@getstrata/core 0.5.55 → 0.5.56

package/dist/index.js

@@ -196,13 +196,6 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
 
 // ../../src/core/contracts/serviceTokens.ts
 var CORE_QUEUE_TOKEN = "core.queue";
@@ -1608,65 +1601,6 @@ var apiTokenTable = defineTable({
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
-// ../../src/core/auth/password.ts
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
-  }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
-  }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
-}
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
-  }
-  if (featureFlag === "true") {
-    return true;
-  }
-  return (process.env.APP_ENV ?? "local") === "production";
-}
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
-  }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-
-// ../../src/core/crypto/mfaSecret.ts
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
-  }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
-  }
-  return decryptField(stored, key);
-}
-
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
 function runWithRequestMeta(meta, callback) {
@@ -1694,66 +1628,6 @@ function logSecurityEvent(event, details = {}) {
   }));
 }
 
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
-  }
-  return parsed;
-}
-
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
-    }
-    bits += value.toString(2).padStart(5, "0");
-  }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
-  }
-  return Buffer.from(bytes);
-}
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
-}
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
-  }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
-    }
-  }
-  return false;
-}
-
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 function runWithTenant(tenant, callback) {
@@ -1776,99 +1650,6 @@ function rateLimitMultiplierForPlan(plan) {
   }
 }
 
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationTable.ts
 var notificationTable = defineTable({
   name: "notification",
@@ -4840,14 +4621,14 @@ function createCsrfProtection(secret, options = {}) {
   };
 }
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -5217,8 +4998,183 @@ function isViewsEnabled() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join4 } from "path";
+import { join as join4, relative } from "path";
 import { Eta } from "eta";
+
+// ../../src/core/view/assertEtaHtmlSource.ts
+var HTML_TAGS = new Set([
+  "a",
+  "abbr",
+  "address",
+  "article",
+  "aside",
+  "audio",
+  "b",
+  "blockquote",
+  "body",
+  "button",
+  "canvas",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "datalist",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "dialog",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "fieldset",
+  "figcaption",
+  "figure",
+  "footer",
+  "form",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "header",
+  "hgroup",
+  "hr",
+  "html",
+  "i",
+  "iframe",
+  "img",
+  "input",
+  "ins",
+  "kbd",
+  "label",
+  "legend",
+  "li",
+  "main",
+  "map",
+  "mark",
+  "menu",
+  "meter",
+  "nav",
+  "object",
+  "ol",
+  "optgroup",
+  "option",
+  "output",
+  "p",
+  "picture",
+  "pre",
+  "progress",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "script",
+  "search",
+  "section",
+  "select",
+  "slot",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "style",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "template",
+  "textarea",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "title",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "wbr"
+]);
+var TAG_PATTERN = "([a-z][a-z0-9]*)";
+var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
+var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
+var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
+var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
+function htmlTagName(match) {
+  const tag = match?.[1];
+  return tag && HTML_TAGS.has(tag) ? tag : undefined;
+}
+function describePugLikeLine(line) {
+  if (/^\|(?:\s|$)/.test(line)) {
+    return "piped text";
+  }
+  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
+    return "class/id shorthand";
+  }
+  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
+    return "attribute shorthand";
+  }
+  if (htmlTagName(line.match(TAG_SHORTHAND))) {
+    return "tag shorthand";
+  }
+  return;
+}
+function updateSkipBlock(lower, skipBlock) {
+  if (skipBlock) {
+    if (skipBlock === "comment" && lower.includes("-->")) {
+      return null;
+    }
+    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
+      return null;
+    }
+    return skipBlock;
+  }
+  if (lower.startsWith("<!--") && !lower.includes("-->")) {
+    return "comment";
+  }
+  if (lower.startsWith("<script") && !lower.includes("</script")) {
+    return "script";
+  }
+  if (lower.startsWith("<style") && !lower.includes("</style")) {
+    return "style";
+  }
+  return null;
+}
+function assertEtaHtmlSource(templateName, source) {
+  let skipBlock = null;
+  for (const rawLine of source.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const lower = trimmed.toLowerCase();
+    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
+    if (skipBlock || nextSkipBlock) {
+      skipBlock = nextSkipBlock;
+      continue;
+    }
+    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
+      continue;
+    }
+    const kind = describePugLikeLine(trimmed);
+    if (kind) {
+      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
+    }
+  }
+}
+
+// ../../src/core/view/etaViewEngine.ts
 var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
@@ -5231,6 +5187,12 @@ class EtaViewEngine {
       autoTrim: false
     });
     this.resolveLayoutData = resolveLayoutData;
+    const readFile2 = this.eta.readFile?.bind(this.eta);
+    this.eta.readFile = (path) => {
+      const source = readFile2 ? readFile2(path) : "";
+      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      return source;
+    };
   }
   async render(name, data = {}, options = {}) {
     const template = name.endsWith(".eta") ? name : `${name}.eta`;
@@ -6544,9 +6506,9 @@ function currentTraceId() {
   return traceContextStorage.getStore()?.traceId ?? null;
 }
 // ../../src/core/tracing/otel.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 function randomHex(bytes) {
-  return randomBytes2(bytes).toString("hex");
+  return randomBytes(bytes).toString("hex");
 }
 function createSpan(input) {
   const spanId = randomHex(8);
@@ -6700,250 +6662,250 @@ function validateObject(payload, schema) {
   return output;
 }
 export {
-  wrapRouteHandler,
-  wrapMarkdownMailLayout,
-  withMigrationLock,
-  withMiddleware,
-  withErrorHandling,
-  verifyCsrfToken,
-  validateObject,
-  toResourceCollection,
-  toPaginatedResourceCollection,
-  stripMarkdown,
-  stringRule,
-  storageFacade as storage,
-  setActiveApplicationContext,
-  serializeDate,
-  sendMarkdownMail,
-  securedBindRouteModelByKey,
-  securedBindRouteModel,
-  scopedOrganizationIds,
-  runWithTraceContext,
-  runWithTenantDatabase,
-  runWithTenant,
-  runWithRequestMeta,
-  runWithDatabaseConnection,
-  runWithAuthUser,
-  runSeedersFromDirectory,
-  runQueueJob,
-  runInTransaction,
-  runGracefulShutdown,
-  runDueScheduledTasks,
-  rollbackDatabase,
-  resolveWebLayoutData,
-  resolveUserTenantId,
-  resolveUserId,
-  resolveService,
-  resolveRepositoryConnection,
-  resolveOrganizationScope,
-  resolveMembershipService,
-  resolveDatabaseDriver,
-  resolveCsrfTokenForRequest,
-  resolveCsrfToken,
-  resolveApplicationQueue,
-  resolveApplicationPolicyGate,
-  resolveApplicationLogger,
-  resolveApplicationEventBus,
-  resolveApplicationDependencies,
-  resolveApplicationConfig,
-  resolveApplicationCache,
-  resolveApplicationAuth,
-  resetDefaultStorage,
-  required,
-  requestIdMiddleware,
-  repositoryConnection,
-  renderMarkdownMail,
-  registerShutdownHandler,
-  registerModelRepository,
-  registerDefaultDatabasePool,
-  readSubmittedCsrfTokenFromBody,
-  readSubmittedCsrfToken,
-  readRequestCookie,
-  readBunRequestCookie,
-  rateLimitMultiplierForPlan,
-  queue,
-  prometheusRegistry,
-  policyGate,
-  parsePositiveIntParam,
-  parsePaginationQuery,
-  parseMultipartUpload,
-  paginatedResponse,
-  normalizeMetricPath,
-  noContentResponse,
-  morphTo,
-  morphOne,
-  morphMany,
-  modelEventName,
-  minLength,
-  migrateDatabase,
-  maxLength,
-  markdownToHtml,
-  mailer,
-  mail,
-  logSecurityEvent,
-  log,
-  loadSeedersFromDirectory,
-  loadMigrationsFromDirectory,
-  jsonResponse2 as jsonResponse,
-  jobRegistry,
-  isPublicReadsEnabled,
-  isInsideTenantDatabaseScope,
-  isHtmxRequest,
-  isGlobalAdmin,
-  isEtagEnabled,
-  installGracefulShutdownSignals,
-  inferReferencedTable,
-  indexMorphToRelation,
-  indexMorphOneRelation,
-  indexMorphManyRelation,
-  indexHasOneRelation,
-  indexHasManyRelation,
-  indexBelongsToRelation,
-  indexBelongsToManyRelation,
-  hydrateValue,
-  htmlResponse,
-  hasOrgMembership,
-  hasOne,
-  hasMinimumOrgRole2 as hasMinimumOrgRole,
-  hasMany,
-  guestCanViewResource,
-  grammarForDriver,
-  getMigrationStatus,
-  getDefaultDatabaseQuery,
-  getDefaultDatabasePool,
-  getActiveDatabaseConnection,
-  freshDatabase,
-  formatAdminValue,
-  filterMassAssignable,
-  events,
-  eventBus,
-  etagFromResource,
-  emptyPaginateResult,
-  emailRule,
-  dehydrateValue,
-  defineTable,
-  currentTraceId,
-  currentTenantId,
-  currentTenant,
-  currentRequestMeta,
-  currentOrganizationIds,
-  currentOrgRole,
-  currentAuthUser,
-  createdResponse,
-  createTrackedJob,
-  createTracingMiddleware,
-  createThrottleMiddleware,
-  createTenantMiddleware,
-  createStorageDriver,
-  createSecurityHeadersMiddleware,
-  createScimThrottleMiddleware,
-  createScimAuthMiddleware,
-  createSchemaBuilder,
-  createRequireWebAuthMiddleware,
-  createRequireGlobalAdminMiddleware,
-  createRequireAuthMiddleware,
-  createRequireAbilityMiddleware,
-  createRequestLoggingMiddleware,
-  createQueueWorker,
-  createQueue,
-  createProductionQueue,
-  createNotificationDispatcher,
-  createMetricsMiddleware,
-  createMemoryThrottleMiddleware,
-  createMembershipMiddleware,
-  createLoginThrottleMiddleware,
-  createFlashMiddleware,
-  createFailedJobService,
-  createDatabaseQueryProxy,
-  createDatabaseConnection2 as createDatabaseConnection,
-  createCsrfTokenCookie,
-  createCsrfProtection,
-  createCsrfMiddleware,
-  createCorsMiddleware,
-  createCacheStore,
-  createBodySizeLimitMiddleware,
-  createAuthorizeMiddleware,
-  createAuthMiddleware,
-  config,
-  conditionalJsonResponse,
-  composeMiddleware,
-  compileBlueprint,
-  collectQueueMetrics,
-  cache,
-  buildSmtpPayload,
-  buildRequestCacheKey,
-  buildMarkdownMailMessage,
-  bindRouteModel,
-  bindDatabaseConnection2 as bindDatabaseConnection,
-  belongsToMany,
-  belongsTo,
-  authContext,
-  auth,
-  auditChecksum,
-  assertResourceInCurrentTenant,
-  assertOrganizationReadable,
-  assertIfMatch,
-  applyMiddlewareToRoutes,
-  applyConditionalGet,
-  applyCasts,
-  appendProjectScope,
-  appendOrganizationScope,
-  appSchedule,
-  WhereBuilder,
-  WebFormRequest,
-  ValidationError,
-  UnsupportedSchemaFeatureError,
-  UnprocessableEntityError,
-  UnauthorizedError,
-  SyncQueue,
-  StorageManager,
-  SqliteGrammar,
-  ServiceContainer,
-  Schema,
-  Schedule,
-  ResilientQueue,
-  RepositoryQuery,
-  RedisQueue,
-  QueueWorker,
-  PrometheusRegistry,
-  PreconditionFailedError,
-  PostgresGrammar,
-  PolicyGate,
-  Policy,
-  PayloadTooLargeError,
-  NotificationDispatcher,
-  Notification,
-  NotFoundError,
-  MySqlGrammar,
-  Model,
-  membershipService_default as MembershipService,
-  Mailer,
-  LogMailDriver,
-  LocalStorageDriver,
-  Job,
-  HttpError,
-  GuestGuard,
-  FormRequest,
-  ForeignIdColumnDefinition,
-  ForbiddenError,
-  failedJobService_default as FailedJobService,
-  failedJobRepository_default as FailedJobRepository,
-  EventBus,
-  EtaViewEngine,
-  DatabaseTokenGuard,
-  DEFAULT_VIEWS_DIRECTORY,
-  DEFAULT_TENANT,
-  ConflictError,
-  ConfigStore,
-  CompositeGuard,
-  ColumnDefinition,
-  repository_default2 as CacheRepository,
-  CACHE_TAGS,
-  Blueprint,
-  baseRepository_default as BaseRepository,
-  BadRequestError,
-  AuthManager,
-  AsyncQueue,
+  AdminResourceRegistry,
   ApiTokenGuard,
-  AdminResourceRegistry
+  AsyncQueue,
+  AuthManager,
+  BadRequestError,
+  baseRepository_default as BaseRepository,
+  Blueprint,
+  CACHE_TAGS,
+  repository_default2 as CacheRepository,
+  ColumnDefinition,
+  CompositeGuard,
+  ConfigStore,
+  ConflictError,
+  DEFAULT_TENANT,
+  DEFAULT_VIEWS_DIRECTORY,
+  DatabaseTokenGuard,
+  EtaViewEngine,
+  EventBus,
+  failedJobRepository_default as FailedJobRepository,
+  failedJobService_default as FailedJobService,
+  ForbiddenError,
+  ForeignIdColumnDefinition,
+  FormRequest,
+  GuestGuard,
+  HttpError,
+  Job,
+  LocalStorageDriver,
+  LogMailDriver,
+  Mailer,
+  membershipService_default as MembershipService,
+  Model,
+  MySqlGrammar,
+  NotFoundError,
+  Notification,
+  NotificationDispatcher,
+  PayloadTooLargeError,
+  Policy,
+  PolicyGate,
+  PostgresGrammar,
+  PreconditionFailedError,
+  PrometheusRegistry,
+  QueueWorker,
+  RedisQueue,
+  RepositoryQuery,
+  ResilientQueue,
+  Schedule,
+  Schema,
+  ServiceContainer,
+  SqliteGrammar,
+  StorageManager,
+  SyncQueue,
+  UnauthorizedError,
+  UnprocessableEntityError,
+  UnsupportedSchemaFeatureError,
+  ValidationError,
+  WebFormRequest,
+  WhereBuilder,
+  appSchedule,
+  appendOrganizationScope,
+  appendProjectScope,
+  applyCasts,
+  applyConditionalGet,
+  applyMiddlewareToRoutes,
+  assertIfMatch,
+  assertOrganizationReadable,
+  assertResourceInCurrentTenant,
+  auditChecksum,
+  auth,
+  authContext,
+  belongsTo,
+  belongsToMany,
+  bindDatabaseConnection2 as bindDatabaseConnection,
+  bindRouteModel,
+  buildMarkdownMailMessage,
+  buildRequestCacheKey,
+  buildSmtpPayload,
+  cache,
+  collectQueueMetrics,
+  compileBlueprint,
+  composeMiddleware,
+  conditionalJsonResponse,
+  config,
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCacheStore,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createCsrfProtection,
+  createCsrfTokenCookie,
+  createDatabaseConnection2 as createDatabaseConnection,
+  createDatabaseQueryProxy,
+  createFailedJobService,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createNotificationDispatcher,
+  createProductionQueue,
+  createQueue,
+  createQueueWorker,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSchemaBuilder,
+  createScimAuthMiddleware,
+  createScimThrottleMiddleware,
+  createSecurityHeadersMiddleware,
+  createStorageDriver,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  createTrackedJob,
+  createdResponse,
+  currentAuthUser,
+  currentOrgRole,
+  currentOrganizationIds,
+  currentRequestMeta,
+  currentTenant,
+  currentTenantId,
+  currentTraceId,
+  defineTable,
+  dehydrateValue,
+  emailRule,
+  emptyPaginateResult,
+  etagFromResource,
+  eventBus,
+  events,
+  filterMassAssignable,
+  formatAdminValue,
+  freshDatabase,
+  getActiveDatabaseConnection,
+  getDefaultDatabasePool,
+  getDefaultDatabaseQuery,
+  getMigrationStatus,
+  grammarForDriver,
+  guestCanViewResource,
+  hasMany,
+  hasMinimumOrgRole2 as hasMinimumOrgRole,
+  hasOne,
+  hasOrgMembership,
+  htmlResponse,
+  hydrateValue,
+  indexBelongsToManyRelation,
+  indexBelongsToRelation,
+  indexHasManyRelation,
+  indexHasOneRelation,
+  indexMorphManyRelation,
+  indexMorphOneRelation,
+  indexMorphToRelation,
+  inferReferencedTable,
+  installGracefulShutdownSignals,
+  isEtagEnabled,
+  isGlobalAdmin,
+  isHtmxRequest,
+  isInsideTenantDatabaseScope,
+  isPublicReadsEnabled,
+  jobRegistry,
+  jsonResponse2 as jsonResponse,
+  loadMigrationsFromDirectory,
+  loadSeedersFromDirectory,
+  log,
+  logSecurityEvent,
+  mail,
+  mailer,
+  markdownToHtml,
+  maxLength,
+  migrateDatabase,
+  minLength,
+  modelEventName,
+  morphMany,
+  morphOne,
+  morphTo,
+  noContentResponse,
+  normalizeMetricPath,
+  paginatedResponse,
+  parseMultipartUpload,
+  parsePaginationQuery,
+  parsePositiveIntParam,
+  policyGate,
+  prometheusRegistry,
+  queue,
+  rateLimitMultiplierForPlan,
+  readBunRequestCookie,
+  readRequestCookie,
+  readSubmittedCsrfToken,
+  readSubmittedCsrfTokenFromBody,
+  registerDefaultDatabasePool,
+  registerModelRepository,
+  registerShutdownHandler,
+  renderMarkdownMail,
+  repositoryConnection,
+  requestIdMiddleware,
+  required,
+  resetDefaultStorage,
+  resolveApplicationAuth,
+  resolveApplicationCache,
+  resolveApplicationConfig,
+  resolveApplicationDependencies,
+  resolveApplicationEventBus,
+  resolveApplicationLogger,
+  resolveApplicationPolicyGate,
+  resolveApplicationQueue,
+  resolveCsrfToken,
+  resolveCsrfTokenForRequest,
+  resolveDatabaseDriver,
+  resolveMembershipService,
+  resolveOrganizationScope,
+  resolveRepositoryConnection,
+  resolveService,
+  resolveUserId,
+  resolveUserTenantId,
+  resolveWebLayoutData,
+  rollbackDatabase,
+  runDueScheduledTasks,
+  runGracefulShutdown,
+  runInTransaction,
+  runQueueJob,
+  runSeedersFromDirectory,
+  runWithAuthUser,
+  runWithDatabaseConnection,
+  runWithRequestMeta,
+  runWithTenant,
+  runWithTenantDatabase,
+  runWithTraceContext,
+  scopedOrganizationIds,
+  securedBindRouteModel,
+  securedBindRouteModelByKey,
+  sendMarkdownMail,
+  serializeDate,
+  setActiveApplicationContext,
+  storageFacade as storage,
+  stringRule,
+  stripMarkdown,
+  toPaginatedResourceCollection,
+  toResourceCollection,
+  validateObject,
+  verifyCsrfToken,
+  withErrorHandling,
+  withMiddleware,
+  withMigrationLock,
+  wrapMarkdownMailLayout,
+  wrapRouteHandler
 };