@getstrata/core 0.5.52 → 0.5.54

package/dist/index.js

@@ -1530,2580 +1530,2569 @@ class BaseRepository {
   }
 }
 var baseRepository_default = BaseRepository;
-// ../../src/core/database/connection.ts
-function createDatabaseConnection(source) {
-  return {
-    async unsafe(query, params = []) {
-      return await source.unsafe(query, params);
-    }
-  };
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
 }
-// ../../src/core/database/model.ts
-var modelRepositories = new WeakMap;
-var modelGlobalScopes = new WeakMap;
-var modelBooted = new WeakSet;
-function resolveModelRepository(model) {
-  const repository = modelRepositories.get(model);
-  if (!repository) {
-    throw new Error(`${model.name}.repository() is not implemented.`);
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
   }
-  return repository;
-}
-function modelStatics(model) {
-  return model;
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
 }
-function ensureBooted(model) {
-  if (modelBooted.has(model)) {
-    return;
-  }
-  modelBooted.add(model);
-  const boot = model.boot;
-  if (typeof boot === "function") {
-    boot.call(model);
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
   }
+  return connectionHolder.connection;
 }
-function getGlobalScopes(model) {
-  return modelGlobalScopes.get(model) ?? [];
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
 }
-function hydrateValue(value, cast) {
-  if (value === null || value === undefined) {
-    return value;
-  }
-  switch (cast) {
-    case "date":
-    case "datetime":
-      return value instanceof Date ? value : new Date(String(value));
-    case "json":
-      return typeof value === "string" ? JSON.parse(value) : value;
-    case "bool":
-    case "boolean":
-      return value === true || value === 1 || value === "1" || value === "true";
-    default:
-      return value;
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
   }
+});
+var connection_default = db;
+
+// ../../src/core/database/table.ts
+function defineTable(definition) {
+  return definition;
 }
-function dehydrateValue(value, cast) {
-  if (value === null || value === undefined) {
-    return value;
-  }
-  switch (cast) {
-    case "date":
-    case "datetime":
-      return value instanceof Date ? value : new Date(String(value));
-    case "json":
-      return typeof value === "string" ? value : JSON.stringify(value);
-    case "bool":
-    case "boolean":
-      return Boolean(value);
-    default:
-      return value;
-  }
+
+// ../../src/modules/user/apiTokenTable.ts
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/password.ts
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
 }
-function filterMassAssignable(fillable, guarded, input) {
-  const resolvedGuarded = guarded ?? true;
-  if (fillable && fillable.length > 0) {
-    const allowed = new Set(fillable);
-    return Object.fromEntries(Object.entries(input).filter(([key]) => allowed.has(key)));
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
   }
-  if (resolvedGuarded === true || resolvedGuarded.includes("*")) {
-    return {};
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
   }
-  const blocked = new Set(resolvedGuarded);
-  return Object.fromEntries(Object.entries(input).filter(([key]) => !blocked.has(key)));
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
 }
-function applyCasts(values, casts, direction) {
-  if (Object.keys(casts).length === 0) {
-    return values;
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
   }
-  const result = { ...values };
-  const castFn = direction === "hydrate" ? hydrateValue : dehydrateValue;
-  for (const [key, cast] of Object.entries(casts)) {
-    if (key in result && cast) {
-      result[key] = castFn(result[key], cast);
-    }
+  if (featureFlag === "true") {
+    return true;
   }
-  return result;
+  return (process.env.APP_ENV ?? "local") === "production";
 }
-function applyTimestampsOnCreate(columns, values, enabled) {
-  if (!enabled) {
-    return values;
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
   }
-  const now = new Date;
-  const result = { ...values };
-  if (columns.includes("created_at")) {
-    result.created_at = now;
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
   }
-  if (columns.includes("updated_at")) {
-    result.updated_at = now;
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
   }
-  return result;
+  return decryptField(stored, key);
 }
-function applyTimestampsOnUpdate(columns, values, enabled) {
-  if (!enabled) {
-    return values;
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
   }
-  const result = { ...values };
-  if (columns.includes("updated_at")) {
-    result.updated_at = new Date;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
   }
-  return result;
+  return parsed;
 }
 
-class Model {
-  attributes;
-  repository;
-  static $fillable;
-  static $guarded;
-  static $casts = {};
-  static $timestamps = true;
-  _exists;
-  constructor(attributes, repository, exists = true) {
-    this.attributes = attributes;
-    this.repository = repository;
-    this._exists = exists;
-  }
-  get $exists() {
-    return this._exists;
-  }
-  get(key) {
-    return this.attributes[key];
-  }
-  get id() {
-    return this.attributes[this.primaryKey()];
-  }
-  toObject() {
-    return { ...this.attributes };
-  }
-  primaryKey() {
-    throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
-  }
-  static primaryKeyField() {
-    return resolveModelRepository(this).getTable().primaryKey;
-  }
-  static hydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
-    return applyCasts(attributes, casts, "hydrate");
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2 } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
   }
-  static dehydrateAttributes(attributes) {
-    const casts = modelStatics(this).$casts ?? {};
-    return applyCasts(attributes, casts, "dehydrate");
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
   }
-  static fromRecord(record, repository, exists = true) {
-    const statics = modelStatics(this);
-    const hydrated = statics.hydrateAttributes(record);
-    return new statics(hydrated, repository, exists);
+  return Buffer.from(bytes);
+}
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
   }
-  static boot() {}
-  static addGlobalScope(_name, scope) {
-    ensureBooted(this);
-    const existing = modelGlobalScopes.get(this) ?? [];
-    modelGlobalScopes.set(this, [
-      ...existing,
-      scope
-    ]);
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
   }
-  static repository() {
-    return resolveModelRepository(this);
+  return false;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
   }
-  static query() {
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
-    let query = repository.query();
-    for (const scope of getGlobalScopes(this)) {
-      query = scope(query);
-    }
-    return query;
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
   }
-  static async create(attributes) {
-    const statics = modelStatics(this);
-    ensureBooted(this);
-    const repository = resolveModelRepository(this);
-    const table = repository.getTable();
-    const timestamps = statics.$timestamps ?? true;
-    const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
-    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
-    const payload = statics.dehydrateAttributes(withTimestamps);
-    const record = await repository.create(payload);
-    return statics.fromRecord(record, repository, true);
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
   }
-  static async find(id) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    const primaryKey = repository.getTable().primaryKey;
-    const record = await Model.query.call(this).where({ [primaryKey]: id }).first();
-    return record ? statics.fromRecord(record, repository, true) : null;
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
   }
-  static async findOrFail(id, errorFactory) {
-    const model = await Model.find.call(this, id);
-    if (model) {
-      return model;
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
     }
-    throw errorFactory?.(id) ?? new NotFoundError(`${this.name} ${String(id)} not found.`);
-  }
-  static async all(options = {}) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this);
-    if (options.orderBy) {
-      query = query.orderBy(options.orderBy);
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
     }
-    if (options.limit !== undefined) {
-      query = query.limit(options.limit);
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
     }
-    const rows = await query.get();
-    return rows.map((row) => statics.fromRecord(row, repository, true));
-  }
-  static async firstWhere(where, options = {}) {
-    const statics = modelStatics(this);
-    const repository = resolveModelRepository(this);
-    let query = Model.query.call(this).where(where);
-    if (options.orderBy) {
-      query = query.orderBy(options.orderBy);
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
     }
-    const record = await query.first();
-    return record ? statics.fromRecord(record, repository, true) : null;
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
   }
-  async save() {
-    const ModelClass = modelStatics(this.constructor);
-    const timestamps = ModelClass.$timestamps ?? true;
-    const casts = ModelClass.$casts ?? {};
-    const table = this.repository.getTable();
-    if (this.$exists) {
-      const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
-      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record2);
-      return this;
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
-    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, this.attributes);
-    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
-    const payload = ModelClass.dehydrateAttributes(withTimestamps);
-    const record = await this.repository.create(payload);
-    this.attributes = ModelClass.hydrateAttributes(record);
-    this._exists = true;
-    return this;
-  }
-  async update(changes) {
-    const ModelClass = modelStatics(this.constructor);
-    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, changes);
-    Object.assign(this.attributes, assignable);
-    return await this.save();
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
   }
-  async delete() {
-    if (resolveSoftDeleteColumn(this.repository.getTable())) {
-      return await this.repository.deleteById(this.id);
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
-    return await this.repository.forceDeleteById(this.id);
-  }
-  async forceDelete() {
-    return await this.repository.forceDeleteById(this.id);
+    return provider.getAuthorizationUrl(state);
   }
-  async restore() {
-    const ModelClass = modelStatics(this.constructor);
-    const record = await this.repository.restoreById(this.id);
-    if (!record) {
-      return null;
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
     }
-    this.attributes = ModelClass.hydrateAttributes(record);
-    return this;
-  }
-  async loadHasMany(as, relation, childRepository, options = {}) {
-    const grouped = await childRepository.withConnection(this.repository.getConnection()).loadHasManyForParents([this.attributes], relation, options);
-    const loaded = grouped.get(this.attributes[relation.localKey]) ?? [];
-    return Object.assign(this, { [as]: loaded });
-  }
-  async loadHasOne(as, relation, childRepository, options = {}) {
-    const loaded = await this.loadHasMany(as, relation, childRepository, { ...options, limit: 1 });
-    const value = loaded[as]?.[0];
-    return Object.assign(this, { [as]: value });
-  }
-  async loadBelongsTo(as, relation, parentRepository, options = {}) {
-    const grouped = await this.repository.loadBelongsToForParents([this.attributes], relation, parentRepository, options);
-    const loaded = grouped.get(this.attributes[relation.foreignKey]);
-    return Object.assign(this, { [as]: loaded });
-  }
-  async loadBelongsToMany(as, relation, relatedRepository, options = {}) {
-    const connection = this.repository.getConnection();
-    const parentId = this.attributes[relation.parentKey];
-    const pivotRows = await connection.unsafe(`SELECT * FROM ${relation.pivotTable} WHERE ${String(relation.foreignPivotKey)} = $1`, [parentId]);
-    if (pivotRows.length === 0) {
-      return Object.assign(this, { [as]: [] });
-    }
-    const relatedIds = [
-      ...new Set(pivotRows.map((row) => row[relation.relatedPivotKey]))
-    ];
-    const relatedRows = await relatedRepository.withConnection(connection).findAll({
-      ...options,
-      where: {
-        [relation.relatedKey]: relatedIds
-      }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
     });
-    const grouped = indexBelongsToManyRelation([this.attributes], pivotRows, relatedRows, relation);
-    const loaded = grouped.get(parentId) ?? [];
-    return Object.assign(this, { [as]: loaded });
-  }
-  mergeAttributes(patch) {
-    Object.assign(this.attributes, patch);
-    return this;
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
   }
 }
-function registerModelRepository(model, repository) {
-  modelRepositories.set(model, repository);
-  ensureBooted(model);
-  return model;
-}
-// ../../src/core/database/schema/columnDefinition.ts
-class ColumnDefinition {
-  name;
-  kind;
-  length;
-  isNullable = false;
-  isPrimary = false;
-  isUnique = false;
-  autoIncrement = false;
-  defaultValue;
-  checkExpression;
-  foreignKey;
-  constructor(name, kind) {
-    this.name = name;
-    this.kind = kind;
+
+// ../../src/modules/user/notificationTable.ts
+var notificationTable = defineTable({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+var oauthIdentityTable = defineTable({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/table.ts
+var userTable = defineTable({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/guard.ts
+function devHeaderAbilities(role) {
+  if (role === "admin") {
+    return [...ADMIN_ABILITIES];
   }
-  nullable() {
-    this.isNullable = true;
-    return this;
+  return [...MEMBER_ABILITIES];
+}
+
+class GuestGuard {
+  resolve(request) {
+    const userId = request.headers.get("x-authenticated-user-id");
+    if (!userId) {
+      return null;
+    }
+    const role = request.headers.get("x-authenticated-user-role");
+    return {
+      id: userId,
+      abilities: devHeaderAbilities(role),
+      ...role ? { role } : {}
+    };
   }
-  notNullable() {
-    this.isNullable = false;
-    return this;
+}
+
+class ApiTokenGuard {
+  options;
+  constructor(options) {
+    this.options = options;
   }
-  default(value) {
-    if (typeof value === "boolean") {
-      this.defaultValue = value ? "TRUE" : "FALSE";
-      return this;
+  resolve(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return null;
     }
-    if (typeof value === "number") {
-      this.defaultValue = String(value);
-      return this;
+    const token = authorization.slice("Bearer ".length).trim();
+    if (token !== this.options.token) {
+      return null;
     }
-    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
-    return this;
+    return this.options.user;
   }
-  defaultRaw(expression) {
-    this.defaultValue = expression;
-    return this;
+}
+
+class DatabaseTokenGuard {
+  container;
+  constructor(container) {
+    this.container = container;
   }
-  unique() {
-    this.isUnique = true;
-    return this;
+  async resolve(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return null;
+    }
+    const token = authorization.slice("Bearer ".length).trim();
+    if (!token) {
+      return null;
+    }
+    if (!this.container.has(tokenServiceToken)) {
+      return null;
+    }
+    const tokenService = this.container.resolve(tokenServiceToken);
+    return await tokenService.resolveUserFromToken(token);
   }
-  primary() {
-    this.isPrimary = true;
-    return this;
+}
+
+class CompositeGuard {
+  guards;
+  constructor(guards) {
+    this.guards = guards;
   }
-  check(expression) {
-    this.checkExpression = expression;
-    return this;
+  async resolve(request) {
+    for (const guard of this.guards) {
+      const user = await Promise.resolve(guard.resolve(request));
+      if (user) {
+        return user;
+      }
+    }
+    return null;
   }
 }
 
-class ForeignIdColumnDefinition extends ColumnDefinition {
-  constructor(name) {
-    super(name, "foreignId");
-    this.notNullable();
+class AuthManager {
+  guard;
+  constructor(guard) {
+    this.guard = guard;
   }
-  references(table, column = "id") {
-    this.foreignKey = {
-      referencesTable: table,
-      referencesColumn: column
-    };
-    return this;
+  async resolve(request) {
+    if (request) {
+      return await Promise.resolve(this.guard.resolve(request));
+    }
+    return currentAuthUser();
   }
-  constrained(table) {
-    const referencesTable = table ?? inferReferencedTable(this.name);
-    return this.references(referencesTable);
+  user(request) {
+    return this.resolve(request);
   }
-  cascadeOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
-    }
-    this.foreignKey.onDelete = "cascade";
-    return this;
+  async check(request) {
+    return await this.user(request) !== null;
   }
-  nullOnDelete() {
-    if (!this.foreignKey) {
-      throw new Error(`Foreign key is not defined for column ${this.name}`);
+  async requireUser(request) {
+    const user = await this.user(request);
+    if (!user) {
+      throw new UnauthorizedError;
     }
-    this.foreignKey.onDelete = "set null";
-    return this;
-  }
-}
-function inferReferencedTable(columnName) {
-  if (!columnName.endsWith("_id")) {
-    throw new Error(`Cannot infer referenced table from column ${columnName}`);
+    return user;
   }
-  return columnName.slice(0, -3);
 }
-
-// ../../src/core/database/schema/blueprint.ts
-class Blueprint {
-  table;
-  action;
-  columns = [];
-  indexes = [];
-  droppedColumns = [];
-  droppedIndexes = [];
-  constructor(table, action) {
-    this.table = table;
-    this.action = action;
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
   }
-  id(name = "id") {
-    const column = new ColumnDefinition(name, "id");
-    column.primary();
-    column.autoIncrement = true;
-    this.columns.push(column);
-    return column;
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
   }
-  string(name, length) {
-    const column = new ColumnDefinition(name, "string");
-    column.length = length;
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
   }
-  text(name) {
-    const column = new ColumnDefinition(name, "text");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
   }
-  boolean(name) {
-    const column = new ColumnDefinition(name, "boolean");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
   }
-  integer(name) {
-    const column = new ColumnDefinition(name, "integer");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
   }
-  bigInteger(name) {
-    const column = new ColumnDefinition(name, "bigInteger");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+function currentOrgRole(organizationId) {
+  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
+}
+function hasOrgMembership(organizationId) {
+  return currentOrgRole(organizationId) !== null;
+}
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
+function hasMinimumOrgRole2(organizationId, minimum) {
+  const role = currentOrgRole(organizationId);
+  if (!role) {
+    return false;
   }
-  timestamp(name) {
-    const column = new ColumnDefinition(name, "timestamp");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  const ranks = {
+    member: 1,
+    admin: 2,
+    owner: 3
+  };
+  return ranks[role] >= ranks[minimum];
+}
+// ../../src/core/auth/membershipContextMiddleware.ts
+function createMembershipContextMiddleware() {
+  return async (_request, next) => {
+    return await runWithMembershipContext(async () => await next());
+  };
+}
+
+// ../../src/core/auth/membershipMiddleware.ts
+function createMembershipMiddleware() {
+  return createMembershipContextMiddleware();
+}
+// ../../src/core/auth/membershipScope.ts
+function resolveOrganizationScope() {
+  const user = currentAuthUser();
+  if (!user) {
+    return null;
   }
-  json(name) {
-    const column = new ColumnDefinition(name, "json");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  if (isGlobalAdmin(user)) {
+    return null;
   }
-  jsonb(name) {
-    const column = new ColumnDefinition(name, "jsonb");
-    column.notNullable();
-    this.columns.push(column);
-    return column;
+  return currentOrganizationIds();
+}
+function scopedOrganizationIds(requestedOrganizationId) {
+  const scope = resolveOrganizationScope();
+  if (scope === null) {
+    return requestedOrganizationId === undefined ? null : [requestedOrganizationId];
   }
-  foreignId(name) {
-    const column = new ForeignIdColumnDefinition(name);
-    this.columns.push(column);
-    return column;
+  if (requestedOrganizationId !== undefined) {
+    return scope.includes(requestedOrganizationId) ? [requestedOrganizationId] : [];
   }
-  timestamps() {
-    this.timestamp("created_at").defaultRaw("NOW()");
-    this.timestamp("updated_at").defaultRaw("NOW()");
+  return scope;
+}
+function appendOrganizationScope(where, requestedOrganizationId) {
+  const organizationIds = scopedOrganizationIds(requestedOrganizationId);
+  if (organizationIds === null) {
+    return where;
   }
-  softDeletes() {
-    this.timestamp("deleted_at").nullable();
+  if (organizationIds.length === 0) {
+    return {
+      ...where,
+      organization_id: [-1]
+    };
   }
-  dropColumn(name) {
-    this.droppedColumns.push(name);
+  return {
+    ...where,
+    organization_id: organizationIds.length === 1 ? organizationIds[0] : organizationIds
+  };
+}
+function appendProjectScope(where, accessibleProjectIds, requestedProjectId) {
+  if (accessibleProjectIds === null) {
+    if (requestedProjectId === undefined) {
+      return where;
+    }
+    return {
+      ...where,
+      project_id: requestedProjectId
+    };
   }
-  dropSoftDeletes() {
-    this.dropColumn("deleted_at");
-    this.dropIndex(`idx_${this.table}_deleted_at`);
+  if (accessibleProjectIds.length === 0) {
+    return {
+      ...where,
+      project_id: [-1]
+    };
   }
-  dropIndex(name) {
-    this.droppedIndexes.push(name);
+  if (requestedProjectId !== undefined) {
+    return {
+      ...where,
+      project_id: accessibleProjectIds.includes(requestedProjectId) ? requestedProjectId : -1
+    };
   }
-  unique(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "unique"
-    });
+  return {
+    ...where,
+    project_id: accessibleProjectIds
+  };
+}
+function emptyPaginateResult(page, perPage) {
+  return {
+    data: [],
+    meta: {
+      page,
+      per_page: perPage,
+      total: 0,
+      last_page: 1
+    }
+  };
+}
+function assertResourceInCurrentTenant(resourceTenantId, resourceLabel, resourceId) {
+  if (resourceTenantId !== currentTenantId()) {
+    throw new NotFoundError(`${resourceLabel} ${resourceId} not found.`);
   }
-  index(columns, options = {}) {
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "index",
-      order: options.order
-    });
+}
+function assertOrganizationReadable(organizationId) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return;
   }
-  partialIndex(columns, where, nameOrOptions) {
-    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
-    this.indexes.push({
-      name: options.name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: options.unique ? "uniquePartial" : "partial",
-      where
-    });
-  }
-  fullText(columns, name) {
-    this.indexes.push({
-      name,
-      columns: Array.isArray(columns) ? columns : [columns],
-      kind: "fullText"
-    });
+  const organizationIds = scopedOrganizationIds();
+  if (organizationIds !== null && !organizationIds.includes(organizationId)) {
+    throw new NotFoundError(`Organization ${organizationId} not found.`);
   }
-  ginIndex(column, name) {
-    this.indexes.push({
-      name,
-      columns: [column],
-      kind: "gin"
-    });
+}
+// ../../src/core/contracts/di.ts
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
   }
+  return dependency;
 }
-// ../../src/core/database/schema/driver.ts
-function normalizeConnectionName(connection) {
-  const normalized = connection.trim().toLowerCase();
-  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
-    return "pgsql";
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
   }
-  if (normalized === "mysql" || normalized === "mariadb") {
-    return "mysql";
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
   }
-  if (normalized === "sqlite") {
-    return "sqlite";
+  debug(message, context) {
+    this.write("debug", message, context);
   }
-  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
-}
-function resolveDriverFromUrl(url) {
-  const normalized = url.trim().toLowerCase();
-  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
-    return "pgsql";
+  info(message, context) {
+    this.write("info", message, context);
   }
-  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
-    return "mysql";
+  warn(message, context) {
+    this.write("warn", message, context);
   }
-  if (normalized.startsWith("sqlite:")) {
-    return "sqlite";
+  error(message, context) {
+    this.write("error", message, context);
   }
-  return null;
 }
-function resolveDatabaseDriver(options = {}) {
-  const connection = options.connection ?? process.env.DB_CONNECTION;
-  if (connection) {
-    return normalizeConnectionName(connection);
+var appLogger = new Logger("app");
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
   }
-  const url = options.url ?? process.env.DATABASE_URL ?? "";
-  const fromUrl = resolveDriverFromUrl(url);
-  if (fromUrl) {
-    return fromUrl;
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
   }
-  return "pgsql";
+  return activeContext;
 }
-// ../../src/core/database/schema/errors.ts
-class UnsupportedSchemaFeatureError extends Error {
-  constructor(feature, driver) {
-    super(`${feature} is not supported for the ${driver} driver`);
-    this.name = "UnsupportedSchemaFeatureError";
-  }
+function setActiveApplicationContext(context) {
+  activeContext = context;
+  globalThis[APPLICATION_CONTEXT_KEY] = context;
 }
-// ../../src/core/database/schema/grammars/grammar.ts
-function compileColumnType(driver, column) {
-  switch (column.kind) {
-    case "id":
-      return compileIdType(driver);
-    case "string":
-      return compileStringType(driver, column.length);
-    case "text":
-      return compileTextType(driver);
-    case "boolean":
-      return compileBooleanType(driver);
-    case "integer":
-    case "foreignId":
-      return compileIntegerType(driver);
-    case "bigInteger":
-      return compileBigIntegerType(driver);
-    case "timestamp":
-      return compileTimestampType(driver);
-    case "json":
-      return compileJsonType(driver);
-    case "jsonb":
-      return compileJsonbType(driver);
-    default:
-      throw new Error(`Unsupported column kind: ${column.kind}`);
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
   }
+  return context;
 }
-function compileIdType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "SERIAL";
-    case "mysql":
-      return "BIGINT UNSIGNED";
-    case "sqlite":
-      return "INTEGER";
-  }
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
 }
-function compileStringType(driver, length) {
-  switch (driver) {
-    case "pgsql":
-      return "TEXT";
-    case "mysql":
-      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
-    case "sqlite":
-      return "TEXT";
-  }
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
-function compileTextType(driver) {
-  switch (driver) {
-    case "pgsql":
-    case "sqlite":
-      return "TEXT";
-    case "mysql":
-      return "TEXT";
-  }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
 }
-function compileBooleanType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BOOLEAN";
-    case "mysql":
-      return "BOOLEAN";
-    case "sqlite":
-      return "INTEGER";
-  }
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }
-function compileIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "INTEGER";
-    case "mysql":
-      return "INT";
-    case "sqlite":
-      return "INTEGER";
-  }
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
 }
-function compileBigIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BIGINT";
-    case "mysql":
-      return "BIGINT";
-    case "sqlite":
-      return "INTEGER";
-  }
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
 }
-function compileTimestampType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "TIMESTAMPTZ";
-    case "mysql":
-      return "TIMESTAMP";
-    case "sqlite":
-      return "TEXT";
-  }
+function resolveApplicationLogger() {
+  return appLogger;
 }
-function compileJsonType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
 }
-function compileJsonbType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
+
+// ../../src/core/auth/resolveMembershipService.ts
+function resolveMembershipService() {
+  const dependencies = resolveApplicationDependencies();
+  if (dependencies.container.has("core.membership")) {
+    return dependencies.container.resolve("core.membership");
   }
+  return new membershipService_default;
 }
 
-// ../../src/core/database/schema/grammars/compileStatements.ts
-function compileCreateTable(driver, blueprint) {
-  const table = quoteIdentifier(blueprint.table);
-  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length > 1) {
-      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-      parts.push(`UNIQUE (${columns})`);
-    }
+// ../../src/core/auth/membershipService.ts
+class MembershipService {
+  members;
+  constructor(members = membershipRepository) {
+    this.members = members;
   }
-  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
-  ${parts.join(`,
-  `)}
-)`];
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length === 1) {
-      continue;
+  async listOrganizationIdsForUser(userId) {
+    const memberships = await this.members.listForUser(userId);
+    return memberships.map((membership) => membership.organization_id);
+  }
+  async getOrgRole(userId, organizationId) {
+    const membership = await this.members.findMembership(userId, organizationId);
+    return membership?.role ?? null;
+  }
+  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
+    if (!user) {
+      throw new ForbiddenError("Authentication required.");
     }
-    if (index.kind === "index") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    if (isGlobalAdmin(user)) {
+      return "owner";
     }
+    const role = await this.getOrgRole(resolveUserId(user), organizationId);
+    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
+      throw new ForbiddenError("Organization membership required.");
+    }
+    return role;
   }
-  return statements;
-}
-function compileAlterTable(driver, blueprint) {
-  const statements = [];
-  const table = quoteIdentifier(blueprint.table);
-  for (const column of blueprint.columns) {
-    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
-    statements.push(`ALTER TABLE ${table}
-${addPrefix} ${compileColumn(driver, column, "alter")}`);
-  }
-  for (const columnName of blueprint.droppedColumns) {
-    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
-    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
+  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
+    if (!user) {
+      return [];
+    }
+    if (isGlobalAdmin(user)) {
+      return organizationIds;
+    }
+    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
+    return organizationIds.filter((organizationId) => allowed.has(organizationId));
   }
-  for (const indexName of blueprint.droppedIndexes) {
-    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
+  async addOwnerOnOrganizationCreate(organizationId, userId) {
+    await this.members.addMember({
+      organizationId,
+      userId,
+      role: "owner"
+    });
   }
-  for (const index of blueprint.indexes) {
-    if (index.kind === "index" || index.kind === "unique") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
+  listMembersForOrganization(organizationId) {
+    return this.members.listForOrganization(organizationId);
   }
-  return statements;
-}
-function compileDropTable(driver, tableName) {
-  const cascade = driver === "pgsql" ? " CASCADE" : "";
-  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
-}
-function compileColumn(driver, column, mode) {
-  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
-  if (column.autoIncrement && driver === "mysql") {
-    parts[1] = `${parts[1]} AUTO_INCREMENT`;
+  addMember(input) {
+    return this.members.addMember(input);
   }
-  if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
-      parts.push("PRIMARY KEY AUTOINCREMENT");
-    } else {
-      parts.push("PRIMARY KEY");
-    }
-  } else if (!column.isNullable) {
-    parts.push("NOT NULL");
-  } else if (column.isNullable) {
-    parts.push("NULL");
+  removeMember(organizationId, userId) {
+    return this.members.removeMember(organizationId, userId);
   }
-  if (column.defaultValue !== undefined) {
-    parts.push(`DEFAULT ${column.defaultValue}`);
+}
+var membershipService_default = MembershipService;
+// ../../src/core/auth/policy.ts
+class Policy {
+  constructor() {}
+  view(_user, _resource) {
+    return false;
   }
-  if (column.isUnique) {
-    parts.push("UNIQUE");
+  create(_user) {
+    return false;
   }
-  if (column.checkExpression) {
-    parts.push(`CHECK (${column.checkExpression})`);
+  update(_user, _resource) {
+    return false;
   }
-  if (column.foreignKey) {
-    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
-    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
-    let clause = `REFERENCES ${reference}`;
-    if (onDelete === "cascade") {
-      clause += " ON DELETE CASCADE";
-    } else if (onDelete === "set null") {
-      clause += " ON DELETE SET NULL";
-    }
-    parts.push(clause);
+  delete(_user, _resource) {
+    return false;
   }
-  return parts.join(" ");
 }
-function compileIndex(_driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
-  const columns = index.columns.map((column) => {
-    const quoted = quoteIdentifier(column);
-    if (index.order === "desc") {
-      return `${quoted} DESC`;
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
     }
-    return quoted;
-  }).join(", ");
-  const unique = index.kind === "unique" ? "UNIQUE " : "";
-  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
-}
-function compileSpecialIndex(driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
-  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-  switch (index.kind) {
-    case "partial":
-    case "uniquePartial": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
-      }
-      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
-      return [
-        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
-      ];
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
     }
-    case "gin": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
-      }
-      return [
-        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
-      ];
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
     }
-    case "fullText": {
-      if (driver === "mysql") {
-        return [
-          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
-        ];
-      }
-      if (driver === "pgsql") {
-        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
-      }
-      throw new UnsupportedSchemaFeatureError("fullText()", driver);
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
     }
-    default:
-      return [];
   }
 }
-function defaultIndexName(tableName, columns, kind) {
-  return `idx_${tableName}_${columns.join("_")}_${kind}`;
+// ../../src/core/database/bindConnection.ts
+function bindDatabaseConnection2(connection) {
+  bindDatabaseConnection(connection);
 }
-function compileBlueprint(driver, blueprint) {
-  switch (blueprint.action) {
-    case "create":
-      return compileCreateTable(driver, blueprint);
-    case "alter":
-      return compileAlterTable(driver, blueprint);
-    case "drop":
-      return compileDropTable(driver, blueprint.table);
-    default:
-      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
+  return timingSafeEqual(leftBuffer, rightBuffer);
 }
-// ../../src/core/database/schema/grammars/createGrammar.ts
-function createGrammar(driver) {
-  return {
-    driver,
-    compile(blueprint) {
-      return compileBlueprint(driver, blueprint);
+
+// ../../src/core/security/scimTenantTokens.ts
+function parseScimTenantTokens(raw) {
+  const tokens = new Map;
+  if (!raw?.trim()) {
+    return tokens;
+  }
+  for (const entry of raw.split(",")) {
+    const [tenantPart, tokenPart] = entry.split(":");
+    if (!tenantPart || !tokenPart) {
+      continue;
     }
-  };
+    const tenantId = Number.parseInt(tenantPart.trim(), 10);
+    const token = tokenPart.trim();
+    if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
+      tokens.set(tenantId, token);
+    }
+  }
+  return tokens;
+}
+function resolveScimTenantFromToken(token) {
+  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
+  for (const [tenantId, expectedToken] of tenantTokens) {
+    if (timingSafeCompareString(token, expectedToken)) {
+      return tenantId;
+    }
+  }
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
+  if (timingSafeCompareString(token, fallbackToken)) {
+    return 1;
+  }
+  return null;
 }
 
-// ../../src/core/database/schema/grammars/mysqlGrammar.ts
-var MySqlGrammar = createGrammar("mysql");
-
-// ../../src/core/database/schema/grammars/postgresGrammar.ts
-var PostgresGrammar = createGrammar("pgsql");
-
-// ../../src/core/database/schema/grammars/sqliteGrammar.ts
-var SqliteGrammar = createGrammar("sqlite");
-
-// ../../src/core/database/schema/grammars/index.ts
-function grammarForDriver(driver) {
-  switch (driver) {
-    case "pgsql":
-      return PostgresGrammar;
-    case "mysql":
-      return MySqlGrammar;
-    case "sqlite":
-      return SqliteGrammar;
-    default:
-      throw new Error(`Unsupported database driver: ${driver}`);
-  }
-}
-// ../../src/core/database/schema/schema.ts
-class SchemaBuilder {
-  #driver;
-  #statements = [];
-  constructor(driver) {
-    this.#driver = driver;
-  }
-  create(table, callback) {
-    const blueprint = new Blueprint(table, "create");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  table(table, callback) {
-    const blueprint = new Blueprint(table, "alter");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  drop(table) {
-    const blueprint = new Blueprint(table, "drop");
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  toSql() {
-    return [...this.#statements];
-  }
-  async execute(db) {
-    for (const statement of this.#statements) {
-      await db.unsafe(statement);
-    }
-  }
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await repositoryConnection`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
 }
 
-class Schema {
-  static builder(driver) {
-    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
-  }
-  static async run(db, driver, callback) {
-    const schema = Schema.builder(driver);
-    await callback(schema);
-    await schema.execute(db);
-  }
-}
-function createSchemaBuilder(db, driver) {
-  const builder = Schema.builder(driver);
-  return Object.assign(builder, {
-    async commit() {
-      await builder.execute(db);
-    }
-  });
-}
-// ../../src/core/database/table.ts
-function defineTable(definition) {
-  return definition;
-}
-// ../../src/core/database/transaction.ts
-function supportsTransactions(connection) {
-  return typeof connection.begin === "function";
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
-async function runInTransaction(operation) {
-  const pool = resolveRepositoryConnection();
-  if (!supportsTransactions(pool)) {
-    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+async function runWithTenantDatabase(tenant, callback) {
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    return await runWithTenant(tenant, callback);
   }
-  return await pool.begin(async (transaction) => {
-    return await operation(createDatabaseConnection(transaction));
+  return await getDefaultDatabasePool().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
   });
 }
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
 
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection2(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
+// ../../src/core/auth/scimAuthMiddleware.ts
+function createScimAuthMiddleware() {
+  return async (request, next) => {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return jsonScimError("SCIM bearer token required.", 401);
+    }
+    const token = authorization.slice("Bearer ".length).trim();
+    const tenantId = resolveScimTenantFromToken(token);
+    if (tenantId === null) {
+      return jsonScimError("Invalid SCIM bearer token.", 401);
+    }
+    const tenant = await resolveTenant(tenantId);
+    if (!tenant) {
+      return jsonScimError("SCIM tenant not found.", 401);
+    }
+    return await runWithTenantDatabase(tenant, async () => {
+      bindDatabaseConnection2(getActiveDatabaseConnection(getDefaultDatabasePool()));
+      try {
+        return await next();
+      } finally {
+        resetBoundDatabaseConnection();
+      }
+    });
+  };
+}
+function jsonScimError(detail, status) {
+  return Response.json({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    detail,
+    status: String(status)
+  }, {
+    status,
+    headers: { "content-type": "application/scim+json" }
   });
 }
+// ../../src/core/cache/redisCacheStore.ts
+var {RedisClient } = globalThis.Bun;
+var KEY_PREFIX = "workhub:cache:";
+var TAG_PREFIX = "workhub:cache:tag:";
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
+class RedisCacheStore {
+  ttlMs;
+  maxEntries;
+  client;
+  inflight = new Map;
+  keyTags = new Map;
+  constructor(redisUrl, ttlMs, maxEntries) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    this.client = new RedisClient(redisUrl);
   }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
+  async get(key) {
+    const raw = await this.client.get(this.storageKey(key));
+    if (raw === null) {
+      return;
+    }
+    return JSON.parse(raw);
   }
-});
-var connection_default = db;
-
-// ../../src/modules/user/apiTokenTable.ts
-var apiTokenTable = defineTable({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/core/auth/password.ts
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
+  async set(key, value, ttlMs) {
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    const payload = JSON.stringify(value);
+    if (resolvedTtlMs > 0) {
+      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
+    } else {
+      await this.client.set(this.storageKey(key), payload);
+    }
+    await this.enforceMaxEntries();
   }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
+  async getOrSet(key, loader, ttlMs) {
+    const cached = await this.get(key);
+    if (cached !== undefined) {
+      return cached;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then(async (value) => {
+      await this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
   }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
+  async attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      await this.client.sadd(this.tagKey(tag), key);
+    }
   }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
-}
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
+  async flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const members = await this.client.smembers(this.tagKey(tag));
+      for (const member of members) {
+        keysToRemove.add(member);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (await this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      await this.client.del(this.tagKey(tag));
+    }
+    return removed;
+  }
+  async invalidate(key) {
+    const deleted = await this.client.del(this.storageKey(key));
+    await this.detachKeyFromTags(key);
+    return deleted > 0;
+  }
+  async invalidateByPrefix(prefix) {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    let removed = 0;
+    for (const storageKey of keys) {
+      const key = storageKey.slice(KEY_PREFIX.length);
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (await this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
   }
-  if (featureFlag === "true") {
-    return true;
+  async clear() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length > 0) {
+      await this.client.del(...keys);
+    }
+    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
+    if (tagKeys.length > 0) {
+      await this.client.del(...tagKeys);
+    }
+    this.inflight.clear();
+    this.keyTags.clear();
   }
-  return (process.env.APP_ENV ?? "local") === "production";
-}
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
+  async size() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    return keys.length;
   }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-
-// ../../src/core/crypto/mfaSecret.ts
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
+  storageKey(key) {
+    return `${KEY_PREFIX}${key}`;
   }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
+  tagKey(tag) {
+    return `${TAG_PREFIX}${tag}`;
   }
-  return decryptField(stored, key);
-}
-
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
+  async detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
+    }
+    for (const tag of tags) {
+      await this.client.srem(this.tagKey(tag), key);
+    }
+    this.keyTags.delete(key);
   }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
+  async enforceMaxEntries() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length <= this.maxEntries) {
+      return;
+    }
+    const overflow = keys.length - this.maxEntries;
+    const keysToRemove = keys.slice(0, overflow);
+    if (keysToRemove.length > 0) {
+      await this.client.del(...keysToRemove);
+    }
   }
-  return parsed;
 }
+var redisCacheStore_default = RedisCacheStore;
 
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
+// ../../src/core/cache/simpleCache.ts
+class SimpleCache {
+  ttlMs;
+  maxEntries;
+  cache = new Map;
+  inflight = new Map;
+  tagIndex = new Map;
+  keyTags = new Map;
+  constructor(ttlMs = 3600000, maxEntries = 100) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
+      throw new RangeError("ttlMs must be a non-negative number.");
+    }
+    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
+      throw new RangeError("maxEntries must be a positive integer.");
     }
-    bits += value.toString(2).padStart(5, "0");
   }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  get(key) {
+    return this.getFreshEntry(key)?.value;
   }
-  return Buffer.from(bytes);
-}
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
-}
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
+  set(key, value, ttlMs) {
+    const now = Date.now();
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    this.cache.set(key, {
+      value,
+      expiresAt: now + resolvedTtlMs,
+      lastAccessedAt: now
+    });
+    this.evictOverflow();
   }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
+  async getOrSet(key, loader, ttlMs) {
+    this.pruneExpired();
+    const cachedEntry = this.getFreshEntry(key);
+    if (cachedEntry) {
+      return cachedEntry.value;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then((value) => {
+      this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
+  }
+  attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      let keysForTag = this.tagIndex.get(tag);
+      if (!keysForTag) {
+        keysForTag = new Set;
+        this.tagIndex.set(tag, keysForTag);
+      }
+      keysForTag.add(key);
     }
   }
-  return false;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
+  flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      for (const key of keys) {
+        keysToRemove.add(key);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      this.tagIndex.delete(tag);
+    }
+    return removed;
   }
-}
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
+  invalidate(key) {
+    const removed = this.cache.delete(key);
+    if (removed) {
+      this.detachKeyFromTags(key);
+    }
+    return removed;
   }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
+  invalidateByPrefix(prefix) {
+    let removed = 0;
+    for (const key of [...this.cache.keys()]) {
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
   }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
+  clear() {
+    this.cache.clear();
+    this.inflight.clear();
+    this.tagIndex.clear();
+    this.keyTags.clear();
   }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
+  size() {
+    this.pruneExpired();
+    return this.cache.size;
+  }
+  detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
     }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      keys.delete(key);
+      if (keys.size === 0) {
+        this.tagIndex.delete(tag);
       }
     }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
+    this.keyTags.delete(key);
   }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
+  getFreshEntry(key) {
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return;
     }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
+    if (entry.expiresAt <= Date.now()) {
+      this.invalidate(key);
+      return;
+    }
+    entry.lastAccessedAt = Date.now();
+    return entry;
   }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
+  pruneExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache.entries()) {
+      if (entry.expiresAt <= now) {
+        this.invalidate(key);
+      }
     }
-    return provider.getAuthorizationUrl(state);
   }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+  evictOverflow() {
+    while (this.cache.size > this.maxEntries) {
+      let oldestKey;
+      let oldestAccessTime = Number.POSITIVE_INFINITY;
+      for (const [key, entry] of this.cache.entries()) {
+        if (entry.lastAccessedAt < oldestAccessTime) {
+          oldestAccessTime = entry.lastAccessedAt;
+          oldestKey = key;
+        }
+      }
+      if (!oldestKey) {
+        return;
+      }
+      this.invalidate(oldestKey);
     }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
   }
 }
+var simpleCache_default = SimpleCache;
 
-// ../../src/modules/user/notificationTable.ts
-var notificationTable = defineTable({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
-
-// ../../src/modules/user/oauthIdentityRepository.ts
-var oauthIdentityTable = defineTable({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/table.ts
-var userTable = defineTable({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/provider.ts
-var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
-
-// ../../src/core/auth/guard.ts
-function devHeaderAbilities(role) {
-  if (role === "admin") {
-    return [...ADMIN_ABILITIES];
+// ../../src/core/cache/simpleCacheStore.ts
+class SimpleCacheStore {
+  cache;
+  constructor(cache) {
+    this.cache = cache;
+  }
+  get(key) {
+    return Promise.resolve(this.cache.get(key));
+  }
+  set(key, value, ttlMs) {
+    this.cache.set(key, value, ttlMs);
+    return Promise.resolve();
+  }
+  getOrSet(key, loader, ttlMs) {
+    return this.cache.getOrSet(key, loader, ttlMs);
+  }
+  attachTags(key, tags) {
+    this.cache.attachTags(key, tags);
+    return Promise.resolve();
+  }
+  flushTags(tags) {
+    return Promise.resolve(this.cache.flushTags(tags));
+  }
+  invalidate(key) {
+    return Promise.resolve(this.cache.invalidate(key));
+  }
+  invalidateByPrefix(prefix) {
+    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
+  }
+  clear() {
+    this.cache.clear();
+    return Promise.resolve();
+  }
+  size() {
+    return Promise.resolve(this.cache.size());
   }
-  return [...MEMBER_ABILITIES];
 }
+var simpleCacheStore_default = SimpleCacheStore;
 
-class GuestGuard {
-  resolve(request) {
-    const userId = request.headers.get("x-authenticated-user-id");
-    if (!userId) {
-      return null;
+// ../../src/core/cache/createCacheStore.ts
+function createCacheStore(options) {
+  if (options.driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
     }
-    const role = request.headers.get("x-authenticated-user-role");
-    return {
-      id: userId,
-      abilities: devHeaderAbilities(role),
-      ...role ? { role } : {}
-    };
+    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
+  }
+  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
+}
+// ../../src/core/cache/taggedCache.ts
+class TaggedCache {
+  store;
+  tags;
+  constructor(store, tags) {
+    this.store = store;
+    this.tags = tags;
+  }
+  async remember(key, callback, ttlMs) {
+    const value = await this.store.getOrSet(key, callback, ttlMs);
+    await this.store.attachTags(key, this.tags);
+    return value;
+  }
+  async flush() {
+    return this.store.flushTags(this.tags);
   }
 }
+var taggedCache_default = TaggedCache;
 
-class ApiTokenGuard {
-  options;
-  constructor(options) {
-    this.options = options;
+// ../../src/core/cache/repository.ts
+class CacheRepository {
+  store;
+  constructor(store) {
+    this.store = store;
   }
-  resolve(request) {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return null;
-    }
-    const token = authorization.slice("Bearer ".length).trim();
-    if (token !== this.options.token) {
-      return null;
-    }
-    return this.options.user;
+  async get(key) {
+    return this.store.get(key);
+  }
+  async remember(key, callback, ttlMs) {
+    return this.store.getOrSet(key, callback, ttlMs);
+  }
+  async forget(key) {
+    return this.store.invalidate(key);
+  }
+  async flush() {
+    await this.store.clear();
+  }
+  tags(...names) {
+    return new taggedCache_default(this.store, names);
+  }
+  async getOrSet(key, loader, ttlMs) {
+    return this.remember(key, loader, ttlMs);
+  }
+  async invalidate(key) {
+    return this.forget(key);
+  }
+  async invalidateByPrefix(prefix) {
+    return this.store.invalidateByPrefix(prefix);
+  }
+  async clear() {
+    await this.flush();
+  }
+  async size() {
+    return this.store.size();
   }
 }
-
-class DatabaseTokenGuard {
-  container;
-  constructor(container) {
-    this.container = container;
+var repository_default2 = CacheRepository;
+// ../../src/core/cache/tags.ts
+var CACHE_TAGS = {
+  organizations: "organizations",
+  projects: "projects",
+  tasks: "tasks",
+  comments: "comments",
+  attachments: "attachments",
+  reports: "reports"
+};
+// ../../src/core/contracts/container.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
   }
-  async resolve(request) {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return null;
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
     }
-    const token = authorization.slice("Bearer ".length).trim();
-    if (!token) {
-      return null;
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
     }
-    if (!this.container.has(tokenServiceToken)) {
-      return null;
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
     }
-    const tokenService = this.container.resolve(tokenServiceToken);
-    return await tokenService.resolveUserFromToken(token);
+    throw new Error(`Service "${key}" is not registered.`);
   }
-}
-
-class CompositeGuard {
-  guards;
-  constructor(guards) {
-    this.guards = guards;
+  resolve(key) {
+    return this.get(key);
   }
-  async resolve(request) {
-    for (const guard of this.guards) {
-      const user = await Promise.resolve(guard.resolve(request));
-      if (user) {
-        return user;
-      }
-    }
-    return null;
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
   }
 }
 
-class AuthManager {
-  guard;
-  constructor(guard) {
-    this.guard = guard;
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
   }
-  async resolve(request) {
-    if (request) {
-      return await Promise.resolve(this.guard.resolve(request));
-    }
-    return currentAuthUser();
+  get(key) {
+    return this.values.get(key);
   }
-  user(request) {
-    return this.resolve(request);
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
   }
-  async check(request) {
-    return await this.user(request) !== null;
+  has(key) {
+    return this.values.has(key);
   }
-  async requireUser(request) {
-    const user = await this.user(request);
-    if (!user) {
-      throw new UnauthorizedError;
+}
+// ../../src/core/database/connection.ts
+function createDatabaseConnection2(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
     }
-    return user;
-  }
+  };
 }
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
+// ../../src/core/database/migrations/advisoryLock.ts
+var MIGRATION_LOCK_KEY = 42424242;
+async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
+  await db2.unsafe("SELECT pg_advisory_lock($1)", [lockKey]);
+  try {
+    return await callback();
+  } finally {
+    await db2.unsafe("SELECT pg_advisory_unlock($1)", [lockKey]);
   }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
+}
+// ../../src/core/database/migrations/runner.ts
+import { readdir } from "fs/promises";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var MIGRATIONS_TABLE = "framework_migrations";
+async function ensureMigrationsTable(db2) {
+  await db2.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+      name TEXT PRIMARY KEY,
+      batch INTEGER NOT NULL,
+      run_on TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `);
+}
+async function getAppliedMigrations(db2) {
+  await ensureMigrationsTable(db2);
+  return await db2.unsafe(`
+    SELECT name, batch
+    FROM ${MIGRATIONS_TABLE}
+    ORDER BY batch ASC, name ASC
+  `);
+}
+async function loadMigrationsFromDirectory(directory) {
+  const entries = await readdir(directory);
+  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedMigrations.filter((migration) => migration?.name !== undefined);
+}
+async function getMigrationStatus(db2, migrations) {
+  const applied = await getAppliedMigrations(db2);
+  const appliedByName = new Map(applied.map(({ name, batch }) => [name, Number(batch)]));
+  return migrations.map(({ name }) => ({
+    name,
+    status: appliedByName.has(name) ? "up" : "pending",
+    batch: appliedByName.get(name) ?? null
+  }));
+}
+async function runPendingMigrations(db2, migrations, options = {}) {
+  const applied = await getAppliedMigrations(db2);
+  const appliedNames = new Set(applied.map(({ name }) => name));
+  const nextBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0) + 1;
+  const pendingMigrations = migrations.filter(({ name }) => !appliedNames.has(name));
+  for (const migration of pendingMigrations) {
+    options.onMigration?.(migration.name);
+    await migration.up(db2);
+    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
+    if (inserted.length === 0) {
+      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
     }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
   }
+  return pendingMigrations.length;
 }
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var membershipRepository = new memberRepository_default;
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
+async function migrateDatabase(db2, migrations, options = {}) {
+  const { advisoryLock = false, onMigration } = options;
+  if (advisoryLock) {
+    return withMigrationLock(db2, () => runPendingMigrations(db2, migrations, { onMigration }));
   }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-function currentOrgRole(organizationId) {
-  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
-}
-function hasOrgMembership(organizationId) {
-  return currentOrgRole(organizationId) !== null;
-}
-function currentOrganizationIds() {
-  return membershipContext.getStore()?.organizationIds ?? [];
+  return runPendingMigrations(db2, migrations, { onMigration });
 }
-function hasMinimumOrgRole2(organizationId, minimum) {
-  const role = currentOrgRole(organizationId);
-  if (!role) {
-    return false;
+async function rollbackDatabase(db2, migrations, options = {}) {
+  const applied = await getAppliedMigrations(db2);
+  if (applied.length === 0) {
+    return 0;
   }
-  const ranks = {
-    member: 1,
-    admin: 2,
-    owner: 3
-  };
-  return ranks[role] >= ranks[minimum];
+  const lastBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0);
+  const migrationsToRollback = new Set(applied.filter(({ batch }) => Number(batch) === lastBatch).map(({ name }) => name));
+  let rolledBack = 0;
+  for (const migration of [...migrations].reverse()) {
+    if (!migrationsToRollback.has(migration.name)) {
+      continue;
+    }
+    options.onMigration?.(migration.name);
+    await migration.down(db2);
+    await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE} WHERE name = $1`, [migration.name]);
+    rolledBack += 1;
+  }
+  return rolledBack;
 }
-// ../../src/core/auth/membershipContextMiddleware.ts
-function createMembershipContextMiddleware() {
-  return async (_request, next) => {
-    return await runWithMembershipContext(async () => await next());
+async function freshDatabase(db2, migrations, options = {}) {
+  const runFresh = async () => {
+    const applied = await getAppliedMigrations(db2);
+    const appliedNames = new Set(applied.map(({ name }) => name));
+    const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
+    for (const migration of [...appliedMigrations].reverse()) {
+      options.onMigration?.(migration.name);
+      await migration.down(db2);
+    }
+    if (appliedMigrations.length > 0) {
+      await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
+    }
+    await runPendingMigrations(db2, migrations, options);
   };
+  if (options.advisoryLock) {
+    await withMigrationLock(db2, runFresh);
+    return;
+  }
+  await runFresh();
 }
-
-// ../../src/core/auth/membershipMiddleware.ts
-function createMembershipMiddleware() {
-  return createMembershipContextMiddleware();
+// ../../src/core/database/model.ts
+var modelRepositories = new WeakMap;
+var modelGlobalScopes = new WeakMap;
+var modelBooted = new WeakSet;
+function resolveModelRepository(model) {
+  const repository = modelRepositories.get(model);
+  if (!repository) {
+    throw new Error(`${model.name}.repository() is not implemented.`);
+  }
+  return repository;
 }
-// ../../src/core/auth/membershipScope.ts
-function resolveOrganizationScope() {
-  const user = currentAuthUser();
-  if (!user) {
-    return null;
+function modelStatics(model) {
+  return model;
+}
+function ensureBooted(model) {
+  if (modelBooted.has(model)) {
+    return;
   }
-  if (isGlobalAdmin(user)) {
-    return null;
+  modelBooted.add(model);
+  const boot = model.boot;
+  if (typeof boot === "function") {
+    boot.call(model);
   }
-  return currentOrganizationIds();
 }
-function scopedOrganizationIds(requestedOrganizationId) {
-  const scope = resolveOrganizationScope();
-  if (scope === null) {
-    return requestedOrganizationId === undefined ? null : [requestedOrganizationId];
+function getGlobalScopes(model) {
+  return modelGlobalScopes.get(model) ?? [];
+}
+function hydrateValue(value, cast) {
+  if (value === null || value === undefined) {
+    return value;
   }
-  if (requestedOrganizationId !== undefined) {
-    return scope.includes(requestedOrganizationId) ? [requestedOrganizationId] : [];
+  switch (cast) {
+    case "date":
+    case "datetime":
+      return value instanceof Date ? value : new Date(String(value));
+    case "json":
+      return typeof value === "string" ? JSON.parse(value) : value;
+    case "bool":
+    case "boolean":
+      return value === true || value === 1 || value === "1" || value === "true";
+    default:
+      return value;
   }
-  return scope;
 }
-function appendOrganizationScope(where, requestedOrganizationId) {
-  const organizationIds = scopedOrganizationIds(requestedOrganizationId);
-  if (organizationIds === null) {
-    return where;
+function dehydrateValue(value, cast) {
+  if (value === null || value === undefined) {
+    return value;
   }
-  if (organizationIds.length === 0) {
-    return {
-      ...where,
-      organization_id: [-1]
-    };
+  switch (cast) {
+    case "date":
+    case "datetime":
+      return value instanceof Date ? value : new Date(String(value));
+    case "json":
+      return typeof value === "string" ? value : JSON.stringify(value);
+    case "bool":
+    case "boolean":
+      return Boolean(value);
+    default:
+      return value;
   }
-  return {
-    ...where,
-    organization_id: organizationIds.length === 1 ? organizationIds[0] : organizationIds
-  };
 }
-function appendProjectScope(where, accessibleProjectIds, requestedProjectId) {
-  if (accessibleProjectIds === null) {
-    if (requestedProjectId === undefined) {
-      return where;
-    }
-    return {
-      ...where,
-      project_id: requestedProjectId
-    };
-  }
-  if (accessibleProjectIds.length === 0) {
-    return {
-      ...where,
-      project_id: [-1]
-    };
+function filterMassAssignable(fillable, guarded, input) {
+  const resolvedGuarded = guarded ?? true;
+  if (fillable && fillable.length > 0) {
+    const allowed = new Set(fillable);
+    return Object.fromEntries(Object.entries(input).filter(([key]) => allowed.has(key)));
   }
-  if (requestedProjectId !== undefined) {
-    return {
-      ...where,
-      project_id: accessibleProjectIds.includes(requestedProjectId) ? requestedProjectId : -1
-    };
+  if (resolvedGuarded === true || resolvedGuarded.includes("*")) {
+    return {};
   }
-  return {
-    ...where,
-    project_id: accessibleProjectIds
-  };
+  const blocked = new Set(resolvedGuarded);
+  return Object.fromEntries(Object.entries(input).filter(([key]) => !blocked.has(key)));
 }
-function emptyPaginateResult(page, perPage) {
-  return {
-    data: [],
-    meta: {
-      page,
-      per_page: perPage,
-      total: 0,
-      last_page: 1
+function applyCasts(values, casts, direction) {
+  if (Object.keys(casts).length === 0) {
+    return values;
+  }
+  const result = { ...values };
+  const castFn = direction === "hydrate" ? hydrateValue : dehydrateValue;
+  for (const [key, cast] of Object.entries(casts)) {
+    if (key in result && cast) {
+      result[key] = castFn(result[key], cast);
     }
-  };
-}
-function assertResourceInCurrentTenant(resourceTenantId, resourceLabel, resourceId) {
-  if (resourceTenantId !== currentTenantId()) {
-    throw new NotFoundError(`${resourceLabel} ${resourceId} not found.`);
   }
+  return result;
 }
-function assertOrganizationReadable(organizationId) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return;
+function applyTimestampsOnCreate(columns, values, enabled) {
+  if (!enabled) {
+    return values;
   }
-  const organizationIds = scopedOrganizationIds();
-  if (organizationIds !== null && !organizationIds.includes(organizationId)) {
-    throw new NotFoundError(`Organization ${organizationId} not found.`);
+  const now = new Date;
+  const result = { ...values };
+  if (columns.includes("created_at")) {
+    result.created_at = now;
+  }
+  if (columns.includes("updated_at")) {
+    result.updated_at = now;
   }
+  return result;
 }
-// ../../src/core/contracts/di.ts
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
+function applyTimestampsOnUpdate(columns, values, enabled) {
+  if (!enabled) {
+    return values;
   }
-  return dependency;
-}
-function resolveService(dependencies, token) {
-  return dependencies.container.resolve(token);
+  const result = { ...values };
+  if (columns.includes("updated_at")) {
+    result.updated_at = new Date;
+  }
+  return result;
 }
 
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
+class Model {
+  attributes;
+  repository;
+  static $fillable;
+  static $guarded;
+  static $casts = {};
+  static $timestamps = true;
+  _exists;
+  constructor(attributes, repository, exists = true) {
+    this.attributes = attributes;
+    this.repository = repository;
+    this._exists = exists;
   }
-  debug(message, context) {
-    this.write("debug", message, context);
+  get $exists() {
+    return this._exists;
   }
-  info(message, context) {
-    this.write("info", message, context);
+  get(key) {
+    return this.attributes[key];
   }
-  warn(message, context) {
-    this.write("warn", message, context);
+  get id() {
+    return this.attributes[this.primaryKey()];
   }
-  error(message, context) {
-    this.write("error", message, context);
+  toObject() {
+    return { ...this.attributes };
   }
-}
-var appLogger = new Logger("app");
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
+  primaryKey() {
+    throw new Error(`${this.constructor.name}.primaryKey() is not implemented.`);
   }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
+  static primaryKeyField() {
+    return resolveModelRepository(this).getTable().primaryKey;
   }
-  return activeContext;
-}
-function setActiveApplicationContext(context) {
-  activeContext = context;
-  globalThis[APPLICATION_CONTEXT_KEY] = context;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
+  static hydrateAttributes(attributes) {
+    const casts = modelStatics(this).$casts ?? {};
+    return applyCasts(attributes, casts, "hydrate");
   }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationQueue() {
-  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
-}
-function resolveApplicationEventBus() {
-  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
-}
-function resolveApplicationAuth() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
-}
-function resolveApplicationPolicyGate() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
-}
-function resolveApplicationConfig() {
-  return requireActiveApplicationContext().config;
-}
-function resolveApplicationLogger() {
-  return appLogger;
-}
-function resolveApplicationDependencies() {
-  return requireActiveApplicationContext().dependencies;
-}
-
-// ../../src/core/auth/resolveMembershipService.ts
-function resolveMembershipService() {
-  const dependencies = resolveApplicationDependencies();
-  if (dependencies.container.has("core.membership")) {
-    return dependencies.container.resolve("core.membership");
+  static dehydrateAttributes(attributes) {
+    const casts = modelStatics(this).$casts ?? {};
+    return applyCasts(attributes, casts, "dehydrate");
   }
-  return new membershipService_default;
-}
-
-// ../../src/core/auth/membershipService.ts
-class MembershipService {
-  members;
-  constructor(members = membershipRepository) {
-    this.members = members;
+  static fromRecord(record, repository, exists = true) {
+    const statics = modelStatics(this);
+    const hydrated = statics.hydrateAttributes(record);
+    return new statics(hydrated, repository, exists);
   }
-  async listOrganizationIdsForUser(userId) {
-    const memberships = await this.members.listForUser(userId);
-    return memberships.map((membership) => membership.organization_id);
+  static boot() {}
+  static addGlobalScope(_name, scope) {
+    ensureBooted(this);
+    const existing = modelGlobalScopes.get(this) ?? [];
+    modelGlobalScopes.set(this, [
+      ...existing,
+      scope
+    ]);
   }
-  async getOrgRole(userId, organizationId) {
-    const membership = await this.members.findMembership(userId, organizationId);
-    return membership?.role ?? null;
+  static repository() {
+    return resolveModelRepository(this);
   }
-  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
-    if (!user) {
-      throw new ForbiddenError("Authentication required.");
-    }
-    if (isGlobalAdmin(user)) {
-      return "owner";
+  static query() {
+    ensureBooted(this);
+    const repository = resolveModelRepository(this);
+    let query = repository.query();
+    for (const scope of getGlobalScopes(this)) {
+      query = scope(query);
     }
-    const role = await this.getOrgRole(resolveUserId(user), organizationId);
-    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
-      throw new ForbiddenError("Organization membership required.");
+    return query;
+  }
+  static async create(attributes) {
+    const statics = modelStatics(this);
+    ensureBooted(this);
+    const repository = resolveModelRepository(this);
+    const table = repository.getTable();
+    const timestamps = statics.$timestamps ?? true;
+    const assignable = filterMassAssignable(statics.$fillable, statics.$guarded, attributes);
+    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
+    const payload = statics.dehydrateAttributes(withTimestamps);
+    const record = await repository.create(payload);
+    return statics.fromRecord(record, repository, true);
+  }
+  static async find(id) {
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(this);
+    const primaryKey = repository.getTable().primaryKey;
+    const record = await Model.query.call(this).where({ [primaryKey]: id }).first();
+    return record ? statics.fromRecord(record, repository, true) : null;
+  }
+  static async findOrFail(id, errorFactory) {
+    const model = await Model.find.call(this, id);
+    if (model) {
+      return model;
     }
-    return role;
+    throw errorFactory?.(id) ?? new NotFoundError(`${this.name} ${String(id)} not found.`);
   }
-  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
-    if (!user) {
-      return [];
+  static async all(options = {}) {
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(this);
+    let query = Model.query.call(this);
+    if (options.orderBy) {
+      query = query.orderBy(options.orderBy);
     }
-    if (isGlobalAdmin(user)) {
-      return organizationIds;
+    if (options.limit !== undefined) {
+      query = query.limit(options.limit);
     }
-    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
-    return organizationIds.filter((organizationId) => allowed.has(organizationId));
+    const rows = await query.get();
+    return rows.map((row) => statics.fromRecord(row, repository, true));
   }
-  async addOwnerOnOrganizationCreate(organizationId, userId) {
-    await this.members.addMember({
-      organizationId,
-      userId,
-      role: "owner"
-    });
+  static async firstWhere(where, options = {}) {
+    const statics = modelStatics(this);
+    const repository = resolveModelRepository(this);
+    let query = Model.query.call(this).where(where);
+    if (options.orderBy) {
+      query = query.orderBy(options.orderBy);
+    }
+    const record = await query.first();
+    return record ? statics.fromRecord(record, repository, true) : null;
   }
-  listMembersForOrganization(organizationId) {
-    return this.members.listForOrganization(organizationId);
+  async save() {
+    const ModelClass = modelStatics(this.constructor);
+    const timestamps = ModelClass.$timestamps ?? true;
+    const casts = ModelClass.$casts ?? {};
+    const table = this.repository.getTable();
+    if (this.$exists) {
+      const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
+      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
+      this.attributes = ModelClass.hydrateAttributes(record2);
+      return this;
+    }
+    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, this.attributes);
+    const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
+    const payload = ModelClass.dehydrateAttributes(withTimestamps);
+    const record = await this.repository.create(payload);
+    this.attributes = ModelClass.hydrateAttributes(record);
+    this._exists = true;
+    return this;
   }
-  addMember(input) {
-    return this.members.addMember(input);
+  async update(changes) {
+    const ModelClass = modelStatics(this.constructor);
+    const assignable = filterMassAssignable(ModelClass.$fillable, ModelClass.$guarded, changes);
+    Object.assign(this.attributes, assignable);
+    return await this.save();
   }
-  removeMember(organizationId, userId) {
-    return this.members.removeMember(organizationId, userId);
+  async delete() {
+    if (resolveSoftDeleteColumn(this.repository.getTable())) {
+      return await this.repository.deleteById(this.id);
+    }
+    return await this.repository.forceDeleteById(this.id);
   }
-}
-var membershipService_default = MembershipService;
-// ../../src/core/auth/policy.ts
-class Policy {
-  constructor() {}
-  view(_user, _resource) {
-    return false;
+  async forceDelete() {
+    return await this.repository.forceDeleteById(this.id);
   }
-  create(_user) {
-    return false;
+  async restore() {
+    const ModelClass = modelStatics(this.constructor);
+    const record = await this.repository.restoreById(this.id);
+    if (!record) {
+      return null;
+    }
+    this.attributes = ModelClass.hydrateAttributes(record);
+    return this;
   }
-  update(_user, _resource) {
-    return false;
+  async loadHasMany(as, relation, childRepository, options = {}) {
+    const grouped = await childRepository.withConnection(this.repository.getConnection()).loadHasManyForParents([this.attributes], relation, options);
+    const loaded = grouped.get(this.attributes[relation.localKey]) ?? [];
+    return Object.assign(this, { [as]: loaded });
   }
-  delete(_user, _resource) {
-    return false;
+  async loadHasOne(as, relation, childRepository, options = {}) {
+    const loaded = await this.loadHasMany(as, relation, childRepository, { ...options, limit: 1 });
+    const value = loaded[as]?.[0];
+    return Object.assign(this, { [as]: value });
   }
-}
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
-
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
+  async loadBelongsTo(as, relation, parentRepository, options = {}) {
+    const grouped = await this.repository.loadBelongsToForParents([this.attributes], relation, parentRepository, options);
+    const loaded = grouped.get(this.attributes[relation.foreignKey]);
+    return Object.assign(this, { [as]: loaded });
   }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
+  async loadBelongsToMany(as, relation, relatedRepository, options = {}) {
+    const connection = this.repository.getConnection();
+    const parentId = this.attributes[relation.parentKey];
+    const pivotRows = await connection.unsafe(`SELECT * FROM ${relation.pivotTable} WHERE ${String(relation.foreignPivotKey)} = $1`, [parentId]);
+    if (pivotRows.length === 0) {
+      return Object.assign(this, { [as]: [] });
     }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+    const relatedIds = [
+      ...new Set(pivotRows.map((row) => row[relation.relatedPivotKey]))
+    ];
+    const relatedRows = await relatedRepository.withConnection(connection).findAll({
+      ...options,
+      where: {
+        [relation.relatedKey]: relatedIds
+      }
+    });
+    const grouped = indexBelongsToManyRelation([this.attributes], pivotRows, relatedRows, relation);
+    const loaded = grouped.get(parentId) ?? [];
+    return Object.assign(this, { [as]: loaded });
   }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
+  mergeAttributes(patch) {
+    Object.assign(this.attributes, patch);
+    return this;
   }
 }
-// ../../src/core/database/bindConnection.ts
-function bindDatabaseConnection2(connection) {
-  bindDatabaseConnection(connection);
+function registerModelRepository(model, repository) {
+  modelRepositories.set(model, repository);
+  ensureBooted(model);
+  return model;
 }
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-
-// ../../src/core/security/timingSafeCompare.ts
-import { timingSafeEqual } from "crypto";
-function timingSafeCompareString(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
+// ../../src/core/database/schema/columnDefinition.ts
+class ColumnDefinition {
+  name;
+  kind;
+  length;
+  isNullable = false;
+  isPrimary = false;
+  isUnique = false;
+  autoIncrement = false;
+  defaultValue;
+  checkExpression;
+  foreignKey;
+  constructor(name, kind) {
+    this.name = name;
+    this.kind = kind;
   }
-  return timingSafeEqual(leftBuffer, rightBuffer);
-}
-
-// ../../src/core/security/scimTenantTokens.ts
-function parseScimTenantTokens(raw) {
-  const tokens = new Map;
-  if (!raw?.trim()) {
-    return tokens;
+  nullable() {
+    this.isNullable = true;
+    return this;
   }
-  for (const entry of raw.split(",")) {
-    const [tenantPart, tokenPart] = entry.split(":");
-    if (!tenantPart || !tokenPart) {
-      continue;
+  notNullable() {
+    this.isNullable = false;
+    return this;
+  }
+  default(value) {
+    if (typeof value === "boolean") {
+      this.defaultValue = value ? "TRUE" : "FALSE";
+      return this;
     }
-    const tenantId = Number.parseInt(tenantPart.trim(), 10);
-    const token = tokenPart.trim();
-    if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
-      tokens.set(tenantId, token);
+    if (typeof value === "number") {
+      this.defaultValue = String(value);
+      return this;
     }
+    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
+    return this;
   }
-  return tokens;
-}
-function resolveScimTenantFromToken(token) {
-  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
-  for (const [tenantId, expectedToken] of tenantTokens) {
-    if (timingSafeCompareString(token, expectedToken)) {
-      return tenantId;
-    }
+  defaultRaw(expression) {
+    this.defaultValue = expression;
+    return this;
   }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
-  if (timingSafeCompareString(token, fallbackToken)) {
-    return 1;
+  unique() {
+    this.isUnique = true;
+    return this;
   }
-  return null;
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  const rows = await repositoryConnection`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
-    return await runWithTenant(tenant, callback);
+  primary() {
+    this.isPrimary = true;
+    return this;
+  }
+  check(expression) {
+    this.checkExpression = expression;
+    return this;
   }
-  return await getDefaultDatabasePool().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
-  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
 
-// ../../src/core/auth/scimAuthMiddleware.ts
-function createScimAuthMiddleware() {
-  return async (request, next) => {
-    const authorization = request.headers.get("authorization");
-    if (!authorization?.startsWith("Bearer ")) {
-      return jsonScimError("SCIM bearer token required.", 401);
-    }
-    const token = authorization.slice("Bearer ".length).trim();
-    const tenantId = resolveScimTenantFromToken(token);
-    if (tenantId === null) {
-      return jsonScimError("Invalid SCIM bearer token.", 401);
+class ForeignIdColumnDefinition extends ColumnDefinition {
+  constructor(name) {
+    super(name, "foreignId");
+    this.notNullable();
+  }
+  references(table, column = "id") {
+    this.foreignKey = {
+      referencesTable: table,
+      referencesColumn: column
+    };
+    return this;
+  }
+  constrained(table) {
+    const referencesTable = table ?? inferReferencedTable(this.name);
+    return this.references(referencesTable);
+  }
+  cascadeOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
     }
-    const tenant = await resolveTenant(tenantId);
-    if (!tenant) {
-      return jsonScimError("SCIM tenant not found.", 401);
+    this.foreignKey.onDelete = "cascade";
+    return this;
+  }
+  nullOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
     }
-    return await runWithTenantDatabase(tenant, async () => {
-      bindDatabaseConnection2(getActiveDatabaseConnection(getDefaultDatabasePool()));
-      try {
-        return await next();
-      } finally {
-        resetBoundDatabaseConnection();
-      }
-    });
-  };
+    this.foreignKey.onDelete = "set null";
+    return this;
+  }
 }
-function jsonScimError(detail, status) {
-  return Response.json({
-    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-    detail,
-    status: String(status)
-  }, {
-    status,
-    headers: { "content-type": "application/scim+json" }
-  });
+function inferReferencedTable(columnName) {
+  if (!columnName.endsWith("_id")) {
+    throw new Error(`Cannot infer referenced table from column ${columnName}`);
+  }
+  return columnName.slice(0, -3);
 }
-// ../../src/core/cache/redisCacheStore.ts
-var {RedisClient } = globalThis.Bun;
-var KEY_PREFIX = "workhub:cache:";
-var TAG_PREFIX = "workhub:cache:tag:";
 
-class RedisCacheStore {
-  ttlMs;
-  maxEntries;
-  client;
-  inflight = new Map;
-  keyTags = new Map;
-  constructor(redisUrl, ttlMs, maxEntries) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    this.client = new RedisClient(redisUrl);
+// ../../src/core/database/schema/blueprint.ts
+class Blueprint {
+  table;
+  action;
+  columns = [];
+  indexes = [];
+  droppedColumns = [];
+  droppedIndexes = [];
+  constructor(table, action) {
+    this.table = table;
+    this.action = action;
   }
-  async get(key) {
-    const raw = await this.client.get(this.storageKey(key));
-    if (raw === null) {
-      return;
-    }
-    return JSON.parse(raw);
+  id(name = "id") {
+    const column = new ColumnDefinition(name, "id");
+    column.primary();
+    column.autoIncrement = true;
+    this.columns.push(column);
+    return column;
   }
-  async set(key, value, ttlMs) {
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    const payload = JSON.stringify(value);
-    if (resolvedTtlMs > 0) {
-      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
-    } else {
-      await this.client.set(this.storageKey(key), payload);
-    }
-    await this.enforceMaxEntries();
+  string(name, length) {
+    const column = new ColumnDefinition(name, "string");
+    column.length = length;
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async getOrSet(key, loader, ttlMs) {
-    const cached = await this.get(key);
-    if (cached !== undefined) {
-      return cached;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then(async (value) => {
-      await this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
+  text(name) {
+    const column = new ColumnDefinition(name, "text");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      await this.client.sadd(this.tagKey(tag), key);
-    }
+  boolean(name) {
+    const column = new ColumnDefinition(name, "boolean");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const members = await this.client.smembers(this.tagKey(tag));
-      for (const member of members) {
-        keysToRemove.add(member);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (await this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      await this.client.del(this.tagKey(tag));
-    }
-    return removed;
+  integer(name) {
+    const column = new ColumnDefinition(name, "integer");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async invalidate(key) {
-    const deleted = await this.client.del(this.storageKey(key));
-    await this.detachKeyFromTags(key);
-    return deleted > 0;
+  bigInteger(name) {
+    const column = new ColumnDefinition(name, "bigInteger");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    let removed = 0;
-    for (const storageKey of keys) {
-      const key = storageKey.slice(KEY_PREFIX.length);
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (await this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
+  timestamp(name) {
+    const column = new ColumnDefinition(name, "timestamp");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async clear() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length > 0) {
-      await this.client.del(...keys);
-    }
-    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
-    if (tagKeys.length > 0) {
-      await this.client.del(...tagKeys);
-    }
-    this.inflight.clear();
-    this.keyTags.clear();
+  json(name) {
+    const column = new ColumnDefinition(name, "json");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  async size() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    return keys.length;
+  jsonb(name) {
+    const column = new ColumnDefinition(name, "jsonb");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
   }
-  storageKey(key) {
-    return `${KEY_PREFIX}${key}`;
+  foreignId(name) {
+    const column = new ForeignIdColumnDefinition(name);
+    this.columns.push(column);
+    return column;
   }
-  tagKey(tag) {
-    return `${TAG_PREFIX}${tag}`;
+  timestamps() {
+    this.timestamp("created_at").defaultRaw("NOW()");
+    this.timestamp("updated_at").defaultRaw("NOW()");
   }
-  async detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      await this.client.srem(this.tagKey(tag), key);
-    }
-    this.keyTags.delete(key);
+  softDeletes() {
+    this.timestamp("deleted_at").nullable();
   }
-  async enforceMaxEntries() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length <= this.maxEntries) {
-      return;
-    }
-    const overflow = keys.length - this.maxEntries;
-    const keysToRemove = keys.slice(0, overflow);
-    if (keysToRemove.length > 0) {
-      await this.client.del(...keysToRemove);
-    }
+  dropColumn(name) {
+    this.droppedColumns.push(name);
   }
-}
-var redisCacheStore_default = RedisCacheStore;
-
-// ../../src/core/cache/simpleCache.ts
-class SimpleCache {
-  ttlMs;
-  maxEntries;
-  cache = new Map;
-  inflight = new Map;
-  tagIndex = new Map;
-  keyTags = new Map;
-  constructor(ttlMs = 3600000, maxEntries = 100) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
-      throw new RangeError("ttlMs must be a non-negative number.");
-    }
-    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
-      throw new RangeError("maxEntries must be a positive integer.");
-    }
+  dropSoftDeletes() {
+    this.dropColumn("deleted_at");
+    this.dropIndex(`idx_${this.table}_deleted_at`);
   }
-  get(key) {
-    return this.getFreshEntry(key)?.value;
+  dropIndex(name) {
+    this.droppedIndexes.push(name);
   }
-  set(key, value, ttlMs) {
-    const now = Date.now();
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    this.cache.set(key, {
-      value,
-      expiresAt: now + resolvedTtlMs,
-      lastAccessedAt: now
+  unique(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "unique"
     });
-    this.evictOverflow();
   }
-  async getOrSet(key, loader, ttlMs) {
-    this.pruneExpired();
-    const cachedEntry = this.getFreshEntry(key);
-    if (cachedEntry) {
-      return cachedEntry.value;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then((value) => {
-      this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
+  index(columns, options = {}) {
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "index",
+      order: options.order
     });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
-  }
-  attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      let keysForTag = this.tagIndex.get(tag);
-      if (!keysForTag) {
-        keysForTag = new Set;
-        this.tagIndex.set(tag, keysForTag);
-      }
-      keysForTag.add(key);
-    }
   }
-  flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      for (const key of keys) {
-        keysToRemove.add(key);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      this.tagIndex.delete(tag);
-    }
-    return removed;
+  partialIndex(columns, where, nameOrOptions) {
+    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: options.unique ? "uniquePartial" : "partial",
+      where
+    });
   }
-  invalidate(key) {
-    const removed = this.cache.delete(key);
-    if (removed) {
-      this.detachKeyFromTags(key);
-    }
-    return removed;
+  fullText(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "fullText"
+    });
   }
-  invalidateByPrefix(prefix) {
-    let removed = 0;
-    for (const key of [...this.cache.keys()]) {
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
+  ginIndex(column, name) {
+    this.indexes.push({
+      name,
+      columns: [column],
+      kind: "gin"
+    });
   }
-  clear() {
-    this.cache.clear();
-    this.inflight.clear();
-    this.tagIndex.clear();
-    this.keyTags.clear();
+}
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
   }
-  size() {
-    this.pruneExpired();
-    return this.cache.size;
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
   }
-  detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      keys.delete(key);
-      if (keys.size === 0) {
-        this.tagIndex.delete(tag);
-      }
-    }
-    this.keyTags.delete(key);
+  if (normalized === "sqlite") {
+    return "sqlite";
   }
-  getFreshEntry(key) {
-    const entry = this.cache.get(key);
-    if (!entry) {
-      return;
-    }
-    if (entry.expiresAt <= Date.now()) {
-      this.invalidate(key);
-      return;
-    }
-    entry.lastAccessedAt = Date.now();
-    return entry;
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
   }
-  pruneExpired() {
-    const now = Date.now();
-    for (const [key, entry] of this.cache.entries()) {
-      if (entry.expiresAt <= now) {
-        this.invalidate(key);
-      }
-    }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
   }
-  evictOverflow() {
-    while (this.cache.size > this.maxEntries) {
-      let oldestKey;
-      let oldestAccessTime = Number.POSITIVE_INFINITY;
-      for (const [key, entry] of this.cache.entries()) {
-        if (entry.lastAccessedAt < oldestAccessTime) {
-          oldestAccessTime = entry.lastAccessedAt;
-          oldestKey = key;
-        }
-      }
-      if (!oldestKey) {
-        return;
-      }
-      this.invalidate(oldestKey);
-    }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
   }
+  return null;
 }
-var simpleCache_default = SimpleCache;
-
-// ../../src/core/cache/simpleCacheStore.ts
-class SimpleCacheStore {
-  cache;
-  constructor(cache) {
-    this.cache = cache;
-  }
-  get(key) {
-    return Promise.resolve(this.cache.get(key));
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
   }
-  set(key, value, ttlMs) {
-    this.cache.set(key, value, ttlMs);
-    return Promise.resolve();
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
   }
-  getOrSet(key, loader, ttlMs) {
-    return this.cache.getOrSet(key, loader, ttlMs);
+  return "pgsql";
+}
+// ../../src/core/database/schema/errors.ts
+class UnsupportedSchemaFeatureError extends Error {
+  constructor(feature, driver) {
+    super(`${feature} is not supported for the ${driver} driver`);
+    this.name = "UnsupportedSchemaFeatureError";
   }
-  attachTags(key, tags) {
-    this.cache.attachTags(key, tags);
-    return Promise.resolve();
+}
+// ../../src/core/database/schema/grammars/grammar.ts
+function compileColumnType(driver, column) {
+  switch (column.kind) {
+    case "id":
+      return compileIdType(driver);
+    case "string":
+      return compileStringType(driver, column.length);
+    case "text":
+      return compileTextType(driver);
+    case "boolean":
+      return compileBooleanType(driver);
+    case "integer":
+    case "foreignId":
+      return compileIntegerType(driver);
+    case "bigInteger":
+      return compileBigIntegerType(driver);
+    case "timestamp":
+      return compileTimestampType(driver);
+    case "json":
+      return compileJsonType(driver);
+    case "jsonb":
+      return compileJsonbType(driver);
+    default:
+      throw new Error(`Unsupported column kind: ${column.kind}`);
   }
-  flushTags(tags) {
-    return Promise.resolve(this.cache.flushTags(tags));
+}
+function compileIdType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "SERIAL";
+    case "mysql":
+      return "BIGINT UNSIGNED";
+    case "sqlite":
+      return "INTEGER";
   }
-  invalidate(key) {
-    return Promise.resolve(this.cache.invalidate(key));
+}
+function compileStringType(driver, length) {
+  switch (driver) {
+    case "pgsql":
+      return "TEXT";
+    case "mysql":
+      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
+    case "sqlite":
+      return "TEXT";
   }
-  invalidateByPrefix(prefix) {
-    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
+}
+function compileTextType(driver) {
+  switch (driver) {
+    case "pgsql":
+    case "sqlite":
+      return "TEXT";
+    case "mysql":
+      return "TEXT";
   }
-  clear() {
-    this.cache.clear();
-    return Promise.resolve();
+}
+function compileBooleanType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BOOLEAN";
+    case "mysql":
+      return "BOOLEAN";
+    case "sqlite":
+      return "INTEGER";
   }
-  size() {
-    return Promise.resolve(this.cache.size());
+}
+function compileIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "INTEGER";
+    case "mysql":
+      return "INT";
+    case "sqlite":
+      return "INTEGER";
   }
 }
-var simpleCacheStore_default = SimpleCacheStore;
-
-// ../../src/core/cache/createCacheStore.ts
-function createCacheStore(options) {
-  if (options.driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
-    }
-    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
+function compileBigIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BIGINT";
+    case "mysql":
+      return "BIGINT";
+    case "sqlite":
+      return "INTEGER";
   }
-  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
 }
-// ../../src/core/cache/taggedCache.ts
-class TaggedCache {
-  store;
-  tags;
-  constructor(store, tags) {
-    this.store = store;
-    this.tags = tags;
+function compileTimestampType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "TIMESTAMPTZ";
+    case "mysql":
+      return "TIMESTAMP";
+    case "sqlite":
+      return "TEXT";
   }
-  async remember(key, callback, ttlMs) {
-    const value = await this.store.getOrSet(key, callback, ttlMs);
-    await this.store.attachTags(key, this.tags);
-    return value;
+}
+function compileJsonType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
   }
-  async flush() {
-    return this.store.flushTags(this.tags);
+}
+function compileJsonbType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
   }
 }
-var taggedCache_default = TaggedCache;
 
-// ../../src/core/cache/repository.ts
-class CacheRepository {
-  store;
-  constructor(store) {
-    this.store = store;
-  }
-  async get(key) {
-    return this.store.get(key);
-  }
-  async remember(key, callback, ttlMs) {
-    return this.store.getOrSet(key, callback, ttlMs);
+// ../../src/core/database/schema/grammars/compileStatements.ts
+function compileCreateTable(driver, blueprint) {
+  const table = quoteIdentifier(blueprint.table);
+  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length > 1) {
+      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+      parts.push(`UNIQUE (${columns})`);
+    }
   }
-  async forget(key) {
-    return this.store.invalidate(key);
+  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
+  ${parts.join(`,
+  `)}
+)`];
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length === 1) {
+      continue;
+    }
+    if (index.kind === "index") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
   }
-  async flush() {
-    await this.store.clear();
+  return statements;
+}
+function compileAlterTable(driver, blueprint) {
+  const statements = [];
+  const table = quoteIdentifier(blueprint.table);
+  for (const column of blueprint.columns) {
+    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
+    statements.push(`ALTER TABLE ${table}
+${addPrefix} ${compileColumn(driver, column, "alter")}`);
   }
-  tags(...names) {
-    return new taggedCache_default(this.store, names);
+  for (const columnName of blueprint.droppedColumns) {
+    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
+    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
   }
-  async getOrSet(key, loader, ttlMs) {
-    return this.remember(key, loader, ttlMs);
+  for (const indexName of blueprint.droppedIndexes) {
+    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
   }
-  async invalidate(key) {
-    return this.forget(key);
+  for (const index of blueprint.indexes) {
+    if (index.kind === "index" || index.kind === "unique") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
   }
-  async invalidateByPrefix(prefix) {
-    return this.store.invalidateByPrefix(prefix);
+  return statements;
+}
+function compileDropTable(driver, tableName) {
+  const cascade = driver === "pgsql" ? " CASCADE" : "";
+  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
+}
+function compileColumn(driver, column, mode) {
+  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
+  if (column.autoIncrement && driver === "mysql") {
+    parts[1] = `${parts[1]} AUTO_INCREMENT`;
   }
-  async clear() {
-    await this.flush();
+  if (column.isPrimary && mode === "create") {
+    if (driver === "sqlite") {
+      parts.push("PRIMARY KEY AUTOINCREMENT");
+    } else {
+      parts.push("PRIMARY KEY");
+    }
+  } else if (!column.isNullable) {
+    parts.push("NOT NULL");
+  } else if (column.isNullable) {
+    parts.push("NULL");
   }
-  async size() {
-    return this.store.size();
+  if (column.defaultValue !== undefined) {
+    parts.push(`DEFAULT ${column.defaultValue}`);
   }
-}
-var repository_default2 = CacheRepository;
-// ../../src/core/cache/tags.ts
-var CACHE_TAGS = {
-  organizations: "organizations",
-  projects: "projects",
-  tasks: "tasks",
-  comments: "comments",
-  attachments: "attachments",
-  reports: "reports"
-};
-// ../../src/core/contracts/container.ts
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
+  if (column.isUnique) {
+    parts.push("UNIQUE");
   }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
+  if (column.checkExpression) {
+    parts.push(`CHECK (${column.checkExpression})`);
   }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
+  if (column.foreignKey) {
+    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
+    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
+    let clause = `REFERENCES ${reference}`;
+    if (onDelete === "cascade") {
+      clause += " ON DELETE CASCADE";
+    } else if (onDelete === "set null") {
+      clause += " ON DELETE SET NULL";
+    }
+    parts.push(clause);
   }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
+  return parts.join(" ");
+}
+function compileIndex(_driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
+  const columns = index.columns.map((column) => {
+    const quoted = quoteIdentifier(column);
+    if (index.order === "desc") {
+      return `${quoted} DESC`;
+    }
+    return quoted;
+  }).join(", ");
+  const unique = index.kind === "unique" ? "UNIQUE " : "";
+  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
+}
+function compileSpecialIndex(driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
+  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+  switch (index.kind) {
+    case "partial":
+    case "uniquePartial": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
+      }
+      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
+      return [
+        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
+      ];
     }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
+    case "gin": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
+      }
+      return [
+        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
+      ];
     }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
+    case "fullText": {
+      if (driver === "mysql") {
+        return [
+          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
+        ];
+      }
+      if (driver === "pgsql") {
+        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
+      }
+      throw new UnsupportedSchemaFeatureError("fullText()", driver);
     }
-    throw new Error(`Service "${key}" is not registered.`);
-  }
-  resolve(key) {
-    return this.get(key);
+    default:
+      return [];
   }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+}
+function defaultIndexName(tableName, columns, kind) {
+  return `idx_${tableName}_${columns.join("_")}_${kind}`;
+}
+function compileBlueprint(driver, blueprint) {
+  switch (blueprint.action) {
+    case "create":
+      return compileCreateTable(driver, blueprint);
+    case "alter":
+      return compileAlterTable(driver, blueprint);
+    case "drop":
+      return compileDropTable(driver, blueprint.table);
+    default:
+      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
   }
 }
+// ../../src/core/database/schema/grammars/createGrammar.ts
+function createGrammar(driver) {
+  return {
+    driver,
+    compile(blueprint) {
+      return compileBlueprint(driver, blueprint);
+    }
+  };
+}
 
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
+// ../../src/core/database/schema/grammars/mysqlGrammar.ts
+var MySqlGrammar = createGrammar("mysql");
+
+// ../../src/core/database/schema/grammars/postgresGrammar.ts
+var PostgresGrammar = createGrammar("pgsql");
+
+// ../../src/core/database/schema/grammars/sqliteGrammar.ts
+var SqliteGrammar = createGrammar("sqlite");
+
+// ../../src/core/database/schema/grammars/index.ts
+function grammarForDriver(driver) {
+  switch (driver) {
+    case "pgsql":
+      return PostgresGrammar;
+    case "mysql":
+      return MySqlGrammar;
+    case "sqlite":
+      return SqliteGrammar;
+    default:
+      throw new Error(`Unsupported database driver: ${driver}`);
   }
-  get(key) {
-    return this.values.get(key);
+}
+// ../../src/core/database/schema/schema.ts
+class SchemaBuilder {
+  #driver;
+  #statements = [];
+  constructor(driver) {
+    this.#driver = driver;
   }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
-    }
-    return this.values.get(key);
+  create(table, callback) {
+    const blueprint = new Blueprint(table, "create");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-  has(key) {
-    return this.values.has(key);
+  table(table, callback) {
+    const blueprint = new Blueprint(table, "alter");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-}
-// ../../src/core/database/migrations/advisoryLock.ts
-var MIGRATION_LOCK_KEY = 42424242;
-async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
-  await db2.unsafe("SELECT pg_advisory_lock($1)", [lockKey]);
-  try {
-    return await callback();
-  } finally {
-    await db2.unsafe("SELECT pg_advisory_unlock($1)", [lockKey]);
+  drop(table) {
+    const blueprint = new Blueprint(table, "drop");
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-}
-// ../../src/core/database/migrations/runner.ts
-import { readdir } from "fs/promises";
-import { join } from "path";
-import { pathToFileURL } from "url";
-var MIGRATIONS_TABLE = "framework_migrations";
-async function ensureMigrationsTable(db2) {
-  await db2.unsafe(`
-    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
-      name TEXT PRIMARY KEY,
-      batch INTEGER NOT NULL,
-      run_on TIMESTAMPTZ NOT NULL DEFAULT NOW()
-    )
-  `);
-}
-async function getAppliedMigrations(db2) {
-  await ensureMigrationsTable(db2);
-  return await db2.unsafe(`
-    SELECT name, batch
-    FROM ${MIGRATIONS_TABLE}
-    ORDER BY batch ASC, name ASC
-  `);
-}
-async function loadMigrationsFromDirectory(directory) {
-  const entries = await readdir(directory);
-  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
-  const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
-    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
-    const module = await import(moduleUrl);
-    return module.default;
-  }));
-  return loadedMigrations.filter((migration) => migration?.name !== undefined);
-}
-async function getMigrationStatus(db2, migrations) {
-  const applied = await getAppliedMigrations(db2);
-  const appliedByName = new Map(applied.map(({ name, batch }) => [name, Number(batch)]));
-  return migrations.map(({ name }) => ({
-    name,
-    status: appliedByName.has(name) ? "up" : "pending",
-    batch: appliedByName.get(name) ?? null
-  }));
-}
-async function runPendingMigrations(db2, migrations, options = {}) {
-  const applied = await getAppliedMigrations(db2);
-  const appliedNames = new Set(applied.map(({ name }) => name));
-  const nextBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0) + 1;
-  const pendingMigrations = migrations.filter(({ name }) => !appliedNames.has(name));
-  for (const migration of pendingMigrations) {
-    options.onMigration?.(migration.name);
-    await migration.up(db2);
-    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
-    if (inserted.length === 0) {
-      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
-    }
+  toSql() {
+    return [...this.#statements];
   }
-  return pendingMigrations.length;
-}
-async function migrateDatabase(db2, migrations, options = {}) {
-  const { advisoryLock = false, onMigration } = options;
-  if (advisoryLock) {
-    return withMigrationLock(db2, () => runPendingMigrations(db2, migrations, { onMigration }));
+  async execute(db2) {
+    for (const statement of this.#statements) {
+      await db2.unsafe(statement);
+    }
   }
-  return runPendingMigrations(db2, migrations, { onMigration });
 }
-async function rollbackDatabase(db2, migrations, options = {}) {
-  const applied = await getAppliedMigrations(db2);
-  if (applied.length === 0) {
-    return 0;
+
+class Schema {
+  static builder(driver) {
+    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
   }
-  const lastBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0);
-  const migrationsToRollback = new Set(applied.filter(({ batch }) => Number(batch) === lastBatch).map(({ name }) => name));
-  let rolledBack = 0;
-  for (const migration of [...migrations].reverse()) {
-    if (!migrationsToRollback.has(migration.name)) {
-      continue;
-    }
-    options.onMigration?.(migration.name);
-    await migration.down(db2);
-    await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE} WHERE name = $1`, [migration.name]);
-    rolledBack += 1;
+  static async run(db2, driver, callback) {
+    const schema = Schema.builder(driver);
+    await callback(schema);
+    await schema.execute(db2);
   }
-  return rolledBack;
 }
-async function freshDatabase(db2, migrations, options = {}) {
-  const runFresh = async () => {
-    const applied = await getAppliedMigrations(db2);
-    const appliedNames = new Set(applied.map(({ name }) => name));
-    const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
-    for (const migration of [...appliedMigrations].reverse()) {
-      options.onMigration?.(migration.name);
-      await migration.down(db2);
-    }
-    if (appliedMigrations.length > 0) {
-      await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
+function createSchemaBuilder(db2, driver) {
+  const builder = Schema.builder(driver);
+  return Object.assign(builder, {
+    async commit() {
+      await builder.execute(db2);
     }
-    await runPendingMigrations(db2, migrations, options);
-  };
-  if (options.advisoryLock) {
-    await withMigrationLock(db2, runFresh);
-    return;
-  }
-  await runFresh();
+  });
 }
 // ../../src/core/database/seeders/runner.ts
 import { readdir as readdir2 } from "fs/promises";
@@ -4130,6 +4119,19 @@ async function runSeedersFromDirectory(directory, db2, options) {
   }
   return seeders.length;
 }
+// ../../src/core/database/transaction.ts
+function supportsTransactions(connection) {
+  return typeof connection.begin === "function";
+}
+async function runInTransaction(operation) {
+  const pool = resolveRepositoryConnection();
+  if (!supportsTransactions(pool)) {
+    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+  }
+  return await pool.begin(async (transaction) => {
+    return await operation(createDatabaseConnection2(transaction));
+  });
+}
 // ../../src/core/mail/mailer.ts
 function resolveSmtpConfig() {
   const host = process.env.MAIL_HOST?.trim();
@@ -6060,7 +6062,7 @@ var failedJobTable = defineTable({
 });
 
 // ../../src/core/queue/failedJobRepository.ts
-class FailedJobRepository extends baseRepository_default {
+class FailedJobRepository extends BaseRepository {
   constructor() {
     super(failedJobTable);
   }
@@ -6853,7 +6855,7 @@ export {
   createFlashMiddleware,
   createFailedJobService,
   createDatabaseQueryProxy,
-  createDatabaseConnection,
+  createDatabaseConnection2 as createDatabaseConnection,
   createCsrfTokenCookie,
   createCsrfProtection,
   createCsrfMiddleware,