@getstrata/core 0.5.48 → 0.5.49

package/dist/entries/auth/sessionGuard.js

@@ -37,2514 +37,137 @@ function resolveAbilitiesForRole(role) {
   return [...MEMBER_ABILITIES];
 }
 
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_CONFIG_TOKEN = "core.config";
-var CORE_CACHE_TOKEN = "core.cache";
-var CORE_QUEUE_TOKEN = "core.queue";
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
-var CORE_POLICY_GATE_TOKEN = "core.policyGate";
-var CORE_AUTH_TOKEN = "core.auth";
-var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
+import {
+  CORE_AUTH_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
 var DEFAULT_QUEUE_DRIVER = "sync";
 
-// ../../src/core/auth/oauth/oidcProvider.ts
-class OidcProvider {
-  options;
-  name;
-  constructor(options) {
-    this.options = options;
-    this.name = options.name;
-  }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      response_type: "code",
-      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
-      state
-    });
-    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.options.redirectUri,
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("OIDC token exchange failed.");
-    }
-    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
-      headers: { authorization: `Bearer ${tokenBody.access_token}` }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: profile.sub,
-      email: profile.email ?? `${profile.sub}@oidc.local`,
-      name: profile.name ?? profile.sub
-    };
-  }
-}
-
-// ../../src/core/auth/oauth/providers.ts
-class GitHubOAuthProvider {
-  options;
-  name = "github";
-  constructor(options) {
-    this.options = options;
-  }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      scope: "read:user user:email",
-      state
-    });
-    return `https://github.com/login/oauth/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret,
-        code,
-        redirect_uri: this.options.redirectUri
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("GitHub OAuth token exchange failed.");
-    }
-    const profileResponse = await fetch("https://api.github.com/user", {
-      headers: {
-        authorization: `Bearer ${tokenBody.access_token}`,
-        accept: "application/json",
-        "user-agent": "workhub"
-      }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: String(profile.id),
-      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
-      name: profile.name ?? profile.login
-    };
-  }
-}
-
-class MockOAuthProvider {
-  profile;
-  name = "mock";
-  constructor(profile) {
-    this.profile = profile;
-  }
-  getAuthorizationUrl(state) {
-    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
-  }
-  async exchangeCode(code) {
-    if (code !== "valid-code") {
-      throw new Error("Invalid OAuth code.");
-    }
-    return this.profile;
-  }
-}
-
-// ../../src/core/auth/oauth/samlProvider.ts
-class SamlProvider {
-  loginUrl;
-  name = "saml";
-  constructor(loginUrl) {
-    this.loginUrl = loginUrl;
-  }
-  getAuthorizationUrl(state) {
-    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
-  }
-  async exchangeCode(code) {
-    if (!code.startsWith("saml:")) {
-      throw new Error("Invalid SAML assertion reference.");
-    }
-    const [, email, name] = code.split(":");
-    return {
-      providerUserId: email ?? "saml-user",
-      email: email ?? "saml-user@workhub.test",
-      name: name ?? "SAML User"
-    };
-  }
-}
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/core/events/eventBus.ts
-class EventBus {
-  constructor() {}
-  listeners = new Map;
-  listen(event, listener) {
-    const handlers = this.listeners.get(event) ?? new Set;
-    handlers.add(listener);
-    this.listeners.set(event, handlers);
-    return () => {
-      handlers.delete(listener);
-      if (handlers.size === 0) {
-        this.listeners.delete(event);
-      }
-    };
-  }
-  async dispatch(event, payload) {
-    const handlers = this.listeners.get(event);
-    if (!handlers || handlers.size === 0) {
-      return;
-    }
-    for (const handler of handlers) {
-      await handler(payload);
-    }
-  }
-}
-var eventBus = new EventBus;
-
-// ../../src/core/events/index.ts
-function modelEventName(tableName, action) {
-  return `${tableName}.${action}`;
-}
-
-// ../../src/core/pagination/index.ts
-function buildPaginationMeta(input) {
-  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
-  return {
-    page: input.page,
-    per_page: input.perPage,
-    total: input.total,
-    last_page: lastPage
-  };
-}
-
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-
-class BadRequestError extends HttpError {
-  constructor(message = "Bad Request", details) {
-    super(400, message, details);
-  }
-}
-
-class NotFoundError extends HttpError {
-  constructor(message = "Not Found", details) {
-    super(404, message, details);
-  }
-}
-
-class ConflictError extends HttpError {
-  constructor(message = "Conflict", details) {
-    super(409, message, details);
-  }
-}
-
-class UnprocessableEntityError extends HttpError {
-  constructor(message = "Unprocessable Entity", details) {
-    super(422, message, details);
-  }
-}
-
-class ValidationError extends HttpError {
-  constructor(message = "Validation failed", details) {
-    super(422, message, details);
-  }
-}
-
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
-class PreconditionFailedError extends HttpError {
-  constructor(message = "Precondition Failed", details) {
-    super(412, message, details);
-  }
-}
-
-// ../../src/core/database/errors.ts
-function isPostgresError(error) {
-  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
-}
-function getPostgresSqlState(error) {
-  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
-    return error.errno;
-  }
-  if (typeof error.errno === "number") {
-    return String(error.errno).padStart(5, "0");
-  }
-  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
-    return error.code;
-  }
-  return;
-}
-function mapDatabaseError(error) {
-  if (error instanceof HttpError) {
-    return error;
-  }
-  if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
-  }
-  const sqlState = getPostgresSqlState(error);
-  switch (sqlState) {
-    case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
-    case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
-    case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
-    case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
-    default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
-  }
-}
-async function withDatabaseErrorHandling(operation) {
-  try {
-    return await operation();
-  } catch (error) {
-    throw mapDatabaseError(error);
-  }
-}
-
-// ../../src/core/database/query.ts
-function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
-}
-function qualifyColumn(tableName, column) {
-  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
-}
-function resolveQualifiedColumn(defaultTable, columnName) {
-  if (columnName.includes(".")) {
-    const [table, column] = columnName.split(".", 2);
-    if (!table || !column) {
-      throw new Error(`Invalid qualified column: ${columnName}`);
-    }
-    return qualifyColumn(table, column);
-  }
-  return qualifyColumn(defaultTable, columnName);
-}
-function parseQualifiedColumn(reference) {
-  const [table, column] = reference.split(".", 2);
-  if (!table || !column) {
-    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
-  }
-  return { table, column };
-}
-function normalizeDirection(direction = "ASC") {
-  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
-}
-function isQueryOperator(value) {
-  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
-}
-function pushParam(values, value) {
-  values.push(value);
-  return `$${values.length}`;
-}
-function buildInClause(column, values, params) {
-  if (values.length === 0) {
-    return "1 = 0";
-  }
-  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
-}
-function buildOperatorClauses(column, operator, params) {
-  const clauses = [];
-  if (operator.isNull === true) {
-    clauses.push(`${column} IS NULL`);
-  }
-  if (operator.isNull === false) {
-    clauses.push(`${column} IS NOT NULL`);
-  }
-  if (operator.eq !== undefined) {
-    if (operator.eq === null) {
-      clauses.push(`${column} IS NULL`);
-    } else {
-      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
-    }
-  }
-  if (operator.in !== undefined) {
-    clauses.push(buildInClause(column, operator.in, params));
-  }
-  if (operator.gt !== undefined) {
-    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
-  }
-  if (operator.gte !== undefined) {
-    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
-  }
-  if (operator.lt !== undefined) {
-    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
-  }
-  if (operator.lte !== undefined) {
-    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
-  }
-  if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
-  }
-  if (operator.tsMatch !== undefined) {
-    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
-  }
-  return clauses;
-}
-function appendWhereParts(tableName, where, params) {
-  const clauses = [];
-  for (const [columnName, filterValue] of Object.entries(where)) {
-    if (filterValue === undefined) {
-      continue;
-    }
-    const column = resolveQualifiedColumn(tableName, columnName);
-    if (Array.isArray(filterValue)) {
-      clauses.push(buildInClause(column, filterValue, params));
-      continue;
-    }
-    if (isQueryOperator(filterValue)) {
-      clauses.push(...buildOperatorClauses(column, filterValue, params));
-      continue;
-    }
-    if (filterValue === null) {
-      clauses.push(`${column} IS NULL`);
-      continue;
-    }
-    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
-  }
-  return clauses.join(" AND ");
-}
-function buildWhereClause(tableName, where = {}) {
-  const params = [];
-  const body = appendWhereParts(tableName, where, params);
-  return {
-    clause: body.length > 0 ? ` WHERE ${body}` : "",
-    params
-  };
-}
-function buildWhereNodeClause(tableName, node, params) {
-  if ("where" in node) {
-    return appendWhereParts(tableName, node.where, params);
-  }
-  const grouped = buildWhereGroupClause(tableName, node.group, params);
-  if (!grouped) {
-    return "";
-  }
-  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
-}
-function buildWhereGroupClause(tableName, nodes, params) {
-  let result = "";
-  for (const node of nodes) {
-    const part = buildWhereNodeClause(tableName, node, params);
-    if (!part) {
-      continue;
-    }
-    if (!result) {
-      result = part;
-      continue;
-    }
-    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
-  }
-  if (!result) {
-    return "";
-  }
-  return result;
-}
-function buildAdvancedWhereClause(tableName, where = {}, whereNodes = [], params = []) {
-  const nodes = [];
-  if (Object.keys(where).length > 0) {
-    nodes.push({ kind: "and", where });
-  }
-  nodes.push(...whereNodes);
-  const combined = buildWhereGroupClause(tableName, nodes, params);
-  return {
-    clause: combined ? ` WHERE ${combined}` : "",
-    params
-  };
-}
-function resolveSoftDeleteColumn(table) {
-  if (!table.softDeletes) {
-    return null;
-  }
-  if (table.softDeletes === true) {
-    return "deleted_at";
-  }
-  return table.softDeletes.column ?? "deleted_at";
-}
-function appendSoftDeleteScope(table, options, clauses) {
-  const column = resolveSoftDeleteColumn(table);
-  if (!column) {
-    return;
-  }
-  const qualifiedColumn = qualifyColumn(table.name, column);
-  if (options.onlyTrashed) {
-    clauses.push(`${qualifiedColumn} IS NOT NULL`);
-    return;
-  }
-  if (!options.withTrashed) {
-    clauses.push(`${qualifiedColumn} IS NULL`);
-  }
-}
-function buildQueryWhereClause(table, options = {}, whereNodes = [], params = []) {
-  const { clause, params: whereParams } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes, params);
-  const softDeleteClauses = [];
-  appendSoftDeleteScope(table, options, softDeleteClauses);
-  if (softDeleteClauses.length === 0) {
-    return { clause, params: whereParams };
-  }
-  const base = clause.replace(/^ WHERE /, "");
-  const scope = softDeleteClauses.join(" AND ");
-  return {
-    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
-    params: whereParams
-  };
-}
-function isQueryOrder(value) {
-  return "column" in value;
-}
-function normalizeOrderBy(orderBy) {
-  if (!orderBy) {
-    return [];
-  }
-  if (Array.isArray(orderBy)) {
-    return orderBy;
-  }
-  if (isQueryOrder(orderBy)) {
-    return [orderBy];
-  }
-  return Object.entries(orderBy).map(([column, direction]) => ({
-    column,
-    direction
-  }));
-}
-function buildOrderByClause(tableName, orderBy) {
-  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
-    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
-  });
-  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
-}
-function buildGroupByClause(tableName, groupBy) {
-  if (!groupBy) {
-    return "";
-  }
-  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
-  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
-  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
-}
-function buildHavingClause(tableName, having, params) {
-  if (!having) {
-    return "";
-  }
-  const body = appendWhereParts(tableName, having, params);
-  return body.length > 0 ? ` HAVING ${body}` : "";
-}
-function buildJoinClause(joins = []) {
-  return joins.map((join) => {
-    const joinType = join.type === "left" ? "LEFT JOIN" : "INNER JOIN";
-    const onClause = join.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
-    return ` ${joinType} ${quoteIdentifier(join.table)} ON ${onClause}`;
-  }).join("");
-}
-function buildLimitClause(limit) {
-  if (limit === undefined) {
-    return "";
-  }
-  if (!Number.isInteger(limit) || limit <= 0) {
-    throw new Error("Query limit must be a positive integer.");
-  }
-  return ` LIMIT ${limit}`;
-}
-function buildOffsetClause(offset) {
-  if (offset === undefined) {
-    return "";
-  }
-  if (!Number.isInteger(offset) || offset < 0) {
-    throw new Error("Query offset must be a non-negative integer.");
-  }
-  return ` OFFSET ${offset}`;
-}
-function buildReturningColumns(table) {
-  return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
-}
-function buildSelectList(table, select, params = []) {
-  if (!select || select.length === 0) {
-    return buildReturningColumns(table);
-  }
-  return select.map((item) => {
-    if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
-    }
-    if (item.kind === "literalText") {
-      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
-    }
-    const column = qualifyColumn(item.table, item.column);
-    const placeholder = pushParam(params, item.query);
-    return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
-  }).join(", ");
-}
-function getDefinedColumnEntries(table, values, options = {}) {
-  const record = values;
-  const excluded = new Set(options.exclude ?? []);
-  return table.columns.flatMap((column) => {
-    if (excluded.has(column) || !Object.hasOwn(record, column)) {
-      return [];
-    }
-    const value = record[column];
-    if (value === undefined) {
-      return [];
-    }
-    return [[column, value]];
-  });
-}
-function buildSelectQuery(table, options = {}, whereNodes = []) {
-  const params = [];
-  const columns = buildSelectList(table, options.select, params);
-  const { clause } = buildQueryWhereClause(table, options, whereNodes, params);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  const havingClause = buildHavingClause(table.name, options.having, params);
-  const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
-  const limit = buildLimitClause(options.limit);
-  const offset = buildOffsetClause(options.offset);
-  return {
-    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${havingClause}${orderBy}${limit}${offset}`,
-    params
-  };
-}
-function buildCountQuery(table, where = {}, options = {}, whereNodes = []) {
-  const params = [];
-  const { clause, params: whereParams } = buildQueryWhereClause(table, {
-    where,
-    withTrashed: options.withTrashed,
-    onlyTrashed: options.onlyTrashed
-  }, whereNodes);
-  params.push(...whereParams);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  return {
-    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}`,
-    params
-  };
-}
-function buildProjectionQuery(table, expression, alias, options = {}, whereNodes = []) {
-  assertSafeProjectionExpression(expression);
-  const params = [];
-  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
-  params.push(...whereParams);
-  const joins = buildJoinClause(options.joins);
-  const groupBy = buildGroupByClause(table.name, options.groupBy);
-  const orderBy = buildOrderByClause(table.name, options.orderBy);
-  const limit = buildLimitClause(options.limit);
-  return {
-    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${orderBy}${limit}`,
-    params
-  };
-}
-var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
-function assertSafeProjectionExpression(expression) {
-  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
-    throw new Error(`Unsafe projection expression: ${expression}`);
-  }
-}
-function buildGroupedCountQuery(table, column, where = {}, options = {}) {
-  const qualifiedColumn = qualifyColumn(table.name, column);
-  const { clause, params } = buildQueryWhereClause(table, {
-    where,
-    ...options
-  });
-  return {
-    text: `SELECT ${qualifiedColumn} AS ${quoteIdentifier("value")}, COUNT(*) AS ${quoteIdentifier("count")} FROM ${quoteIdentifier(table.name)}${clause} GROUP BY ${qualifiedColumn} ORDER BY ${qualifiedColumn} ASC`,
-    params
-  };
-}
-function buildInsertQuery(table, values) {
-  const entries = getDefinedColumnEntries(table, values);
-  if (entries.length === 0) {
-    throw new Error(`Cannot insert into ${table.name} without any column values.`);
-  }
-  const params = [];
-  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
-  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
-  const returningColumns = buildReturningColumns(table);
-  return {
-    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
-    params
-  };
-}
-function buildUpdateQuery(table, id, changes) {
-  const entries = getDefinedColumnEntries(table, changes, {
-    exclude: [table.primaryKey]
-  });
-  if (entries.length === 0) {
-    throw new Error(`Cannot update ${table.name} without any changed column values.`);
-  }
-  const params = [];
-  const setClause = entries.map(([column, value]) => `${quoteIdentifier(column)} = ${pushParam(params, value)}`).join(", ");
-  const primaryKeyPlaceholder = pushParam(params, id);
-  const returningColumns = buildReturningColumns(table);
-  const scopeClauses = [];
-  appendSoftDeleteScope(table, {}, scopeClauses);
-  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
-    params
-  };
-}
-function buildSoftDeleteByIdQuery(table, id, deletedAt) {
-  const deletedAtColumn = resolveSoftDeleteColumn(table);
-  if (!deletedAtColumn) {
-    throw new Error(`Table ${table.name} does not support soft deletes.`);
-  }
-  const returningColumns = buildReturningColumns(table);
-  const scopeClauses = [];
-  appendSoftDeleteScope(table, {}, scopeClauses);
-  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
-    params: [deletedAt, id]
-  };
-}
-function buildRestoreByIdQuery(table, id) {
-  const deletedAtColumn = resolveSoftDeleteColumn(table);
-  if (!deletedAtColumn) {
-    throw new Error(`Table ${table.name} does not support soft deletes.`);
-  }
-  const returningColumns = buildReturningColumns(table);
-  return {
-    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
-    params: [null, id]
-  };
-}
-function buildDeleteByIdQuery(table, id) {
-  return {
-    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
-    params: [id]
-  };
-}
-
-// ../../src/core/database/relationships.ts
-function hasMany(definition) {
-  return {
-    type: "hasMany",
-    ...definition
-  };
-}
-function hasOne(definition) {
-  return {
-    type: "hasOne",
-    ...definition
-  };
-}
-function belongsTo(definition) {
-  return {
-    type: "belongsTo",
-    ...definition
-  };
-}
-function belongsToMany(definition) {
-  return {
-    type: "belongsToMany",
-    ...definition
-  };
-}
-function indexHasManyRelation(parents, children, relation) {
-  const groups = new Map;
-  for (const parent of parents) {
-    groups.set(parent[relation.localKey], []);
-  }
-  for (const child of children) {
-    const key = child[relation.foreignKey];
-    const group = groups.get(key);
-    if (!group) {
-      continue;
-    }
-    group.push(child);
-  }
-  return groups;
-}
-function indexHasOneRelation(parents, children, relation) {
-  const grouped = indexHasManyRelation(parents, children, relation);
-  const result = new Map;
-  for (const parent of parents) {
-    const matches = grouped.get(parent[relation.localKey]) ?? [];
-    result.set(parent[relation.localKey], matches[0]);
-  }
-  return result;
-}
-function indexBelongsToRelation(children, parents, relation) {
-  const parentsById = new Map;
-  for (const parent of parents) {
-    parentsById.set(parent[relation.ownerKey], parent);
-  }
-  const result = new Map;
-  for (const child of children) {
-    const foreignKey = child[relation.foreignKey];
-    const parent = parentsById.get(foreignKey);
-    if (parent) {
-      result.set(foreignKey, parent);
-    }
-  }
-  return result;
-}
-function indexBelongsToManyRelation(parents, pivotRows, relatedRows, relation) {
-  const relatedById = new Map;
-  for (const related of relatedRows) {
-    relatedById.set(related[relation.relatedKey], related);
-  }
-  const groups = new Map;
-  for (const parent of parents) {
-    groups.set(parent[relation.parentKey], []);
-  }
-  for (const pivot of pivotRows) {
-    const parentId = pivot[relation.foreignPivotKey];
-    const relatedId = pivot[relation.relatedPivotKey];
-    const group = groups.get(parentId);
-    const related = relatedById.get(relatedId);
-    if (!group || !related) {
-      continue;
-    }
-    group.push(related);
-  }
-  return groups;
-}
-function morphMany(definition) {
-  return {
-    type: "morphMany",
-    ...definition
-  };
-}
-function morphOne(definition) {
-  return {
-    type: "morphOne",
-    ...definition
-  };
-}
-function morphTo(definition) {
-  return {
-    type: "morphTo",
-    ...definition
-  };
-}
-function indexMorphManyRelation(parents, children, relation) {
-  const groups = new Map;
-  for (const parent of parents) {
-    groups.set(parent[relation.localKey], []);
-  }
-  for (const child of children) {
-    if (child[relation.morphTypeKey] !== relation.morphType) {
-      continue;
-    }
-    const key = child[relation.morphIdKey];
-    const group = groups.get(key);
-    if (!group) {
-      continue;
-    }
-    group.push(child);
-  }
-  return groups;
-}
-function indexMorphOneRelation(parents, children, relation) {
-  const grouped = indexMorphManyRelation(parents, children, relation);
-  const result = new Map;
-  for (const parent of parents) {
-    const matches = grouped.get(parent[relation.localKey]) ?? [];
-    result.set(parent[relation.localKey], matches[0]);
-  }
-  return result;
-}
-function indexMorphToRelation(children, parentsByType, relation) {
-  const result = new Map;
-  for (const child of children) {
-    const morphType = String(child[relation.morphTypeKey]);
-    const parents = parentsByType.get(morphType);
-    if (!parents) {
-      continue;
-    }
-    const parent = parents.get(child[relation.morphIdKey]);
-    if (parent) {
-      result.set(child[relation.morphIdKey], parent);
-    }
-  }
-  return result;
-}
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function bindDatabaseConnection(connection) {
-  boundConnectionHolder.connection = connection;
-}
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-function resetBoundDatabaseConnection() {
-  boundConnectionHolder.connection = null;
-}
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabasePool() {
-  if (!defaultPool.connection) {
-    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultPool.connection;
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
-}
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveRepositoryConnection()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
-// ../../src/core/database/whereBuilder.ts
-class WhereBuilder {
-  nodes = [];
-  where(where) {
-    this.nodes.push({ kind: "and", where });
-    return this;
-  }
-  orWhere(where) {
-    this.nodes.push({ kind: "or", where });
-    return this;
-  }
-  whereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
-      this.nodes.push({ kind: "and", group: nested.nodes });
-    }
-    return this;
-  }
-  orWhereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
-      this.nodes.push({ kind: "or", group: nested.nodes });
-    }
-    return this;
-  }
-}
-
-// ../../src/core/database/repositoryQuery.ts
-class RepositoryQuery {
-  repository;
-  whereClause;
-  queryOptions;
-  eagerLoads = [];
-  whereNodes = [];
-  constructor(repository, whereClause = {}, queryOptions = {}) {
-    this.repository = repository;
-    this.whereClause = whereClause;
-    this.queryOptions = queryOptions;
-  }
-  where(input) {
-    if (typeof input === "function") {
-      const builder = new WhereBuilder;
-      input(builder);
-      this.whereNodes.push(...builder.nodes);
-      return this;
-    }
-    this.whereClause = { ...this.whereClause, ...input };
-    return this;
-  }
-  orWhere(input) {
-    if (typeof input === "function") {
-      const builder = new WhereBuilder;
-      input(builder);
-      if (builder.nodes.length > 0) {
-        this.whereNodes.push({ kind: "or", group: builder.nodes });
-      }
-      return this;
-    }
-    this.whereNodes.push({ kind: "or", where: input });
-    return this;
-  }
-  orderBy(orderBy) {
-    this.queryOptions = { ...this.queryOptions, orderBy };
-    return this;
-  }
-  limit(limit) {
-    this.queryOptions = { ...this.queryOptions, limit };
-    return this;
-  }
-  offset(offset) {
-    this.queryOptions = { ...this.queryOptions, offset };
-    return this;
-  }
-  join(left, right) {
-    return this.addJoin("inner", left, right);
-  }
-  leftJoin(left, right) {
-    return this.addJoin("left", left, right);
-  }
-  groupBy(groupBy) {
-    this.queryOptions = { ...this.queryOptions, groupBy };
-    return this;
-  }
-  having(having) {
-    this.queryOptions = { ...this.queryOptions, having };
-    return this;
-  }
-  withHasMany(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "hasMany",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withBelongsTo(as, relation, parentRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "belongsTo",
-      as,
-      relation,
-      repository: parentRepository,
-      options
-    });
-    return this;
-  }
-  withMorphMany(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphMany",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withMorphOne(as, relation, childRepository, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphOne",
-      as,
-      relation,
-      repository: childRepository,
-      options
-    });
-    return this;
-  }
-  withMorphTo(as, relation, repositoriesByType, options = {}) {
-    this.eagerLoads.push({
-      kind: "morphTo",
-      as,
-      relation,
-      repository: this.repository,
-      morphRepositories: repositoriesByType,
-      options
-    });
-    return this;
-  }
-  async get() {
-    const rows = await this.repository.findAll(this.buildOptions());
-    return await this.attach(rows);
-  }
-  async first() {
-    const rows = await this.get();
-    return rows[0] ?? null;
-  }
-  async paginate(options) {
-    return await this.repository.paginate({
-      ...this.buildOptions(),
-      page: options.page,
-      perPage: options.perPage
-    });
-  }
-  buildOptions() {
-    return {
-      ...this.queryOptions,
-      where: this.whereClause,
-      whereNodes: this.whereNodes
-    };
-  }
-  addJoin(type, left, right) {
-    const leftRef = parseQualifiedColumn(left);
-    const rightRef = parseQualifiedColumn(right);
-    const table = type === "inner" ? rightRef.table : rightRef.table;
-    const joins = this.queryOptions.joins ?? [];
-    const existing = joins.find((join) => join.table === table && join.type === type);
-    if (existing) {
-      existing.on.push({ left: leftRef, right: rightRef });
-      return this;
-    }
-    this.queryOptions = {
-      ...this.queryOptions,
-      joins: [
-        ...joins,
-        {
-          type,
-          table,
-          on: [{ left: leftRef, right: rightRef }]
-        }
-      ]
-    };
-    return this;
-  }
-  async attach(rows) {
-    if (rows.length === 0 || this.eagerLoads.length === 0) {
-      return rows.map((row) => ({ ...row }));
-    }
-    let result = rows.map((row) => ({ ...row }));
-    for (const load of this.eagerLoads) {
-      if (load.kind === "hasMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
-        }));
-        continue;
-      }
-      if (load.kind === "morphMany") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
-        }));
-        continue;
-      }
-      if (load.kind === "morphOne") {
-        const relation2 = load.relation;
-        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.localKey])
-        }));
-        continue;
-      }
-      if (load.kind === "morphTo") {
-        const relation2 = load.relation;
-        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
-        result = result.map((row) => ({
-          ...row,
-          [load.as]: grouped2.get(row[relation2.morphIdKey])
-        }));
-        continue;
-      }
-      const relation = load.relation;
-      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
-      result = result.map((row) => ({
-        ...row,
-        [load.as]: grouped.get(row[relation.foreignKey])
-      }));
-    }
-    return result;
-  }
-}
-
-// ../../src/core/database/baseRepository.ts
-class BaseRepository {
-  table;
-  connection;
-  constructor(table, connection = repositoryConnection) {
-    this.table = table;
-    this.connection = connection;
-  }
-  async findAll(options = {}) {
-    return await withDatabaseErrorHandling(async () => {
-      const { whereNodes, ...queryOptions } = options;
-      const { text, params } = buildSelectQuery(this.table, queryOptions, whereNodes ?? []);
-      return await this.connection.unsafe(text, params);
-    });
-  }
-  async paginate(options) {
-    const { whereNodes, where = {}, page, perPage, ...queryOptions } = options;
-    const total = await this.countWhere(where, {
-      withTrashed: options.withTrashed,
-      onlyTrashed: options.onlyTrashed,
-      joins: options.joins,
-      groupBy: options.groupBy
-    }, whereNodes);
-    const offset = (page - 1) * perPage;
-    const data = await this.findAll({
-      ...queryOptions,
-      where,
-      whereNodes,
-      limit: perPage,
-      offset
-    });
-    return {
-      data,
-      meta: buildPaginationMeta({ page, perPage, total })
-    };
-  }
-  async chunk(count, callback, options = {}) {
-    if (!Number.isInteger(count) || count <= 0) {
-      throw new Error("Chunk size must be a positive integer.");
-    }
-    let offset = 0;
-    while (true) {
-      const rows = await this.findAll({
-        ...options,
-        limit: count,
-        offset
-      });
-      if (rows.length === 0) {
-        return;
-      }
-      const shouldContinue = await callback(rows);
-      if (shouldContinue === false || rows.length < count) {
-        return;
-      }
-      offset += count;
-    }
-  }
-  async cursorPaginate(options) {
-    const {
-      perPage,
-      cursor,
-      cursorColumn = this.table.primaryKey,
-      direction = "asc",
-      where = {},
-      whereNodes,
-      ...queryOptions
-    } = options;
-    if (!Number.isInteger(perPage) || perPage <= 0) {
-      throw new Error("Cursor page size must be a positive integer.");
-    }
-    const cursorWhere = { ...where };
-    if (cursor !== undefined) {
-      cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
-    }
-    const rows = await this.findAll({
-      ...queryOptions,
-      where: cursorWhere,
-      whereNodes,
-      orderBy: { [cursorColumn]: direction },
-      limit: perPage + 1
-    });
-    const hasMore = rows.length > perPage;
-    const data = hasMore ? rows.slice(0, perPage) : rows;
-    const nextCursor = hasMore ? data[data.length - 1]?.[cursorColumn] ?? null : null;
-    const prevCursor = cursor ?? null;
-    return {
-      data,
-      meta: {
-        per_page: perPage,
-        next_cursor: nextCursor,
-        prev_cursor: prevCursor,
-        has_more: hasMore
-      }
-    };
-  }
-  async findById(id) {
-    return await this.firstOrNull({
-      [this.table.primaryKey]: id
-    });
-  }
-  async findByIdOrThrow(id, errorFactory) {
-    const record = await this.findById(id);
-    if (record) {
-      return record;
-    }
-    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
-  }
-  async findByIds(ids) {
-    const uniqueIds = [...new Set(ids)];
-    if (uniqueIds.length === 0) {
-      return [];
-    }
-    return await this.findWhere({
-      [this.table.primaryKey]: uniqueIds
-    });
-  }
-  async firstOrNull(where, options = {}) {
-    const [record] = await this.findAll({ ...options, where, limit: 1 });
-    return record ?? null;
-  }
-  async create(values) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildInsertQuery(this.table, values);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        throw new Error(`Insert into ${this.table.name} did not return a record.`);
-      }
-      const entity = record;
-      await eventBus.dispatch(modelEventName(this.table.name, "created"), entity);
-      return entity;
-    });
-  }
-  async updateById(id, changes) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildUpdateQuery(this.table, id, changes);
-      const [record] = await this.connection.unsafe(text, params);
-      const entity = record ?? null;
-      if (entity) {
-        await eventBus.dispatch(modelEventName(this.table.name, "updated"), entity);
-      }
-      return entity;
-    });
-  }
-  async updateByIdOrThrow(id, changes, errorFactory) {
-    const record = await this.updateById(id, changes);
-    if (record) {
-      return record;
-    }
-    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
-  }
-  async deleteById(id) {
-    if (resolveSoftDeleteColumn(this.table)) {
-      return await this.softDeleteById(id);
-    }
-    return await this.forceDeleteById(id);
-  }
-  async softDeleteById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        return false;
-      }
-      await eventBus.dispatch(modelEventName(this.table.name, "deleted"), record);
-      return true;
-    });
-  }
-  async forceDeleteById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildDeleteByIdQuery(this.table, id);
-      const [row] = await this.connection.unsafe(text, params);
-      if (!row) {
-        return false;
-      }
-      await eventBus.dispatch(modelEventName(this.table.name, "force-deleted"), {
-        id
-      });
-      return true;
-    });
-  }
-  async restoreById(id) {
-    return await withDatabaseErrorHandling(async () => {
-      const { text, params } = buildRestoreByIdQuery(this.table, id);
-      const [record] = await this.connection.unsafe(text, params);
-      if (!record) {
-        return null;
-      }
-      const entity = record;
-      await eventBus.dispatch(modelEventName(this.table.name, "restored"), entity);
-      return entity;
-    });
-  }
-  withConnection(connection) {
-    const clone = Object.create(Object.getPrototypeOf(this));
-    Object.assign(clone, this);
-    clone.connection = connection;
-    return clone;
-  }
-  getConnection() {
-    return this.connection;
-  }
-  getTable() {
-    return this.table;
-  }
-  query(where = {}) {
-    return new RepositoryQuery(this, where);
-  }
-  async findWhere(where, options = {}) {
-    return await this.findAll({ ...options, where });
-  }
-  async countWhere(where = {}, options = {}, whereNodes = []) {
-    const { text, params } = buildCountQuery(this.table, where, options, whereNodes);
-    const [row] = await this.connection.unsafe(text, params);
-    return Number(row?.count ?? 0);
-  }
-  async averageColumn(column, where = {}) {
-    const qualifiedColumn = qualifyColumn(this.table.name, column);
-    return await this.averageExpression(`AVG(${qualifiedColumn})`, "value", where);
-  }
-  async averageExpression(expression, alias, where = {}) {
-    const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
-    const [row] = await this.connection.unsafe(text, params);
-    return Math.round(Number(row?.[alias] ?? 0));
-  }
-  async pluckNumberValues(expression, alias, options = {}) {
-    const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
-    const rows = await this.connection.unsafe(text, params);
-    return rows.flatMap((row) => {
-      const value = row[alias];
-      return value === null || value === undefined ? [] : [Number(value)];
-    });
-  }
-  async countGroupedBy(column, where = {}) {
-    const { text, params } = buildGroupedCountQuery(this.table, column, where);
-    const rows = await this.connection.unsafe(text, params);
-    return rows.map(({ value, count }) => ({
-      value,
-      count: Number(count)
-    }));
-  }
-  async findByHasManyRelation(relation, parentId, options = {}) {
-    return await this.findWhere({
-      [relation.foreignKey]: parentId
-    }, options);
-  }
-  async loadHasManyForParents(parents, relation, options = {}) {
-    if (parents.length === 0) {
-      return indexHasManyRelation(parents, [], relation);
-    }
-    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
-    const children = await this.findWhere({
-      [relation.foreignKey]: parentIds
-    }, options);
-    return indexHasManyRelation(parents, children, relation);
-  }
-  async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
-    if (children.length === 0) {
-      return new Map;
-    }
-    const ownerIds = [...new Set(children.map((child) => child[relation.foreignKey]))];
-    const parents = await parentRepository.withConnection(this.connection).findWhere({
-      [relation.ownerKey]: ownerIds
-    }, options);
-    return indexBelongsToRelation(children, parents, relation);
-  }
-  async loadMorphManyForParents(parents, relation, options = {}) {
-    if (parents.length === 0) {
-      return indexMorphManyRelation(parents, [], relation);
-    }
-    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
-    const children = await this.findWhere({
-      [relation.morphTypeKey]: relation.morphType,
-      [relation.morphIdKey]: parentIds
-    }, options);
-    return indexMorphManyRelation(parents, children, relation);
-  }
-  async loadMorphOneForParents(parents, relation, options = {}) {
-    const grouped = await this.loadMorphManyForParents(parents, relation, options);
-    const result = new Map;
-    for (const parent of parents) {
-      const matches = grouped.get(parent[relation.localKey]) ?? [];
-      result.set(parent[relation.localKey], matches[0]);
-    }
-    return result;
-  }
-  async loadMorphToForChildren(children, relation, repositoriesByType, options = {}) {
-    if (children.length === 0) {
-      return new Map;
-    }
-    const idsByType = new Map;
-    for (const child of children) {
-      const morphType = String(child[relation.morphTypeKey]);
-      const morphId = child[relation.morphIdKey];
-      const ids = idsByType.get(morphType) ?? new Set;
-      ids.add(morphId);
-      idsByType.set(morphType, ids);
-    }
-    const parentsByType = new Map;
-    for (const [morphType, ids] of idsByType) {
-      const repository = repositoriesByType.get(morphType);
-      if (!repository) {
-        continue;
-      }
-      const ownerKey = repository.getTable().primaryKey;
-      const parents = await repository.withConnection(this.connection).findWhere({
-        [ownerKey]: [...ids]
-      }, options);
-      const indexed = new Map;
-      for (const parent of parents) {
-        indexed.set(parent[ownerKey], parent);
-      }
-      parentsByType.set(morphType, indexed);
-    }
-    return indexMorphToRelation(children, parentsByType, relation);
-  }
-}
-var baseRepository_default = BaseRepository;
-// ../../src/core/database/model.ts
-var modelRepositories = new WeakMap;
-var modelGlobalScopes = new WeakMap;
-var modelBooted = new WeakSet;
-function resolveModelRepository(model) {
-  const repository = modelRepositories.get(model);
-  if (!repository) {
-    throw new Error(`${model.name}.repository() is not implemented.`);
-  }
-  return repository;
-}
-function modelStatics(model) {
-  return model;
-}
-function ensureBooted(model) {
-  if (modelBooted.has(model)) {
-    return;
-  }
-  modelBooted.add(model);
-  const boot = model.boot;
-  if (typeof boot === "function") {
-    boot.call(model);
-  }
-}
-function getGlobalScopes(model) {
-  return modelGlobalScopes.get(model) ?? [];
-}
-function hydrateValue(value, cast) {
-  if (value === null || value === undefined) {
-    return value;
-  }
-  switch (cast) {
-    case "date":
-    case "datetime":
-      return value instanceof Date ? value : new Date(String(value));
-    case "json":
-      return typeof value === "string" ? JSON.parse(value) : value;
-    case "bool":
-    case "boolean":
-      return value === true || value === 1 || value === "1" || value === "true";
-    default:
-      return value;
-  }
-}
-function dehydrateValue(value, cast) {
-  if (value === null || value === undefined) {
-    return value;
-  }
-  switch (cast) {
-    case "date":
-    case "datetime":
-      return value instanceof Date ? value : new Date(String(value));
-    case "json":
-      return typeof value === "string" ? value : JSON.stringify(value);
-    case "bool":
-    case "boolean":
-      return Boolean(value);
-    default:
-      return value;
-  }
-}
-function filterMassAssignable(fillable, guarded, input) {
-  const resolvedGuarded = guarded ?? true;
-  if (fillable && fillable.length > 0) {
-    const allowed = new Set(fillable);
-    return Object.fromEntries(Object.entries(input).filter(([key]) => allowed.has(key)));
-  }
-  if (resolvedGuarded === true || resolvedGuarded.includes("*")) {
-    return {};
-  }
-  const blocked = new Set(resolvedGuarded);
-  return Object.fromEntries(Object.entries(input).filter(([key]) => !blocked.has(key)));
-}
-function applyCasts(values, casts, direction) {
-  if (Object.keys(casts).length === 0) {
-    return values;
-  }
-  const result = { ...values };
-  const castFn = direction === "hydrate" ? hydrateValue : dehydrateValue;
-  for (const [key, cast] of Object.entries(casts)) {
-    if (key in result && cast) {
-      result[key] = castFn(result[key], cast);
-    }
-  }
-  return result;
-}
-function applyTimestampsOnCreate(columns, values, enabled) {
-  if (!enabled) {
-    return values;
-  }
-  const now = new Date;
-  const result = { ...values };
-  if (columns.includes("created_at")) {
-    result.created_at = now;
-  }
-  if (columns.includes("updated_at")) {
-    result.updated_at = now;
-  }
-  return result;
-}
-function applyTimestampsOnUpdate(columns, values, enabled) {
-  if (!enabled) {
-    return values;
-  }
-  const result = { ...values };
-  if (columns.includes("updated_at")) {
-    result.updated_at = new Date;
-  }
-  return result;
-}
-
-class Model {
-  attributes;
-  repository;
-  static $fillable;
-  static $guarded;
-  static $casts = {};
-  static $timestamps = true;
-  _exists;
-  constructor(attributes, repository, exists = true) {
-    this.attributes = attributes;
-    this.repository = repository;
-    this._exists = exists;
-  }
-  get $exists() {
-    return this._exists;
-  }
-  get(key) {
-    return this.attributes[key];
-  }
-  get id() {
-    return this.attributes[this.primaryKey()];
-  }
-  toObject() {
-    return { ...this.attributes };
-  }
-  primaryKey() {
-    throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
-  }
-  static primaryKeyField() {
-    return resolveModelRepository(this).getTable().primaryKey;
-  }
-  static hydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
-    return applyCasts(attributes, casts, "hydrate");
-  }
-  static dehydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
-    return applyCasts(attributes, casts, "dehydrate");
-  }
-  static fromRecord(record, repository, exists = true) {
-    const statics = modelStatics(this);
-    const hydrated = statics.hydrateAttributes(record);
-    return new statics(hydrated, repository, exists);
-  }
-  static boot() {}
-  static addGlobalScope(_name, scope) {
-    ensureBooted(this);
-    const existing = modelGlobalScopes.get(this) ?? [];
-    modelGlobalScopes.set(this, [
-      ...existing,
-      scope
-    ]);
-  }
-  static repository() {
-    return resolveModelRepository(this);
-  }
-  static query() {
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
-    let query = repository.query();
-    for (const scope of getGlobalScopes(this)) {
-      query = scope(query);
-    }
-    return query;
-  }
-  static async create(attributes) {
-    const statics = modelStatics(this);
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
-    const table = repository.getTable();
-    const timestamps = statics.$timestamps ?? true;
-    const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
-    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
-    const payload = statics.dehydrateAttributes(withTimestamps);
-    const record = await repository.create(payload);
-    return statics.fromRecord(record, repository, true);
-  }
-  static async find(id) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    const primaryKey = repository.getTable().primaryKey;
-    const record = await Model.query.call(this).where({ [primaryKey]: id }).first();
-    return record ? statics.fromRecord(record, repository, true) : null;
-  }
-  static async findOrFail(id, errorFactory) {
-    const model = await Model.find.call(this, id);
-    if (model) {
-      return model;
-    }
-    throw errorFactory?.(id) ?? new NotFoundError(`${this.name} ${String(id)} not found.`);
-  }
-  static async all(options = {}) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this);
-    if (options.orderBy) {
-      query = query.orderBy(options.orderBy);
-    }
-    if (options.limit !== undefined) {
-      query = query.limit(options.limit);
-    }
-    const rows = await query.get();
-    return rows.map((row) => statics.fromRecord(row, repository, true));
-  }
-  static async firstWhere(where, options = {}) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this).where(where);
-    if (options.orderBy) {
-      query = query.orderBy(options.orderBy);
-    }
-    const record = await query.first();
-    return record ? statics.fromRecord(record, repository, true) : null;
-  }
-  async save() {
-    const ModelClass = modelStatics(this.constructor);
-    const timestamps = ModelClass.$timestamps ?? true;
-    const casts = ModelClass.$casts ?? {};
-    const table = this.repository.getTable();
-    if (this.$exists) {
-      const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
-      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record2);
-      return this;
-    }
-    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, this.attributes);
-    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
-    const payload = ModelClass.dehydrateAttributes(withTimestamps);
-    const record = await this.repository.create(payload);
-    this.attributes = ModelClass.hydrateAttributes(record);
-    this._exists = true;
-    return this;
-  }
-  async update(changes) {
-    const ModelClass = modelStatics(this.constructor);
-    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, changes);
-    Object.assign(this.attributes, assignable);
-    return await this.save();
-  }
-  async delete() {
-    if (resolveSoftDeleteColumn(this.repository.getTable())) {
-      return await this.repository.deleteById(this.id);
-    }
-    return await this.repository.forceDeleteById(this.id);
-  }
-  async forceDelete() {
-    return await this.repository.forceDeleteById(this.id);
-  }
-  async restore() {
-    const ModelClass = modelStatics(this.constructor);
-    const record = await this.repository.restoreById(this.id);
-    if (!record) {
-      return null;
-    }
-    this.attributes = ModelClass.hydrateAttributes(record);
-    return this;
-  }
-  async loadHasMany(as, relation, childRepository, options = {}) {
-    const grouped = await childRepository.withConnection(this.repository.getConnection()).loadHasManyForParents([this.attributes], relation, options);
-    const loaded = grouped.get(this.attributes[relation.localKey]) ?? [];
-    return Object.assign(this, { [as]: loaded });
-  }
-  async loadHasOne(as, relation, childRepository, options = {}) {
-    const loaded = await this.loadHasMany(as, relation, childRepository, { ...options, limit: 1 });
-    const value = loaded[as]?.[0];
-    return Object.assign(this, { [as]: value });
-  }
-  async loadBelongsTo(as, relation, parentRepository, options = {}) {
-    const grouped = await this.repository.loadBelongsToForParents([this.attributes], relation, parentRepository, options);
-    const loaded = grouped.get(this.attributes[relation.foreignKey]);
-    return Object.assign(this, { [as]: loaded });
-  }
-  async loadBelongsToMany(as, relation, relatedRepository, options = {}) {
-    const connection = this.repository.getConnection();
-    const parentId = this.attributes[relation.parentKey];
-    const pivotRows = await connection.unsafe(`SELECT * FROM ${relation.pivotTable} WHERE ${String(relation.foreignPivotKey)} = $1`, [parentId]);
-    if (pivotRows.length === 0) {
-      return Object.assign(this, { [as]: [] });
-    }
-    const relatedIds = [
-      ...new Set(pivotRows.map((row) => row[relation.relatedPivotKey]))
-    ];
-    const relatedRows = await relatedRepository.withConnection(connection).findAll({
-      ...options,
-      where: {
-        [relation.relatedKey]: relatedIds
-      }
-    });
-    const grouped = indexBelongsToManyRelation([this.attributes], pivotRows, relatedRows, relation);
-    const loaded = grouped.get(parentId) ?? [];
-    return Object.assign(this, { [as]: loaded });
-  }
-  mergeAttributes(patch) {
-    Object.assign(this.attributes, patch);
-    return this;
-  }
-}
-function registerModelRepository(model, repository) {
-  modelRepositories.set(model, repository);
-  ensureBooted(model);
-  return model;
-}
-// ../../src/core/database/schema/columnDefinition.ts
-class ColumnDefinition {
-  name;
-  kind;
-  length;
-  isNullable = false;
-  isPrimary = false;
-  isUnique = false;
-  autoIncrement = false;
-  defaultValue;
-  checkExpression;
-  foreignKey;
-  constructor(name, kind) {
-    this.name = name;
-    this.kind = kind;
-  }
-  nullable() {
-    this.isNullable = true;
-    return this;
-  }
-  notNullable() {
-    this.isNullable = false;
-    return this;
-  }
-  default(value) {
-    if (typeof value === "boolean") {
-      this.defaultValue = value ? "TRUE" : "FALSE";
-      return this;
-    }
-    if (typeof value === "number") {
-      this.defaultValue = String(value);
-      return this;
-    }
-    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
-    return this;
-  }
-  defaultRaw(expression) {
-    this.defaultValue = expression;
-    return this;
-  }
-  unique() {
-    this.isUnique = true;
-    return this;
-  }
-  primary() {
-    this.isPrimary = true;
-    return this;
-  }
-  check(expression) {
-    this.checkExpression = expression;
-    return this;
-  }
-}
-
-class ForeignIdColumnDefinition extends ColumnDefinition {
-  constructor(name) {
-    super(name, "foreignId");
-    this.notNullable();
-  }
-  references(table, column = "id") {
-    this.foreignKey = {
-      referencesTable: table,
-      referencesColumn: column
-    };
-    return this;
-  }
-  constrained(table) {
-    const referencesTable = table ?? inferReferencedTable(this.name);
-    return this.references(referencesTable);
-  }
-  cascadeOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
-    }
-    this.foreignKey.onDelete = "cascade";
-    return this;
-  }
-  nullOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
-    }
-    this.foreignKey.onDelete = "set null";
-    return this;
-  }
-}
-function inferReferencedTable(columnName) {
-  if (!columnName.endsWith("_id")) {
-    throw new Error(`Cannot infer referenced table from column ${columnName}`);
-  }
-  return columnName.slice(0, -3);
-}
-
-// ../../src/core/database/schema/blueprint.ts
-class Blueprint {
-  table;
-  action;
-  columns = [];
-  indexes = [];
-  droppedColumns = [];
-  droppedIndexes = [];
-  constructor(table, action) {
-    this.table = table;
-    this.action = action;
-  }
-  id(name = "id") {
-    const column = new ColumnDefinition(name, "id");
-    column.primary();
-    column.autoIncrement = true;
-    this.columns.push(column);
-    return column;
-  }
-  string(name, length) {
-    const column = new ColumnDefinition(name, "string");
-    column.length = length;
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  text(name) {
-    const column = new ColumnDefinition(name, "text");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  boolean(name) {
-    const column = new ColumnDefinition(name, "boolean");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  integer(name) {
-    const column = new ColumnDefinition(name, "integer");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  bigInteger(name) {
-    const column = new ColumnDefinition(name, "bigInteger");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  timestamp(name) {
-    const column = new ColumnDefinition(name, "timestamp");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  json(name) {
-    const column = new ColumnDefinition(name, "json");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  jsonb(name) {
-    const column = new ColumnDefinition(name, "jsonb");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
-  }
-  foreignId(name) {
-    const column = new ForeignIdColumnDefinition(name);
-    this.columns.push(column);
-    return column;
-  }
-  timestamps() {
-    this.timestamp("created_at").defaultRaw("NOW()");
-    this.timestamp("updated_at").defaultRaw("NOW()");
-  }
-  softDeletes() {
-    this.timestamp("deleted_at").nullable();
-  }
-  dropColumn(name) {
-    this.droppedColumns.push(name);
-  }
-  dropSoftDeletes() {
-    this.dropColumn("deleted_at");
-    this.dropIndex(`idx_${this.table}_deleted_at`);
-  }
-  dropIndex(name) {
-    this.droppedIndexes.push(name);
-  }
-  unique(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "unique"
-    });
-  }
-  index(columns, options = {}) {
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "index",
-      order: options.order
-    });
-  }
-  partialIndex(columns, where, nameOrOptions) {
-    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: options.unique ? "uniquePartial" : "partial",
-      where
-    });
-  }
-  fullText(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "fullText"
-    });
-  }
-  ginIndex(column, name) {
-    this.indexes.push({
-      name,
-      columns: [column],
-      kind: "gin"
-    });
-  }
-}
-// ../../src/core/database/schema/driver.ts
-function normalizeConnectionName(connection) {
-  const normalized = connection.trim().toLowerCase();
-  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
-    return "pgsql";
-  }
-  if (normalized === "mysql" || normalized === "mariadb") {
-    return "mysql";
-  }
-  if (normalized === "sqlite") {
-    return "sqlite";
-  }
-  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
-}
-function resolveDriverFromUrl(url) {
-  const normalized = url.trim().toLowerCase();
-  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
-    return "pgsql";
-  }
-  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
-    return "mysql";
-  }
-  if (normalized.startsWith("sqlite:")) {
-    return "sqlite";
-  }
-  return null;
-}
-function resolveDatabaseDriver(options = {}) {
-  const connection = options.connection ?? process.env.DB_CONNECTION;
-  if (connection) {
-    return normalizeConnectionName(connection);
-  }
-  const url = options.url ?? process.env.DATABASE_URL ?? "";
-  const fromUrl = resolveDriverFromUrl(url);
-  if (fromUrl) {
-    return fromUrl;
-  }
-  return "pgsql";
-}
-// ../../src/core/database/schema/errors.ts
-class UnsupportedSchemaFeatureError extends Error {
-  constructor(feature, driver) {
-    super(`${feature} is not supported for the ${driver} driver`);
-    this.name = "UnsupportedSchemaFeatureError";
-  }
-}
-// ../../src/core/database/schema/grammars/grammar.ts
-function compileColumnType(driver, column) {
-  switch (column.kind) {
-    case "id":
-      return compileIdType(driver);
-    case "string":
-      return compileStringType(driver, column.length);
-    case "text":
-      return compileTextType(driver);
-    case "boolean":
-      return compileBooleanType(driver);
-    case "integer":
-    case "foreignId":
-      return compileIntegerType(driver);
-    case "bigInteger":
-      return compileBigIntegerType(driver);
-    case "timestamp":
-      return compileTimestampType(driver);
-    case "json":
-      return compileJsonType(driver);
-    case "jsonb":
-      return compileJsonbType(driver);
-    default:
-      throw new Error(`Unsupported column kind: ${column.kind}`);
-  }
-}
-function compileIdType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "SERIAL";
-    case "mysql":
-      return "BIGINT UNSIGNED";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileStringType(driver, length) {
-  switch (driver) {
-    case "pgsql":
-      return "TEXT";
-    case "mysql":
-      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileTextType(driver) {
-  switch (driver) {
-    case "pgsql":
-    case "sqlite":
-      return "TEXT";
-    case "mysql":
-      return "TEXT";
-  }
-}
-function compileBooleanType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BOOLEAN";
-    case "mysql":
-      return "BOOLEAN";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "INTEGER";
-    case "mysql":
-      return "INT";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileBigIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BIGINT";
-    case "mysql":
-      return "BIGINT";
-    case "sqlite":
-      return "INTEGER";
-  }
+// ../../src/modules/user/provider.ts
+import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
+import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
+import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
 }
-function compileTimestampType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "TIMESTAMPTZ";
-    case "mysql":
-      return "TIMESTAMP";
-    case "sqlite":
-      return "TEXT";
-  }
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
 }
-function compileJsonType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
+
+// ../../src/modules/user/apiTokenRepository.ts
+import { BaseRepository } from "@getstrata/core/database";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
 }
-function compileJsonbType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
   }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
 }
 
-// ../../src/core/database/schema/grammars/compileStatements.ts
-function compileCreateTable(driver, blueprint) {
-  const table = quoteIdentifier(blueprint.table);
-  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length > 1) {
-      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-      parts.push(`UNIQUE (${columns})`);
-    }
-  }
-  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
-  ${parts.join(`,
-  `)}
-)`];
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length === 1) {
-      continue;
-    }
-    if (index.kind === "index") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
 }
-function compileAlterTable(driver, blueprint) {
-  const statements = [];
-  const table = quoteIdentifier(blueprint.table);
-  for (const column of blueprint.columns) {
-    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
-    statements.push(`ALTER TABLE ${table}
-${addPrefix} ${compileColumn(driver, column, "alter")}`);
-  }
-  for (const columnName of blueprint.droppedColumns) {
-    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
-    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
-  }
-  for (const indexName of blueprint.droppedIndexes) {
-    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
-  }
-  for (const index of blueprint.indexes) {
-    if (index.kind === "index" || index.kind === "unique") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
 }
-function compileDropTable(driver, tableName) {
-  const cascade = driver === "pgsql" ? " CASCADE" : "";
-  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
 }
-function compileColumn(driver, column, mode) {
-  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
-  if (column.autoIncrement && driver === "mysql") {
-    parts[1] = `${parts[1]} AUTO_INCREMENT`;
-  }
-  if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
-      parts.push("PRIMARY KEY AUTOINCREMENT");
-    } else {
-      parts.push("PRIMARY KEY");
-    }
-  } else if (!column.isNullable) {
-    parts.push("NOT NULL");
-  } else if (column.isNullable) {
-    parts.push("NULL");
-  }
-  if (column.defaultValue !== undefined) {
-    parts.push(`DEFAULT ${column.defaultValue}`);
-  }
-  if (column.isUnique) {
-    parts.push("UNIQUE");
-  }
-  if (column.checkExpression) {
-    parts.push(`CHECK (${column.checkExpression})`);
-  }
-  if (column.foreignKey) {
-    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
-    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
-    let clause = `REFERENCES ${reference}`;
-    if (onDelete === "cascade") {
-      clause += " ON DELETE CASCADE";
-    } else if (onDelete === "set null") {
-      clause += " ON DELETE SET NULL";
-    }
-    parts.push(clause);
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  return parts.join(" ");
-}
-function compileIndex(_driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
-  const columns = index.columns.map((column) => {
-    const quoted = quoteIdentifier(column);
-    if (index.order === "desc") {
-      return `${quoted} DESC`;
-    }
-    return quoted;
-  }).join(", ");
-  const unique = index.kind === "unique" ? "UNIQUE " : "";
-  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
-}
-function compileSpecialIndex(driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
-  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-  switch (index.kind) {
-    case "partial":
-    case "uniquePartial": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
-      }
-      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
-      return [
-        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
-      ];
-    }
-    case "gin": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
-      }
-      return [
-        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
-      ];
-    }
-    case "fullText": {
-      if (driver === "mysql") {
-        return [
-          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
-        ];
-      }
-      if (driver === "pgsql") {
-        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
-      }
-      throw new UnsupportedSchemaFeatureError("fullText()", driver);
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
     }
-    default:
-      return [];
-  }
-}
-function defaultIndexName(tableName, columns, kind) {
-  return `idx_${tableName}_${columns.join("_")}_${kind}`;
-}
-function compileBlueprint(driver, blueprint) {
-  switch (blueprint.action) {
-    case "create":
-      return compileCreateTable(driver, blueprint);
-    case "alter":
-      return compileAlterTable(driver, blueprint);
-    case "drop":
-      return compileDropTable(driver, blueprint.table);
-    default:
-      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+    return resolveDatabase();
   }
-}
-// ../../src/core/database/schema/grammars/createGrammar.ts
-function createGrammar(driver) {
-  return {
-    driver,
-    compile(blueprint) {
-      return compileBlueprint(driver, blueprint);
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
     }
-  };
+  });
 }
 
-// ../../src/core/database/schema/grammars/mysqlGrammar.ts
-var MySqlGrammar = createGrammar("mysql");
-
-// ../../src/core/database/schema/grammars/postgresGrammar.ts
-var PostgresGrammar = createGrammar("pgsql");
-
-// ../../src/core/database/schema/grammars/sqliteGrammar.ts
-var SqliteGrammar = createGrammar("sqlite");
-
-// ../../src/core/database/schema/grammars/index.ts
-function grammarForDriver(driver) {
-  switch (driver) {
-    case "pgsql":
-      return PostgresGrammar;
-    case "mysql":
-      return MySqlGrammar;
-    case "sqlite":
-      return SqliteGrammar;
-    default:
-      throw new Error(`Unsupported database driver: ${driver}`);
-  }
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
 }
-// ../../src/core/database/schema/schema.ts
-class SchemaBuilder {
-  #driver;
-  #statements = [];
-  constructor(driver) {
-    this.#driver = driver;
-  }
-  create(table, callback) {
-    const blueprint = new Blueprint(table, "create");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  table(table, callback) {
-    const blueprint = new Blueprint(table, "alter");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  drop(table) {
-    const blueprint = new Blueprint(table, "drop");
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  toSql() {
-    return [...this.#statements];
-  }
-  async execute(db) {
-    for (const statement of this.#statements) {
-      await db.unsafe(statement);
-    }
+function getDefaultDatabasePool() {
+  if (!defaultPool.connection) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
+  return defaultPool.connection;
 }
-
-class Schema {
-  static builder(driver) {
-    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
-  }
-  static async run(db, driver, callback) {
-    const schema = Schema.builder(driver);
-    await callback(schema);
-    await schema.execute(db);
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
+  return defaultQuery.connection;
 }
-function createSchemaBuilder(db, driver) {
-  const builder = Schema.builder(driver);
-  return Object.assign(builder, {
-    async commit() {
-      await builder.execute(db);
-    }
-  });
-}
-// ../../src/core/database/table.ts
-function defineTable(definition) {
-  return definition;
-}
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
 
 // ../../src/db/connection/createConnection.ts
 var {SQL } = globalThis.Bun;
-function createDatabaseConnection2(config) {
+function createDatabaseConnection(config) {
   if (!config.url) {
     throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
   }
@@ -2563,7 +186,7 @@ var connectionHolder = {
 };
 function getDatabase() {
   if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
     registerDefaultDatabasePool(connectionHolder.connection);
   }
   return connectionHolder.connection;
@@ -2585,6 +208,7 @@ var db = new Proxy(function database() {}, {
 var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
+import { defineTable } from "@getstrata/core/database";
 var apiTokenTable = defineTable({
   name: "api_token",
   primaryKey: "id",
@@ -2601,237 +225,14 @@ var apiTokenTable = defineTable({
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
-// ../../src/core/auth/password.ts
-async function hashPassword(password) {
-  return await Bun.password.hash(password, {
-    algorithm: "bcrypt",
-    cost: 10
-  });
-}
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
-  }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
-  }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
-}
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
-  }
-  if (featureFlag === "true") {
-    return true;
-  }
-  return (process.env.APP_ENV ?? "local") === "production";
-}
-function encryptField(plaintext, key) {
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
-  return `${ENCRYPTION_PREFIX}${payload}`;
-}
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
-  }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-function hashLookupValue(normalizedValue, key) {
-  return createHmac("sha256", key).update(normalizedValue).digest("hex");
-}
-function normalizeEmail(email) {
-  return email.trim().toLowerCase();
-}
-function protectEmail(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return { storedEmail: normalized, emailLookup: normalized };
-  }
-  return {
-    storedEmail: encryptField(normalized, key),
-    emailLookup: hashLookupValue(normalized, key)
-  };
-}
-function revealEmail(storedEmail) {
-  const key = resolveEncryptionKey();
-  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
-    return storedEmail;
-  }
-  return decryptField(storedEmail, key);
-}
-function emailLookupForQuery(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return normalized;
-  }
-  return hashLookupValue(normalized, key);
-}
-
-// ../../src/core/crypto/mfaSecret.ts
-function protectMfaSecret(secret) {
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key) {
-    return secret;
-  }
-  return encryptField(secret, key);
-}
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
-  }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
-  }
-  return decryptField(stored, key);
-}
-
-// ../../src/core/auth/authContext.ts
-var authContext = createAsyncContextStore("@getstrata/authContext");
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
-  }
-  return parsed;
-}
-
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
-    }
-    bits += value.toString(2).padStart(5, "0");
-  }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
-  }
-  return Buffer.from(bytes);
-}
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
-}
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
-  }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-
 // ../../src/modules/user/authService.ts
+import { verifyPassword } from "@getstrata/core/auth/password";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
+import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
+import { verifyTotp } from "@getstrata/core/security/totp";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
 class AuthService {
   users;
   tokens;
@@ -2924,23 +325,42 @@ class AuthService {
   }
 }
 
+// ../../src/modules/user/notificationRepository.ts
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
+
 // ../../src/modules/user/notificationTable.ts
-var notificationTable = defineTable({
+import { defineTable as defineTable2 } from "@getstrata/core/database";
+var notificationTable = defineTable2({
   name: "notification",
   primaryKey: "id",
   columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
   defaultOrderBy: { column: "created_at", direction: "DESC" }
 });
 
+// ../../src/modules/user/notificationService.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+
 // ../../src/modules/user/oauthIdentityRepository.ts
-var oauthIdentityTable = defineTable({
+import { BaseRepository as BaseRepository3, defineTable as defineTable3 } from "@getstrata/core/database";
+var oauthIdentityTable = defineTable3({
   name: "oauth_identity",
   primaryKey: "id",
   columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
 });
 
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository4 } from "@getstrata/core/database";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
 // ../../src/modules/user/table.ts
-var userTable = defineTable({
+import { defineTable as defineTable4 } from "@getstrata/core/database";
+var userTable = defineTable4({
   name: "users",
   primaryKey: "id",
   columns: [
@@ -2960,24 +380,16 @@ var userTable = defineTable({
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
-// ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac as createHmac3 } from "crypto";
-function resolveTokenPepper() {
-  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
-}
-function hashApiToken(token) {
-  const pepper = resolveTokenPepper();
-  if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac3("sha256", pepper).update(token).digest("hex");
-  }
-  return createHash("sha256").update(token).digest("hex");
-}
+// ../../src/modules/user/tokenService.ts
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
 // ../../src/core/auth/sessionCookie.ts
-import { createHmac as createHmac4, timingSafeEqual } from "crypto";
+import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
 function resolveSessionSecret() {
@@ -2985,7 +397,7 @@ function resolveSessionSecret() {
 }
 function signSession(userId, issuedAt) {
   const payload = `${userId}.${issuedAt}`;
-  const signature = createHmac4("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
 function readCookieValue(request, cookieName) {