,7 @@ function createCsrfProtection(secret, options = {}) {
   };
 }
 // ../../src/core/http/flashSession.ts
-import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual4 } from "crypto";
 var FLASH_COOKIE = appCookieName("flash");
 var FLASH_TTL_MS = 60 * 1000;
 function flashCookieName() {
@@ -6280,7 +6758,7 @@ function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac2("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -6320,7 +6798,7 @@ function parseFlashCookie(cookieValue) {
   if (expectedBuffer.length !== actualBuffer.length) {
     return null;
   }
-  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
+  if (!timingSafeEqual4(expectedBuffer, actualBuffer)) {
     return null;
   }
   try {
@@ -6630,6 +7108,9 @@ function whenLoaded(model, relation, transform) {
   if (value === undefined) {
     return;
   }
+  if (value === null) {
+    return null;
+  }
   return transform ? transform(value) : value;
 }
 
@@ -6655,7 +7136,7 @@ class JsonResource {
   }
   whenLoaded(relation, transform) {
     const model = this.resource;
-    if (typeof model.loaded !== "function") {
+    if (this.resource == null || typeof model.loaded !== "function") {
       return;
     }
     return whenLoaded(model, relation, transform);
@@ -6698,21 +7179,6 @@ function toPaginatedResourceCollection(items, meta, transformer) {
     meta
   };
 }
-// ../../src/core/runtime/frontendMode.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
-  }
-  return "api";
-}
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
-}
-
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
   return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
@@ -6840,6 +7306,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -6851,8 +7321,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 
 // ../../src/core/http/safeInternalPath.ts
@@ -7059,6 +7528,29 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
 }
 // ../../src/core/http/loginThrottleMiddleware.ts
 var {RedisClient: RedisClient2 } = globalThis.Bun;
+
+// ../../src/core/http/throttleResponse.ts
+async function tooManyRequestsResponse(request, message, decaySeconds) {
+  const retryAfter = { "retry-after": String(decaySeconds) };
+  if (requestPrefersJson(request) || !isViewsEnabled()) {
+    return Response.json({ error: message }, {
+      status: 429,
+      headers: retryAfter
+    });
+  }
+  const html = await htmlErrorResponse({
+    status: 429,
+    title: "Too Many Requests",
+    message,
+    request
+  });
+  const headers = new Headers(html.headers);
+  headers.set("retry-after", String(decaySeconds));
+  return new Response(html.body, { status: 429, headers });
+}
+
+// ../../src/core/http/loginThrottleMiddleware.ts
+var memoryLoginBuckets = new Map;
 function resolveLoginIdentity(request) {
   return readClientIp(request) ?? "unknown";
 }
@@ -7076,7 +7568,30 @@ async function resolveLoginEmail(request) {
     return "unknown";
   }
 }
-function createLoginThrottleMiddleware(options) {
+function consumeMemoryAttempt(key, decaySeconds) {
+  const now = Date.now();
+  const existing = memoryLoginBuckets.get(key);
+  if (!existing || existing.resetAt <= now) {
+    memoryLoginBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
+    return 1;
+  }
+  existing.count += 1;
+  return existing.count;
+}
+function createMemoryLoginThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = consumeMemoryAttempt(throttleKey, options.decaySeconds);
+    if (attempts > options.maxAttempts) {
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
+    }
+    return await next();
+  };
+}
+function createRedisLoginThrottleMiddleware(options) {
   const client = new RedisClient2(options.redisUrl);
   const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
   return async (request, next) => {
@@ -7088,16 +7603,18 @@ function createLoginThrottleMiddleware(options) {
       await client.expire(throttleKey, options.decaySeconds);
     }
     if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
     }
     return await next();
   };
 }
+function createLoginThrottleMiddleware(options) {
+  const redisUrl = options.redisUrl?.trim() ?? "";
+  if (redisUrl) {
+    return createRedisLoginThrottleMiddleware({ ...options, redisUrl });
+  }
+  return createMemoryLoginThrottleMiddleware(options);
+}
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
@@ -7116,12 +7633,7 @@ function createMemoryThrottleMiddleware(options) {
     }
     existing.count += 1;
     if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
     }
     return await next();
   };
@@ -7267,6 +7779,60 @@ function createRequireGlobalAdminMiddleware() {
     return await next();
   };
 }
+// ../../src/core/auth/intendedUrlCookie.ts
+var INTENDED_URL_COOKIE = appCookieName("intended");
+var DEFAULT_INTENDED_URL_TTL_SECONDS = 60 * 60 * 24;
+var SKIP_EXACT_PATHS = new Set([
+  "/email/verify",
+  "/verify-email",
+  "/login",
+  "/register",
+  "/logout",
+  "/forgot-password",
+  "/reset-password",
+  "/two-factor-challenge",
+  "/confirm-password",
+  "/api"
+]);
+function intendedUrlCookieName() {
+  return process.env.INTENDED_URL_COOKIE_NAME?.trim() || appCookieName("intended");
+}
+function intendedUrlTtlSeconds() {
+  const parsed = Number.parseInt(process.env.INTENDED_URL_TTL_SECONDS ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_INTENDED_URL_TTL_SECONDS;
+}
+function cookieSecureFlag() {
+  return process.env.APP_ENV === "production" ? "; Secure" : "";
+}
+function pathnameOf(path) {
+  const pathname = path.split("?")[0] ?? path;
+  const trimmed = pathname.replace(/\/+$/, "");
+  return trimmed || "/";
+}
+function isStashableIntendedPath(path) {
+  if (!path.startsWith("/") || path.startsWith("//")) {
+    return false;
+  }
+  const pathname = pathnameOf(path);
+  if (SKIP_EXACT_PATHS.has(pathname) || pathname.startsWith("/oauth") || pathname.startsWith("/api/")) {
+    return false;
+  }
+  return true;
+}
+function createIntendedUrlCookie(path) {
+  const sanitized = sanitizeInternalPath(path, "");
+  if (!sanitized || !isStashableIntendedPath(sanitized)) {
+    return null;
+  }
+  return `${intendedUrlCookieName()}=${encodeURIComponent(sanitized)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${intendedUrlTtlSeconds()}${cookieSecureFlag()}`;
+}
+function createIntendedUrlCookieFromRequest(request) {
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    return null;
+  }
+  return createIntendedUrlCookie(safeInternalRedirectPath(request, ""));
+}
+
 // ../../src/core/http/requireWebAuthMiddleware.ts
 function createRequireWebAuthMiddleware(auth2) {
   return async (request, next) => {
@@ -7277,7 +7843,12 @@ function createRequireWebAuthMiddleware(auth2) {
     if (requestPrefersJson(request)) {
       throw new UnauthorizedError;
     }
-    return Response.redirect(loginRedirectLocation(request), 302);
+    const intended = createIntendedUrlCookieFromRequest(request);
+    const headers = new Headers({ Location: loginRedirectLocation(request) });
+    if (intended) {
+      headers.append("Set-Cookie", intended);
+    }
+    return new Response(null, { status: 302, headers });
   };
 }
 // ../../src/core/http/scimThrottleMiddleware.ts
@@ -7350,7 +7921,7 @@ function createSecurityHeadersMiddleware(options = {}) {
   };
 }
 // ../../src/core/http/signedUrl.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 function resolveSignedUrlSecret() {
   return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
 }
@@ -7372,7 +7943,7 @@ function sortedQueryString(params) {
   return new URLSearchParams(entries).toString();
 }
 function signCanonicalPayload(path, query) {
-  return createHmac2("sha256", resolveSignedUrlSecret()).update(`${path}
+  return createHmac3("sha256", resolveSignedUrlSecret()).update(`${path}
 ${query}`).digest("hex");
 }
 function buildSignedSearchParams(path, query = {}, expiresAt) {
@@ -7467,12 +8038,7 @@ function createThrottleMiddleware(options) {
     }
     const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
     if (attempts > maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
     }
     return await next();
   };
@@ -7890,9 +8456,9 @@ function readSharedJobRegistry() {
   if (globalRegistry) {
     return globalRegistry;
   }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
+  const registry2 = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry2;
+  return registry2;
 }
 var jobRegistry = readSharedJobRegistry();
 
@@ -8787,6 +9353,7 @@ export {
   AuthManager,
   BadRequestError,
   baseRepository_default as BaseRepository,
+  BasicAuthGuard,
   BelongsToManyRelationQuery,
   BelongsToRelationQuery,
   Blueprint,
@@ -8813,6 +9380,7 @@ export {
   HttpError,
   Job,
   JsonResource,
+  JwtGuard,
   LocalStorageDriver,
   LogMailDriver,
   Mailer,
@@ -8898,6 +9466,8 @@ export {
   createMembershipMiddleware,
   createMemoryThrottleMiddleware,
   createMetricsMiddleware,
+  createMysqlConnection,
+  createMysqlConnectionFromPool,
   createNotificationDispatcher,
   createProductionQueue,
   createQueue,
@@ -8911,9 +9481,11 @@ export {
   createScimAuthMiddleware,
   createScimThrottleMiddleware,
   createSecurityHeadersMiddleware,
+  createSqliteConnection,
   createStorageDriver,
   createTenantMiddleware,
   createThrottleMiddleware,
+  createTokenAbilityChecker,
   createTracingMiddleware,
   createTrackedJob,
   createValidateSignatureMiddleware,
@@ -8922,11 +9494,13 @@ export {
   currentOrgRole,
   currentOrganizationIds,
   currentRequestMeta,
+  currentSqlDialect,
   currentTenant,
   currentTenantId,
   currentTraceId,
   defineTable,
   dehydrateValue,
+  dialectFor,
   emailRule,
   emptyPaginateResult,
   errorTemplateName,
@@ -8943,10 +9517,13 @@ export {
   getDefaultDatabasePool,
   getDefaultDatabaseQuery,
   getMigrationStatus,
+  getNamedConnection,
   grammarForDriver,
   guestCanViewResource,
+  hasActiveDatabaseConnection,
   hasMany,
   hasMinimumOrgRole2 as hasMinimumOrgRole,
+  hasNamedConnection,
   hasOne,
   hasOrgMembership,
   hasValidSignature,
@@ -8971,6 +9548,7 @@ export {
   isTenancyEnabled,
   jobRegistry,
   jsonResponse2 as jsonResponse,
+  jwtTtlSeconds,
   loadMigrationsFromDirectory,
   loadSeedersFromDirectory,
   log,
@@ -9008,6 +9586,7 @@ export {
   registerDefaultDatabasePool,
   registerModelClass,
   registerModelRepository,
+  registerNamedConnection,
   registerShutdownHandler,
   renderKernelErrorChrome,
   renderMarkdownMail,
@@ -9017,6 +9596,8 @@ export {
   resetBoundDatabaseConnection,
   resetDefaultStorage,
   resetMemoryThrottleForTests,
+  resetNamedConnections,
+  resetSqlDialect,
   resolveApplicationAuth,
   resolveApplicationCache,
   resolveApplicationConfig,
@@ -9043,12 +9624,14 @@ export {
   runDueScheduledTasks,
   runGracefulShutdown,
   runInTransaction,
+  runOnNamedConnection,
   runQueueJob,
   runSeedersFromDirectory,
   runWithAuthUser,
   runWithDatabaseConnection,
   runWithMembershipContext,
   runWithRequestMeta,
+  runWithSqlDialect,
   runWithTenant,
   runWithTenantDatabase,
   runWithTraceContext,
@@ -9062,6 +9645,7 @@ export {
   serializeDate,
   serverHtmxContentSecurityPolicy,
   setActiveApplicationContext,
+  signJwt,
   signedUrl,
   singularize,
   spaContentSecurityPolicy,
@@ -9075,8 +9659,11 @@ export {
   toPaginatedResourceCollection,
   toResourceCollection,
   trustForwardedFor,
+  unregisterNamedConnection,
+  useSqlDialect,
   validateObject,
   verifyCsrfToken,
+  verifyJwt,
   whenLoaded,
   withErrorHandling,
   withMiddleware,