@getstrata/core 0.5.37 → 0.5.39

package/dist/entries/auth/sessionGuard.js

@@ -0,0 +1,2582 @@
+// @bun
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+// ../../src/bootstrap/config.ts
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/core/auth/oauth/oidcProvider.ts
+class OidcProvider {
+  options;
+  name;
+  constructor(options) {
+    this.options = options;
+    this.name = options.name;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      response_type: "code",
+      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
+      state
+    });
+    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.options.redirectUri,
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
+      headers: { authorization: `Bearer ${tokenBody.access_token}` }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: profile.sub,
+      email: profile.email ?? `${profile.sub}@oidc.local`,
+      name: profile.name ?? profile.sub
+    };
+  }
+}
+
+// ../../src/core/auth/oauth/providers.ts
+class GitHubOAuthProvider {
+  options;
+  name = "github";
+  constructor(options) {
+    this.options = options;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      scope: "read:user user:email",
+      state
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret,
+        code,
+        redirect_uri: this.options.redirectUri
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("GitHub OAuth token exchange failed.");
+    }
+    const profileResponse = await fetch("https://api.github.com/user", {
+      headers: {
+        authorization: `Bearer ${tokenBody.access_token}`,
+        accept: "application/json",
+        "user-agent": "workhub"
+      }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: String(profile.id),
+      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
+      name: profile.name ?? profile.login
+    };
+  }
+}
+
+class MockOAuthProvider {
+  profile;
+  name = "mock";
+  constructor(profile) {
+    this.profile = profile;
+  }
+  getAuthorizationUrl(state) {
+    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (code !== "valid-code") {
+      throw new Error("Invalid OAuth code.");
+    }
+    return this.profile;
+  }
+}
+
+// ../../src/core/auth/oauth/samlProvider.ts
+class SamlProvider {
+  loginUrl;
+  name = "saml";
+  constructor(loginUrl) {
+    this.loginUrl = loginUrl;
+  }
+  getAuthorizationUrl(state) {
+    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (!code.startsWith("saml:")) {
+      throw new Error("Invalid SAML assertion reference.");
+    }
+    const [, email, name] = code.split(":");
+    return {
+      providerUserId: email ?? "saml-user",
+      email: email ?? "saml-user@workhub.test",
+      name: name ?? "SAML User"
+    };
+  }
+}
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  listeners = new Map;
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
+  }
+}
+var eventBus = new EventBus;
+
+// ../../src/core/events/index.ts
+function modelEventName(tableName, action) {
+  return `${tableName}.${action}`;
+}
+
+// ../../src/core/pagination/index.ts
+function buildPaginationMeta(input) {
+  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
+  return {
+    page: input.page,
+    per_page: input.perPage,
+    total: input.total,
+    last_page: lastPage
+  };
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/database/errors.ts
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
+  }
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
+  }
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
+  }
+  return;
+}
+function mapDatabaseError(error) {
+  if (error instanceof HttpError) {
+    return error;
+  }
+  if (!isPostgresError(error)) {
+    const message = error instanceof Error ? error.message : "Database operation failed.";
+    return new BadRequestError(message);
+  }
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      return new ConflictError(error.detail ?? "A record with these values already exists.", {
+        constraint: error.constraint
+      });
+    case "23503":
+      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
+        constraint: error.constraint
+      });
+    case "23502":
+      return new BadRequestError(error.detail ?? "Required field is missing.", {
+        constraint: error.constraint
+      });
+    case "23514":
+      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
+        constraint: error.constraint
+      });
+    default:
+      return new BadRequestError(error.message ?? "Database operation failed.", {
+        code: error.code,
+        sqlState
+      });
+  }
+}
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
+  }
+}
+
+// ../../src/core/database/query.ts
+function quoteIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return `"${identifier}"`;
+}
+function qualifyColumn(tableName, column) {
+  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
+}
+function resolveQualifiedColumn(defaultTable, columnName) {
+  if (columnName.includes(".")) {
+    const [table, column] = columnName.split(".", 2);
+    if (!table || !column) {
+      throw new Error(`Invalid qualified column: ${columnName}`);
+    }
+    return qualifyColumn(table, column);
+  }
+  return qualifyColumn(defaultTable, columnName);
+}
+function parseQualifiedColumn(reference) {
+  const [table, column] = reference.split(".", 2);
+  if (!table || !column) {
+    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
+  }
+  return { table, column };
+}
+function normalizeDirection(direction = "ASC") {
+  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
+}
+function isQueryOperator(value) {
+  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
+}
+function pushParam(values, value) {
+  values.push(value);
+  return `$${values.length}`;
+}
+function buildInClause(column, values, params) {
+  if (values.length === 0) {
+    return "1 = 0";
+  }
+  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
+  return `${column} IN (${placeholders})`;
+}
+function buildOperatorClauses(column, operator, params) {
+  const clauses = [];
+  if (operator.isNull === true) {
+    clauses.push(`${column} IS NULL`);
+  }
+  if (operator.isNull === false) {
+    clauses.push(`${column} IS NOT NULL`);
+  }
+  if (operator.eq !== undefined) {
+    if (operator.eq === null) {
+      clauses.push(`${column} IS NULL`);
+    } else {
+      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
+    }
+  }
+  if (operator.in !== undefined) {
+    clauses.push(buildInClause(column, operator.in, params));
+  }
+  if (operator.gt !== undefined) {
+    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
+  }
+  if (operator.gte !== undefined) {
+    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
+  }
+  if (operator.lt !== undefined) {
+    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
+  }
+  if (operator.lte !== undefined) {
+    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
+  }
+  if (operator.ilike !== undefined) {
+    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
+  }
+  if (operator.tsMatch !== undefined) {
+    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
+  }
+  return clauses;
+}
+function appendWhereParts(tableName, where, params) {
+  const clauses = [];
+  for (const [columnName, filterValue] of Object.entries(where)) {
+    if (filterValue === undefined) {
+      continue;
+    }
+    const column = resolveQualifiedColumn(tableName, columnName);
+    if (Array.isArray(filterValue)) {
+      clauses.push(buildInClause(column, filterValue, params));
+      continue;
+    }
+    if (isQueryOperator(filterValue)) {
+      clauses.push(...buildOperatorClauses(column, filterValue, params));
+      continue;
+    }
+    if (filterValue === null) {
+      clauses.push(`${column} IS NULL`);
+      continue;
+    }
+    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
+  }
+  return clauses.join(" AND ");
+}
+function buildWhereNodeClause(tableName, node, params) {
+  if ("where" in node) {
+    return appendWhereParts(tableName, node.where, params);
+  }
+  const grouped = buildWhereGroupClause(tableName, node.group, params);
+  if (!grouped) {
+    return "";
+  }
+  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
+}
+function buildWhereGroupClause(tableName, nodes, params) {
+  let result = "";
+  for (const node of nodes) {
+    const part = buildWhereNodeClause(tableName, node, params);
+    if (!part) {
+      continue;
+    }
+    if (!result) {
+      result = part;
+      continue;
+    }
+    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
+  }
+  if (!result) {
+    return "";
+  }
+  return result;
+}
+function buildAdvancedWhereClause(tableName, where = {}, whereNodes = [], params = []) {
+  const nodes = [];
+  if (Object.keys(where).length > 0) {
+    nodes.push({ kind: "and", where });
+  }
+  nodes.push(...whereNodes);
+  const combined = buildWhereGroupClause(tableName, nodes, params);
+  return {
+    clause: combined ? ` WHERE ${combined}` : "",
+    params
+  };
+}
+function resolveSoftDeleteColumn(table) {
+  if (!table.softDeletes) {
+    return null;
+  }
+  if (table.softDeletes === true) {
+    return "deleted_at";
+  }
+  return table.softDeletes.column ?? "deleted_at";
+}
+function appendSoftDeleteScope(table, options, clauses) {
+  const column = resolveSoftDeleteColumn(table);
+  if (!column) {
+    return;
+  }
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  if (options.onlyTrashed) {
+    clauses.push(`${qualifiedColumn} IS NOT NULL`);
+    return;
+  }
+  if (!options.withTrashed) {
+    clauses.push(`${qualifiedColumn} IS NULL`);
+  }
+}
+function buildQueryWhereClause(table, options = {}, whereNodes = [], params = []) {
+  const { clause, params: whereParams } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes, params);
+  const softDeleteClauses = [];
+  appendSoftDeleteScope(table, options, softDeleteClauses);
+  if (softDeleteClauses.length === 0) {
+    return { clause, params: whereParams };
+  }
+  const base = clause.replace(/^ WHERE /, "");
+  const scope = softDeleteClauses.join(" AND ");
+  return {
+    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
+    params: whereParams
+  };
+}
+function isQueryOrder(value) {
+  return "column" in value;
+}
+function normalizeOrderBy(orderBy) {
+  if (!orderBy) {
+    return [];
+  }
+  if (Array.isArray(orderBy)) {
+    return orderBy;
+  }
+  if (isQueryOrder(orderBy)) {
+    return [orderBy];
+  }
+  return Object.entries(orderBy).map(([column, direction]) => ({
+    column,
+    direction
+  }));
+}
+function buildOrderByClause(tableName, orderBy) {
+  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
+    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
+  });
+  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
+}
+function buildGroupByClause(tableName, groupBy) {
+  if (!groupBy) {
+    return "";
+  }
+  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
+  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
+  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
+}
+function buildHavingClause(tableName, having, params) {
+  if (!having) {
+    return "";
+  }
+  const body = appendWhereParts(tableName, having, params);
+  return body.length > 0 ? ` HAVING ${body}` : "";
+}
+function buildJoinClause(joins = []) {
+  return joins.map((join) => {
+    const joinType = join.type === "left" ? "LEFT JOIN" : "INNER JOIN";
+    const onClause = join.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
+    return ` ${joinType} ${quoteIdentifier(join.table)} ON ${onClause}`;
+  }).join("");
+}
+function buildLimitClause(limit) {
+  if (limit === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new Error("Query limit must be a positive integer.");
+  }
+  return ` LIMIT ${limit}`;
+}
+function buildOffsetClause(offset) {
+  if (offset === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(offset) || offset < 0) {
+    throw new Error("Query offset must be a non-negative integer.");
+  }
+  return ` OFFSET ${offset}`;
+}
+function buildReturningColumns(table) {
+  return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
+}
+function buildSelectList(table, select, params = []) {
+  if (!select || select.length === 0) {
+    return buildReturningColumns(table);
+  }
+  return select.map((item) => {
+    if (item.kind === "column") {
+      const column2 = qualifyColumn(item.table, item.column);
+      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+    }
+    if (item.kind === "literalText") {
+      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+    }
+    const column = qualifyColumn(item.table, item.column);
+    const placeholder = pushParam(params, item.query);
+    return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
+  }).join(", ");
+}
+function getDefinedColumnEntries(table, values, options = {}) {
+  const record = values;
+  const excluded = new Set(options.exclude ?? []);
+  return table.columns.flatMap((column) => {
+    if (excluded.has(column) || !Object.hasOwn(record, column)) {
+      return [];
+    }
+    const value = record[column];
+    if (value === undefined) {
+      return [];
+    }
+    return [[column, value]];
+  });
+}
+function buildSelectQuery(table, options = {}, whereNodes = []) {
+  const params = [];
+  const columns = buildSelectList(table, options.select, params);
+  const { clause } = buildQueryWhereClause(table, options, whereNodes, params);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  const havingClause = buildHavingClause(table.name, options.having, params);
+  const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
+  const limit = buildLimitClause(options.limit);
+  const offset = buildOffsetClause(options.offset);
+  return {
+    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${havingClause}${orderBy}${limit}${offset}`,
+    params
+  };
+}
+function buildCountQuery(table, where = {}, options = {}, whereNodes = []) {
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, {
+    where,
+    withTrashed: options.withTrashed,
+    onlyTrashed: options.onlyTrashed
+  }, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  return {
+    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}`,
+    params
+  };
+}
+function buildProjectionQuery(table, expression, alias, options = {}, whereNodes = []) {
+  assertSafeProjectionExpression(expression);
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  const orderBy = buildOrderByClause(table.name, options.orderBy);
+  const limit = buildLimitClause(options.limit);
+  return {
+    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${orderBy}${limit}`,
+    params
+  };
+}
+var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
+function assertSafeProjectionExpression(expression) {
+  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
+    throw new Error(`Unsafe projection expression: ${expression}`);
+  }
+}
+function buildGroupedCountQuery(table, column, where = {}, options = {}) {
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  const { clause, params } = buildQueryWhereClause(table, {
+    where,
+    ...options
+  });
+  return {
+    text: `SELECT ${qualifiedColumn} AS ${quoteIdentifier("value")}, COUNT(*) AS ${quoteIdentifier("count")} FROM ${quoteIdentifier(table.name)}${clause} GROUP BY ${qualifiedColumn} ORDER BY ${qualifiedColumn} ASC`,
+    params
+  };
+}
+function buildInsertQuery(table, values) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot insert into ${table.name} without any column values.`);
+  }
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildUpdateQuery(table, id, changes) {
+  const entries = getDefinedColumnEntries(table, changes, {
+    exclude: [table.primaryKey]
+  });
+  if (entries.length === 0) {
+    throw new Error(`Cannot update ${table.name} without any changed column values.`);
+  }
+  const params = [];
+  const setClause = entries.map(([column, value]) => `${quoteIdentifier(column)} = ${pushParam(params, value)}`).join(", ");
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildSoftDeleteByIdQuery(table, id, deletedAt) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
+    params: [deletedAt, id]
+  };
+}
+function buildRestoreByIdQuery(table, id) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
+    params: [null, id]
+  };
+}
+function buildDeleteByIdQuery(table, id) {
+  return {
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
+    params: [id]
+  };
+}
+
+// ../../src/core/database/relationships.ts
+function indexHasManyRelation(parents, children, relation) {
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.localKey], []);
+  }
+  for (const child of children) {
+    const key = child[relation.foreignKey];
+    const group = groups.get(key);
+    if (!group) {
+      continue;
+    }
+    group.push(child);
+  }
+  return groups;
+}
+function indexBelongsToRelation(children, parents, relation) {
+  const parentsById = new Map;
+  for (const parent of parents) {
+    parentsById.set(parent[relation.ownerKey], parent);
+  }
+  const result = new Map;
+  for (const child of children) {
+    const foreignKey = child[relation.foreignKey];
+    const parent = parentsById.get(foreignKey);
+    if (parent) {
+      result.set(foreignKey, parent);
+    }
+  }
+  return result;
+}
+function indexMorphManyRelation(parents, children, relation) {
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.localKey], []);
+  }
+  for (const child of children) {
+    if (child[relation.morphTypeKey] !== relation.morphType) {
+      continue;
+    }
+    const key = child[relation.morphIdKey];
+    const group = groups.get(key);
+    if (!group) {
+      continue;
+    }
+    group.push(child);
+  }
+  return groups;
+}
+function indexMorphToRelation(children, parentsByType, relation) {
+  const result = new Map;
+  for (const child of children) {
+    const morphType = String(child[relation.morphTypeKey]);
+    const parents = parentsByType.get(morphType);
+    if (!parents) {
+      continue;
+    }
+    const parent = parents.get(child[relation.morphIdKey]);
+    if (parent) {
+      result.set(child[relation.morphIdKey], parent);
+    }
+  }
+  return result;
+}
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveRepositoryConnection()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/database/whereBuilder.ts
+class WhereBuilder {
+  nodes = [];
+  where(where) {
+    this.nodes.push({ kind: "and", where });
+    return this;
+  }
+  orWhere(where) {
+    this.nodes.push({ kind: "or", where });
+    return this;
+  }
+  whereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "and", group: nested.nodes });
+    }
+    return this;
+  }
+  orWhereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "or", group: nested.nodes });
+    }
+    return this;
+  }
+}
+
+// ../../src/core/database/repositoryQuery.ts
+class RepositoryQuery {
+  repository;
+  whereClause;
+  queryOptions;
+  eagerLoads = [];
+  whereNodes = [];
+  constructor(repository, whereClause = {}, queryOptions = {}) {
+    this.repository = repository;
+    this.whereClause = whereClause;
+    this.queryOptions = queryOptions;
+  }
+  where(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      this.whereNodes.push(...builder.nodes);
+      return this;
+    }
+    this.whereClause = { ...this.whereClause, ...input };
+    return this;
+  }
+  orWhere(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      if (builder.nodes.length > 0) {
+        this.whereNodes.push({ kind: "or", group: builder.nodes });
+      }
+      return this;
+    }
+    this.whereNodes.push({ kind: "or", where: input });
+    return this;
+  }
+  orderBy(orderBy) {
+    this.queryOptions = { ...this.queryOptions, orderBy };
+    return this;
+  }
+  limit(limit) {
+    this.queryOptions = { ...this.queryOptions, limit };
+    return this;
+  }
+  offset(offset) {
+    this.queryOptions = { ...this.queryOptions, offset };
+    return this;
+  }
+  join(left, right) {
+    return this.addJoin("inner", left, right);
+  }
+  leftJoin(left, right) {
+    return this.addJoin("left", left, right);
+  }
+  groupBy(groupBy) {
+    this.queryOptions = { ...this.queryOptions, groupBy };
+    return this;
+  }
+  having(having) {
+    this.queryOptions = { ...this.queryOptions, having };
+    return this;
+  }
+  withHasMany(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "hasMany",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withBelongsTo(as, relation, parentRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "belongsTo",
+      as,
+      relation,
+      repository: parentRepository,
+      options
+    });
+    return this;
+  }
+  withMorphMany(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphMany",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withMorphOne(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphOne",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withMorphTo(as, relation, repositoriesByType, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphTo",
+      as,
+      relation,
+      repository: this.repository,
+      morphRepositories: repositoriesByType,
+      options
+    });
+    return this;
+  }
+  async get() {
+    const rows = await this.repository.findAll(this.buildOptions());
+    return await this.attach(rows);
+  }
+  async first() {
+    const rows = await this.get();
+    return rows[0] ?? null;
+  }
+  async paginate(options) {
+    return await this.repository.paginate({
+      ...this.buildOptions(),
+      page: options.page,
+      perPage: options.perPage
+    });
+  }
+  buildOptions() {
+    return {
+      ...this.queryOptions,
+      where: this.whereClause,
+      whereNodes: this.whereNodes
+    };
+  }
+  addJoin(type, left, right) {
+    const leftRef = parseQualifiedColumn(left);
+    const rightRef = parseQualifiedColumn(right);
+    const table = type === "inner" ? rightRef.table : rightRef.table;
+    const joins = this.queryOptions.joins ?? [];
+    const existing = joins.find((join) => join.table === table && join.type === type);
+    if (existing) {
+      existing.on.push({ left: leftRef, right: rightRef });
+      return this;
+    }
+    this.queryOptions = {
+      ...this.queryOptions,
+      joins: [
+        ...joins,
+        {
+          type,
+          table,
+          on: [{ left: leftRef, right: rightRef }]
+        }
+      ]
+    };
+    return this;
+  }
+  async attach(rows) {
+    if (rows.length === 0 || this.eagerLoads.length === 0) {
+      return rows.map((row) => ({ ...row }));
+    }
+    let result = rows.map((row) => ({ ...row }));
+    for (const load of this.eagerLoads) {
+      if (load.kind === "hasMany") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
+        }));
+        continue;
+      }
+      if (load.kind === "morphMany") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
+        }));
+        continue;
+      }
+      if (load.kind === "morphOne") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey])
+        }));
+        continue;
+      }
+      if (load.kind === "morphTo") {
+        const relation2 = load.relation;
+        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.morphIdKey])
+        }));
+        continue;
+      }
+      const relation = load.relation;
+      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
+      result = result.map((row) => ({
+        ...row,
+        [load.as]: grouped.get(row[relation.foreignKey])
+      }));
+    }
+    return result;
+  }
+}
+
+// ../../src/core/database/baseRepository.ts
+class BaseRepository {
+  table;
+  connection;
+  constructor(table, connection = repositoryConnection) {
+    this.table = table;
+    this.connection = connection;
+  }
+  async findAll(options = {}) {
+    return await withDatabaseErrorHandling(async () => {
+      const { whereNodes, ...queryOptions } = options;
+      const { text, params } = buildSelectQuery(this.table, queryOptions, whereNodes ?? []);
+      return await this.connection.unsafe(text, params);
+    });
+  }
+  async paginate(options) {
+    const { whereNodes, where = {}, page, perPage, ...queryOptions } = options;
+    const total = await this.countWhere(where, {
+      withTrashed: options.withTrashed,
+      onlyTrashed: options.onlyTrashed,
+      joins: options.joins,
+      groupBy: options.groupBy
+    }, whereNodes);
+    const offset = (page - 1) * perPage;
+    const data = await this.findAll({
+      ...queryOptions,
+      where,
+      whereNodes,
+      limit: perPage,
+      offset
+    });
+    return {
+      data,
+      meta: buildPaginationMeta({ page, perPage, total })
+    };
+  }
+  async chunk(count, callback, options = {}) {
+    if (!Number.isInteger(count) || count <= 0) {
+      throw new Error("Chunk size must be a positive integer.");
+    }
+    let offset = 0;
+    while (true) {
+      const rows = await this.findAll({
+        ...options,
+        limit: count,
+        offset
+      });
+      if (rows.length === 0) {
+        return;
+      }
+      const shouldContinue = await callback(rows);
+      if (shouldContinue === false || rows.length < count) {
+        return;
+      }
+      offset += count;
+    }
+  }
+  async cursorPaginate(options) {
+    const {
+      perPage,
+      cursor,
+      cursorColumn = this.table.primaryKey,
+      direction = "asc",
+      where = {},
+      whereNodes,
+      ...queryOptions
+    } = options;
+    if (!Number.isInteger(perPage) || perPage <= 0) {
+      throw new Error("Cursor page size must be a positive integer.");
+    }
+    const cursorWhere = { ...where };
+    if (cursor !== undefined) {
+      cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
+    }
+    const rows = await this.findAll({
+      ...queryOptions,
+      where: cursorWhere,
+      whereNodes,
+      orderBy: { [cursorColumn]: direction },
+      limit: perPage + 1
+    });
+    const hasMore = rows.length > perPage;
+    const data = hasMore ? rows.slice(0, perPage) : rows;
+    const nextCursor = hasMore ? data[data.length - 1]?.[cursorColumn] ?? null : null;
+    const prevCursor = cursor ?? null;
+    return {
+      data,
+      meta: {
+        per_page: perPage,
+        next_cursor: nextCursor,
+        prev_cursor: prevCursor,
+        has_more: hasMore
+      }
+    };
+  }
+  async findById(id) {
+    return await this.firstOrNull({
+      [this.table.primaryKey]: id
+    });
+  }
+  async findByIdOrThrow(id, errorFactory) {
+    const record = await this.findById(id);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async findByIds(ids) {
+    const uniqueIds = [...new Set(ids)];
+    if (uniqueIds.length === 0) {
+      return [];
+    }
+    return await this.findWhere({
+      [this.table.primaryKey]: uniqueIds
+    });
+  }
+  async firstOrNull(where, options = {}) {
+    const [record] = await this.findAll({ ...options, where, limit: 1 });
+    return record ?? null;
+  }
+  async create(values) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildInsertQuery(this.table, values);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        throw new Error(`Insert into ${this.table.name} did not return a record.`);
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "created"), entity);
+      return entity;
+    });
+  }
+  async updateById(id, changes) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildUpdateQuery(this.table, id, changes);
+      const [record] = await this.connection.unsafe(text, params);
+      const entity = record ?? null;
+      if (entity) {
+        await eventBus.dispatch(modelEventName(this.table.name, "updated"), entity);
+      }
+      return entity;
+    });
+  }
+  async updateByIdOrThrow(id, changes, errorFactory) {
+    const record = await this.updateById(id, changes);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async deleteById(id) {
+    if (resolveSoftDeleteColumn(this.table)) {
+      return await this.softDeleteById(id);
+    }
+    return await this.forceDeleteById(id);
+  }
+  async softDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "deleted"), record);
+      return true;
+    });
+  }
+  async forceDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildDeleteByIdQuery(this.table, id);
+      const [row] = await this.connection.unsafe(text, params);
+      if (!row) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "force-deleted"), {
+        id
+      });
+      return true;
+    });
+  }
+  async restoreById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildRestoreByIdQuery(this.table, id);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return null;
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "restored"), entity);
+      return entity;
+    });
+  }
+  withConnection(connection) {
+    const clone = Object.create(Object.getPrototypeOf(this));
+    Object.assign(clone, this);
+    clone.connection = connection;
+    return clone;
+  }
+  getConnection() {
+    return this.connection;
+  }
+  getTable() {
+    return this.table;
+  }
+  query(where = {}) {
+    return new RepositoryQuery(this, where);
+  }
+  async findWhere(where, options = {}) {
+    return await this.findAll({ ...options, where });
+  }
+  async countWhere(where = {}, options = {}, whereNodes = []) {
+    const { text, params } = buildCountQuery(this.table, where, options, whereNodes);
+    const [row] = await this.connection.unsafe(text, params);
+    return Number(row?.count ?? 0);
+  }
+  async averageColumn(column, where = {}) {
+    const qualifiedColumn = qualifyColumn(this.table.name, column);
+    return await this.averageExpression(`AVG(${qualifiedColumn})`, "value", where);
+  }
+  async averageExpression(expression, alias, where = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
+    const [row] = await this.connection.unsafe(text, params);
+    return Math.round(Number(row?.[alias] ?? 0));
+  }
+  async pluckNumberValues(expression, alias, options = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.flatMap((row) => {
+      const value = row[alias];
+      return value === null || value === undefined ? [] : [Number(value)];
+    });
+  }
+  async countGroupedBy(column, where = {}) {
+    const { text, params } = buildGroupedCountQuery(this.table, column, where);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.map(({ value, count }) => ({
+      value,
+      count: Number(count)
+    }));
+  }
+  async findByHasManyRelation(relation, parentId, options = {}) {
+    return await this.findWhere({
+      [relation.foreignKey]: parentId
+    }, options);
+  }
+  async loadHasManyForParents(parents, relation, options = {}) {
+    if (parents.length === 0) {
+      return indexHasManyRelation(parents, [], relation);
+    }
+    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
+    const children = await this.findWhere({
+      [relation.foreignKey]: parentIds
+    }, options);
+    return indexHasManyRelation(parents, children, relation);
+  }
+  async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
+    if (children.length === 0) {
+      return new Map;
+    }
+    const ownerIds = [...new Set(children.map((child) => child[relation.foreignKey]))];
+    const parents = await parentRepository.withConnection(this.connection).findWhere({
+      [relation.ownerKey]: ownerIds
+    }, options);
+    return indexBelongsToRelation(children, parents, relation);
+  }
+  async loadMorphManyForParents(parents, relation, options = {}) {
+    if (parents.length === 0) {
+      return indexMorphManyRelation(parents, [], relation);
+    }
+    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
+    const children = await this.findWhere({
+      [relation.morphTypeKey]: relation.morphType,
+      [relation.morphIdKey]: parentIds
+    }, options);
+    return indexMorphManyRelation(parents, children, relation);
+  }
+  async loadMorphOneForParents(parents, relation, options = {}) {
+    const grouped = await this.loadMorphManyForParents(parents, relation, options);
+    const result = new Map;
+    for (const parent of parents) {
+      const matches = grouped.get(parent[relation.localKey]) ?? [];
+      result.set(parent[relation.localKey], matches[0]);
+    }
+    return result;
+  }
+  async loadMorphToForChildren(children, relation, repositoriesByType, options = {}) {
+    if (children.length === 0) {
+      return new Map;
+    }
+    const idsByType = new Map;
+    for (const child of children) {
+      const morphType = String(child[relation.morphTypeKey]);
+      const morphId = child[relation.morphIdKey];
+      const ids = idsByType.get(morphType) ?? new Set;
+      ids.add(morphId);
+      idsByType.set(morphType, ids);
+    }
+    const parentsByType = new Map;
+    for (const [morphType, ids] of idsByType) {
+      const repository = repositoriesByType.get(morphType);
+      if (!repository) {
+        continue;
+      }
+      const ownerKey = repository.getTable().primaryKey;
+      const parents = await repository.withConnection(this.connection).findWhere({
+        [ownerKey]: [...ids]
+      }, options);
+      const indexed = new Map;
+      for (const parent of parents) {
+        indexed.set(parent[ownerKey], parent);
+      }
+      parentsByType.set(morphType, indexed);
+    }
+    return indexMorphToRelation(children, parentsByType, relation);
+  }
+}
+var baseRepository_default = BaseRepository;
+// ../../src/core/database/model.ts
+var modelRepositories = new WeakMap;
+var modelGlobalScopes = new WeakMap;
+var modelBooted = new WeakSet;
+// ../../src/core/database/schema/columnDefinition.ts
+class ColumnDefinition {
+  name;
+  kind;
+  length;
+  isNullable = false;
+  isPrimary = false;
+  isUnique = false;
+  autoIncrement = false;
+  defaultValue;
+  checkExpression;
+  foreignKey;
+  constructor(name, kind) {
+    this.name = name;
+    this.kind = kind;
+  }
+  nullable() {
+    this.isNullable = true;
+    return this;
+  }
+  notNullable() {
+    this.isNullable = false;
+    return this;
+  }
+  default(value) {
+    if (typeof value === "boolean") {
+      this.defaultValue = value ? "TRUE" : "FALSE";
+      return this;
+    }
+    if (typeof value === "number") {
+      this.defaultValue = String(value);
+      return this;
+    }
+    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
+    return this;
+  }
+  defaultRaw(expression) {
+    this.defaultValue = expression;
+    return this;
+  }
+  unique() {
+    this.isUnique = true;
+    return this;
+  }
+  primary() {
+    this.isPrimary = true;
+    return this;
+  }
+  check(expression) {
+    this.checkExpression = expression;
+    return this;
+  }
+}
+
+class ForeignIdColumnDefinition extends ColumnDefinition {
+  constructor(name) {
+    super(name, "foreignId");
+    this.notNullable();
+  }
+  references(table, column = "id") {
+    this.foreignKey = {
+      referencesTable: table,
+      referencesColumn: column
+    };
+    return this;
+  }
+  constrained(table) {
+    const referencesTable = table ?? inferReferencedTable(this.name);
+    return this.references(referencesTable);
+  }
+  cascadeOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "cascade";
+    return this;
+  }
+  nullOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "set null";
+    return this;
+  }
+}
+function inferReferencedTable(columnName) {
+  if (!columnName.endsWith("_id")) {
+    throw new Error(`Cannot infer referenced table from column ${columnName}`);
+  }
+  return columnName.slice(0, -3);
+}
+
+// ../../src/core/database/schema/blueprint.ts
+class Blueprint {
+  table;
+  action;
+  columns = [];
+  indexes = [];
+  droppedColumns = [];
+  droppedIndexes = [];
+  constructor(table, action) {
+    this.table = table;
+    this.action = action;
+  }
+  id(name = "id") {
+    const column = new ColumnDefinition(name, "id");
+    column.primary();
+    column.autoIncrement = true;
+    this.columns.push(column);
+    return column;
+  }
+  string(name, length) {
+    const column = new ColumnDefinition(name, "string");
+    column.length = length;
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  text(name) {
+    const column = new ColumnDefinition(name, "text");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  boolean(name) {
+    const column = new ColumnDefinition(name, "boolean");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  integer(name) {
+    const column = new ColumnDefinition(name, "integer");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  bigInteger(name) {
+    const column = new ColumnDefinition(name, "bigInteger");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  timestamp(name) {
+    const column = new ColumnDefinition(name, "timestamp");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  json(name) {
+    const column = new ColumnDefinition(name, "json");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  jsonb(name) {
+    const column = new ColumnDefinition(name, "jsonb");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  foreignId(name) {
+    const column = new ForeignIdColumnDefinition(name);
+    this.columns.push(column);
+    return column;
+  }
+  timestamps() {
+    this.timestamp("created_at").defaultRaw("NOW()");
+    this.timestamp("updated_at").defaultRaw("NOW()");
+  }
+  softDeletes() {
+    this.timestamp("deleted_at").nullable();
+  }
+  dropColumn(name) {
+    this.droppedColumns.push(name);
+  }
+  dropSoftDeletes() {
+    this.dropColumn("deleted_at");
+    this.dropIndex(`idx_${this.table}_deleted_at`);
+  }
+  dropIndex(name) {
+    this.droppedIndexes.push(name);
+  }
+  unique(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "unique"
+    });
+  }
+  index(columns, options = {}) {
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "index",
+      order: options.order
+    });
+  }
+  partialIndex(columns, where, nameOrOptions) {
+    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: options.unique ? "uniquePartial" : "partial",
+      where
+    });
+  }
+  fullText(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "fullText"
+    });
+  }
+  ginIndex(column, name) {
+    this.indexes.push({
+      name,
+      columns: [column],
+      kind: "gin"
+    });
+  }
+}
+// ../../src/core/database/schema/errors.ts
+class UnsupportedSchemaFeatureError extends Error {
+  constructor(feature, driver) {
+    super(`${feature} is not supported for the ${driver} driver`);
+    this.name = "UnsupportedSchemaFeatureError";
+  }
+}
+// ../../src/core/database/schema/grammars/grammar.ts
+function compileColumnType(driver, column) {
+  switch (column.kind) {
+    case "id":
+      return compileIdType(driver);
+    case "string":
+      return compileStringType(driver, column.length);
+    case "text":
+      return compileTextType(driver);
+    case "boolean":
+      return compileBooleanType(driver);
+    case "integer":
+    case "foreignId":
+      return compileIntegerType(driver);
+    case "bigInteger":
+      return compileBigIntegerType(driver);
+    case "timestamp":
+      return compileTimestampType(driver);
+    case "json":
+      return compileJsonType(driver);
+    case "jsonb":
+      return compileJsonbType(driver);
+    default:
+      throw new Error(`Unsupported column kind: ${column.kind}`);
+  }
+}
+function compileIdType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "SERIAL";
+    case "mysql":
+      return "BIGINT UNSIGNED";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileStringType(driver, length) {
+  switch (driver) {
+    case "pgsql":
+      return "TEXT";
+    case "mysql":
+      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileTextType(driver) {
+  switch (driver) {
+    case "pgsql":
+    case "sqlite":
+      return "TEXT";
+    case "mysql":
+      return "TEXT";
+  }
+}
+function compileBooleanType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BOOLEAN";
+    case "mysql":
+      return "BOOLEAN";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "INTEGER";
+    case "mysql":
+      return "INT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileBigIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BIGINT";
+    case "mysql":
+      return "BIGINT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileTimestampType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "TIMESTAMPTZ";
+    case "mysql":
+      return "TIMESTAMP";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonbType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+
+// ../../src/core/database/schema/grammars/compileStatements.ts
+function compileCreateTable(driver, blueprint) {
+  const table = quoteIdentifier(blueprint.table);
+  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length > 1) {
+      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+      parts.push(`UNIQUE (${columns})`);
+    }
+  }
+  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
+  ${parts.join(`,
+  `)}
+)`];
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length === 1) {
+      continue;
+    }
+    if (index.kind === "index") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileAlterTable(driver, blueprint) {
+  const statements = [];
+  const table = quoteIdentifier(blueprint.table);
+  for (const column of blueprint.columns) {
+    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
+    statements.push(`ALTER TABLE ${table}
+${addPrefix} ${compileColumn(driver, column, "alter")}`);
+  }
+  for (const columnName of blueprint.droppedColumns) {
+    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
+    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
+  }
+  for (const indexName of blueprint.droppedIndexes) {
+    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
+  }
+  for (const index of blueprint.indexes) {
+    if (index.kind === "index" || index.kind === "unique") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileDropTable(driver, tableName) {
+  const cascade = driver === "pgsql" ? " CASCADE" : "";
+  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
+}
+function compileColumn(driver, column, mode) {
+  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
+  if (column.autoIncrement && driver === "mysql") {
+    parts[1] = `${parts[1]} AUTO_INCREMENT`;
+  }
+  if (column.isPrimary && mode === "create") {
+    if (driver === "sqlite") {
+      parts.push("PRIMARY KEY AUTOINCREMENT");
+    } else {
+      parts.push("PRIMARY KEY");
+    }
+  } else if (!column.isNullable) {
+    parts.push("NOT NULL");
+  } else if (column.isNullable) {
+    parts.push("NULL");
+  }
+  if (column.defaultValue !== undefined) {
+    parts.push(`DEFAULT ${column.defaultValue}`);
+  }
+  if (column.isUnique) {
+    parts.push("UNIQUE");
+  }
+  if (column.checkExpression) {
+    parts.push(`CHECK (${column.checkExpression})`);
+  }
+  if (column.foreignKey) {
+    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
+    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
+    let clause = `REFERENCES ${reference}`;
+    if (onDelete === "cascade") {
+      clause += " ON DELETE CASCADE";
+    } else if (onDelete === "set null") {
+      clause += " ON DELETE SET NULL";
+    }
+    parts.push(clause);
+  }
+  return parts.join(" ");
+}
+function compileIndex(_driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
+  const columns = index.columns.map((column) => {
+    const quoted = quoteIdentifier(column);
+    if (index.order === "desc") {
+      return `${quoted} DESC`;
+    }
+    return quoted;
+  }).join(", ");
+  const unique = index.kind === "unique" ? "UNIQUE " : "";
+  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
+}
+function compileSpecialIndex(driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
+  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+  switch (index.kind) {
+    case "partial":
+    case "uniquePartial": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
+      }
+      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
+      return [
+        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
+      ];
+    }
+    case "gin": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
+      }
+      return [
+        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
+      ];
+    }
+    case "fullText": {
+      if (driver === "mysql") {
+        return [
+          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
+        ];
+      }
+      if (driver === "pgsql") {
+        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
+      }
+      throw new UnsupportedSchemaFeatureError("fullText()", driver);
+    }
+    default:
+      return [];
+  }
+}
+function defaultIndexName(tableName, columns, kind) {
+  return `idx_${tableName}_${columns.join("_")}_${kind}`;
+}
+function compileBlueprint(driver, blueprint) {
+  switch (blueprint.action) {
+    case "create":
+      return compileCreateTable(driver, blueprint);
+    case "alter":
+      return compileAlterTable(driver, blueprint);
+    case "drop":
+      return compileDropTable(driver, blueprint.table);
+    default:
+      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+  }
+}
+// ../../src/core/database/schema/grammars/createGrammar.ts
+function createGrammar(driver) {
+  return {
+    driver,
+    compile(blueprint) {
+      return compileBlueprint(driver, blueprint);
+    }
+  };
+}
+
+// ../../src/core/database/schema/grammars/mysqlGrammar.ts
+var MySqlGrammar = createGrammar("mysql");
+
+// ../../src/core/database/schema/grammars/postgresGrammar.ts
+var PostgresGrammar = createGrammar("pgsql");
+
+// ../../src/core/database/schema/grammars/sqliteGrammar.ts
+var SqliteGrammar = createGrammar("sqlite");
+
+// ../../src/core/database/schema/grammars/index.ts
+function grammarForDriver(driver) {
+  switch (driver) {
+    case "pgsql":
+      return PostgresGrammar;
+    case "mysql":
+      return MySqlGrammar;
+    case "sqlite":
+      return SqliteGrammar;
+    default:
+      throw new Error(`Unsupported database driver: ${driver}`);
+  }
+}
+// ../../src/core/database/schema/schema.ts
+class SchemaBuilder {
+  #driver;
+  #statements = [];
+  constructor(driver) {
+    this.#driver = driver;
+  }
+  create(table, callback) {
+    const blueprint = new Blueprint(table, "create");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  table(table, callback) {
+    const blueprint = new Blueprint(table, "alter");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  drop(table) {
+    const blueprint = new Blueprint(table, "drop");
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  toSql() {
+    return [...this.#statements];
+  }
+  async execute(db) {
+    for (const statement of this.#statements) {
+      await db.unsafe(statement);
+    }
+  }
+}
+// ../../src/core/database/table.ts
+function defineTable(definition) {
+  return definition;
+}
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection2(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/modules/user/apiTokenTable.ts
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
+}
+function encryptField(plaintext, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+function hashLookupValue(normalizedValue, key) {
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function protectMfaSecret(secret) {
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key) {
+    return secret;
+  }
+  return encryptField(secret, key);
+}
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
+  }
+  return decryptField(stored, key);
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
+  }
+  return parsed;
+}
+
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2 } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
+  }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
+}
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
+  }
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationTable.ts
+var notificationTable = defineTable({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+var oauthIdentityTable = defineTable({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/table.ts
+var userTable = defineTable({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/tokenHash.ts
+import { createHash, createHmac as createHmac3 } from "crypto";
+function resolveTokenPepper() {
+  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+}
+function hashApiToken(token) {
+  const pepper = resolveTokenPepper();
+  if (pepper && pepper !== "workhub-dev-token-pepper") {
+    return createHmac3("sha256", pepper).update(token).digest("hex");
+  }
+  return createHash("sha256").update(token).digest("hex");
+}
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/sessionCookie.ts
+import { createHmac as createHmac4, timingSafeEqual } from "crypto";
+var SESSION_COOKIE = "workhub_session";
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function resolveSessionSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
+}
+function signSession(userId, issuedAt) {
+  const payload = `${userId}.${issuedAt}`;
+  const signature = createHmac4("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCookieValue(request, cookieName) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === cookieName) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function readSessionUserId(request) {
+  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  const userId = Number.parseInt(String(userIdRaw), 10);
+  const issuedAt = Number.parseInt(String(issuedAtRaw), 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > SESSION_TTL_SECONDS * 1000) {
+    return null;
+  }
+  const expectedSignature = signSession(userId, issuedAt).split(".").pop();
+  if (!expectedSignature || !cookieSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return userId;
+}
+function createSessionCookie(userId) {
+  const issuedAt = Date.now();
+  const value = signSession(userId, issuedAt);
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${SESSION_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+}
+function clearSessionCookie() {
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+}
+
+// ../../src/core/auth/sessionGuard.ts
+class SessionGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const userId = readSessionUserId(request);
+    if (!userId) {
+      return null;
+    }
+    if (!this.container.has(tokenServiceToken)) {
+      return null;
+    }
+    const tokenService = this.container.resolve(tokenServiceToken);
+    try {
+      const user = await tokenService.findByIdOrThrow(userId);
+      return {
+        id: user.id,
+        role: user.role,
+        abilities: resolveAbilitiesForRole(user.role)
+      };
+    } catch {
+      return null;
+    }
+  }
+}
+export {
+  SessionGuard
+};