@getstrata/core 2.1.0 → 2.2.1

package/dist/index.js

@@ -364,16 +364,6 @@ function currentTenantId() {
   }
   return tenant.id;
 }
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
 var tenantContext;
 var init_tenantContext = __esm(() => {
   init_asyncContextStore();
@@ -656,9 +646,12 @@ async function runWithDeferredModelEvents(callback) {
   const existing = deferredModelEvents.getStore();
   if (existing) {
     existing.frames.push([]);
+    existing.rollbackFrames.push([]);
     try {
       const result = await callback();
       const nested = existing.frames.pop() ?? [];
+      const rollback = existing.rollbackFrames.pop() ?? [];
+      existing.rollbackFrames.at(-1)?.push(...rollback);
       const parent = existing.frames[existing.frames.length - 1];
       if (parent) {
         parent.push(...nested);
@@ -666,14 +659,26 @@ async function runWithDeferredModelEvents(callback) {
       return result;
     } catch (error) {
       existing.frames.pop();
+      for (const rollback of (existing.rollbackFrames.pop() ?? []).reverse())
+        rollback();
       throw error;
     }
   }
-  const state = { frames: [[]] };
-  const result = await deferredModelEvents.run(state, callback);
+  const state = { frames: [[]], rollbackFrames: [[]] };
+  let result;
+  try {
+    result = await deferredModelEvents.run(state, callback);
+  } catch (error) {
+    for (const rollback of (state.rollbackFrames[0] ?? []).reverse())
+      rollback();
+    throw error;
+  }
   await dispatchQueuedModelEvents(state.frames[0] ?? []);
   return result;
 }
+function onDeferredModelRollback(callback) {
+  deferredModelEvents.getStore()?.rollbackFrames.at(-1)?.push(callback);
+}
 var deferredModelEvents;
 var init_deferredModelEvents = __esm(() => {
   init_asyncContextStore();
@@ -1052,7 +1057,88 @@ function resolveUserId(user) {
   }
   return userId;
 }
+// ../../src/core/contracts/container.ts
+function createServiceToken(key) {
+  if (!key.trim())
+    throw new Error("Service token key must not be empty.");
+  return key;
+}
+
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
+  }
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
+    }
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
+    }
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
+    }
+    throw new Error(`Service "${key}" is not registered.`);
+  }
+  resolve(key) {
+    return this.get(key);
+  }
+  make(key) {
+    return this.resolve(key);
+  }
+  instance(key, value) {
+    return this.set(key, value);
+  }
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  }
+}
+
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
+  }
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
+  }
+}
+
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_THROTTLE_QUOTA_POLICY_TOKEN = createServiceToken("core.throttleQuotaPolicy");
+var CORE_PUBLIC_TENANCY_TOKEN = createServiceToken("core.publicTenancy");
+var CORE_TENANT_RESOLVER_TOKEN = createServiceToken("core.tenantResolver");
+var CORE_HTTP_CLEANUP_TOKEN = createServiceToken("core.httpCleanup");
 var CORE_QUEUE_TOKEN = "core.queue";
 var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
@@ -2054,6 +2140,12 @@ function setActiveApplicationContext(context) {
   activeContext = context;
   globalThis[APPLICATION_CONTEXT_KEY] = context;
 }
+function clearActiveApplicationContext(context) {
+  if (readStoredApplicationContext() !== context)
+    return;
+  activeContext = undefined;
+  delete globalThis[APPLICATION_CONTEXT_KEY];
+}
 function requireActiveApplicationContext() {
   const context = readStoredApplicationContext();
   if (!context) {
@@ -3247,19 +3339,17 @@ async function resolveTenant(tenantId) {
   if (!isTenancyEnabled()) {
     return {
       id: tenantId,
-      slug: "default",
-      plan: "free",
-      region: "eu"
+      slug: "default"
     };
   }
   const rows = await repositoryConnection`
-    SELECT id, slug, plan, region
+    SELECT id, slug
     FROM tenant
     WHERE id = ${tenantId}
     LIMIT 1
   `;
   const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+  return row ? { id: row.id, slug: row.slug } : null;
 }
 
 // ../../src/core/auth/scimAuthMiddleware.ts
@@ -3319,151 +3409,397 @@ function createTokenAbilityChecker() {
 }
 // ../../src/core/cache/redisCacheStore.ts
 var {RedisClient } = globalThis.Bun;
-function cacheKeyPrefix() {
-  return namespacedRedisKey("cache:");
-}
-function cacheTagPrefix() {
-  return namespacedRedisKey("cache:tag:");
-}
+var CACHE_SCRIPT = `
+local expected = {'hash', 'zset', 'zset', 'hash', 'zset'}
+for i, key in ipairs(KEYS) do
+  local kind = redis.call('TYPE', key).ok
+  if kind ~= 'none' and kind ~= expected[i] then return redis.error_reply('Unexpected cache key type') end
+end
+-- Redis eviction can remove one container without its companions. Never read
+-- orphaned values or leases after losing the expiry/order/generation indexes.
+local entries = redis.call('HLEN', KEYS[1])
+local order = redis.call('ZCARD', KEYS[3])
+if redis.call('ZCARD', KEYS[2]) ~= order or entries ~= (order > 0 and order + 1 or 0) then
+  redis.call('DEL', KEYS[1], KEYS[2], KEYS[3])
+end
+if redis.call('HLEN', KEYS[4]) ~= redis.call('ZCARD', KEYS[5]) then
+  redis.call('DEL', KEYS[4], KEYS[5])
+end
+local r = cjson.decode(ARGV[1])
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + tonumber(time[2]) / 1000
+local function removeEntry(key)
+  local removed = redis.call('HDEL', KEYS[1], 'e:' .. key)
+  redis.call('ZREM', KEYS[2], key)
+  redis.call('ZREM', KEYS[3], key)
+  return removed
+end
+local function removeMeta(field)
+  redis.call('HDEL', KEYS[4], field)
+  redis.call('ZREM', KEYS[5], field)
+end
+for _, key in ipairs(redis.call('ZRANGEBYSCORE', KEYS[2], '-inf', now, 'LIMIT', 0, r.capacity)) do removeEntry(key) end
+for _, field in ipairs(redis.call('ZRANGEBYSCORE', KEYS[5], '-inf', now, 'LIMIT', 0, r.metadataLimit)) do removeMeta(field) end
+local function expireContainers()
+  local last = redis.call('ZREVRANGE', KEYS[2], 0, 0, 'WITHSCORES')
+  if #last == 0 then
+    redis.call('DEL', KEYS[1], KEYS[2], KEYS[3])
+  elseif last[2] == 'inf' then
+    for i = 1, 3 do redis.call('PERSIST', KEYS[i]) end
+  else
+    local ttl = math.max(1, math.ceil(tonumber(last[2]) - now))
+    for i = 1, 3 do redis.call('PEXPIRE', KEYS[i], ttl) end
+  end
+  for i = 4, 5 do redis.call('PEXPIRE', KEYS[i], r.metadataTtlMs) end
+end
+local function response(value)
+  expireContainers()
+  return cjson.encode(value)
+end
+local function addTags(existing, added)
+  local seen = {}
+  local result = {}
+  for _, tags in ipairs({existing, added}) do
+    for _, tag in ipairs(tags) do
+      if not seen[tag] then seen[tag] = true; table.insert(result, tag) end
+    end
+  end
+  if #result > 32 then error('Cache entries support at most 32 tags') end
+  return result
+end
+local function touch(key)
+  local sequence = redis.call('HINCRBY', KEYS[1], '_sequence', 1)
+  redis.call('ZADD', KEYS[3], sequence, key)
+end
+local function read(key, tags)
+  local raw = redis.call('HGET', KEYS[1], 'e:' .. key)
+  if not raw then return nil end
+  local entry = cjson.decode(raw)
+  if #tags > 0 then
+    entry.tags = addTags(entry.tags, tags)
+    redis.call('HSET', KEYS[1], 'e:' .. key, cjson.encode(entry))
+  end
+  touch(key)
+  return entry.payload
+end
+local function write(key, payload, tags)
+  local entry = {payload=payload, tags=tags}
+  redis.call('HSET', KEYS[1], 'e:' .. key, cjson.encode(entry))
+  redis.call('ZADD', KEYS[2], r.ttlMs == 0 and '+inf' or now + r.ttlMs, key)
+  touch(key)
+  local overflow = redis.call('ZCARD', KEYS[3]) - r.capacity
+  if overflow > 0 then
+    for _, victim in ipairs(redis.call('ZRANGE', KEYS[3], 0, overflow - 1)) do removeEntry(victim) end
+  end
+end
+local leaseField = 'l:' .. r.key
+local function lease()
+  local raw = redis.call('HGET', KEYS[4], leaseField)
+  if not raw then return nil end
+  local value = cjson.decode(raw)
+  if value.expires <= now or value.deadline <= now then removeMeta(leaseField); return nil end
+  return value
+end
+local function metadataSpace(count)
+  if redis.call('HLEN', KEYS[4]) + count > r.metadataLimit then
+    -- Pressure sheds generation/lease state. Every old owner is fenced; cached
+    -- entries remain valid because invalidation removes matching entries atomically.
+    redis.call('DEL', KEYS[4], KEYS[5])
+  end
+end
+local function putMeta(field, value, expires)
+  redis.call('HSET', KEYS[4], field, value)
+  redis.call('ZADD', KEYS[5], expires, field)
+end
+local function scopes()
+  local fields = {}
+  for _, tag in ipairs(r.tags) do table.insert(fields, 'g:tag:' .. tag) end
+  for _, prefix in ipairs(r.prefixes) do table.insert(fields, 'g:prefix:' .. prefix) end
+  return fields
+end
+local function matches(key, tags)
+  if r.op == 'invalidate' then return key == r.key end
+  if r.op == 'prefix' then return key == r.key or string.sub(key, 1, #r.key + 1) == r.key .. '?' end
+  if r.op == 'tags' then
+    for _, existing in ipairs(tags) do
+      for _, wanted in ipairs(r.tags) do if wanted == existing then return true end end
+    end
+  end
+  return false
+end
+if r.op == 'clear' then
+  redis.call('DEL', unpack(KEYS))
+  return cjson.encode({removed=0})
+elseif r.op == 'get' then
+  local payload = read(r.key, r.tags)
+  return response(payload and {kind='value', payload=payload} or {kind='missing'})
+elseif r.op == 'set' then
+  local old = redis.call('HGET', KEYS[1], 'e:' .. r.key)
+  local tags = old and cjson.decode(old).tags or {}
+  write(r.key, r.payload, tags)
+  removeMeta(leaseField)
+  return response({written=true})
+elseif r.op == 'attach' then
+  read(r.key, r.tags)
+  return response({written=true})
+elseif r.op == 'size' then
+  return response({size=redis.call('ZCARD', KEYS[3])})
+elseif r.op == 'tags' or r.op == 'prefix' or r.op == 'invalidate' then
+  local generationFields = {}
+  if r.op == 'tags' then
+    for _, tag in ipairs(r.tags) do table.insert(generationFields, 'g:tag:' .. tag) end
+  elseif r.op == 'prefix' then table.insert(generationFields, 'g:prefix:' .. r.key) end
+  metadataSpace(#generationFields)
+  for _, field in ipairs(generationFields) do putMeta(field, r.owner, now + r.metadataTtlMs) end
+  local removed = 0
+  for _, key in ipairs(redis.call('ZRANGE', KEYS[3], 0, -1)) do
+    local raw = redis.call('HGET', KEYS[1], 'e:' .. key)
+    if raw and matches(key, cjson.decode(raw).tags) then removed = removed + removeEntry(key) end
+  end
+  for _, field in ipairs(redis.call('HKEYS', KEYS[4])) do
+    if string.sub(field, 1, 2) == 'l:' then
+      local value = cjson.decode(redis.call('HGET', KEYS[4], field))
+      if matches(string.sub(field, 3), value.tags) then removeMeta(field) end
+    end
+  end
+  return response({removed=removed})
+elseif r.op == 'claim' then
+  local payload = read(r.key, r.tags)
+  if payload then return response({kind='value', payload=payload}) end
+  local current = lease()
+  if current then
+    local shared = addTags(current.tags, r.tags)
+    if #shared == #current.tags then return response({kind='wait'}) end
+    -- A newly requested tag must not inherit a fill started before that tag's
+    -- invalidation. Restart with the union of tags and a new owner.
+    r.tags = shared
+    removeMeta(leaseField)
+  end
+  local active = 0
+  for _, field in ipairs(redis.call('HKEYS', KEYS[4])) do if string.sub(field, 1, 2) == 'l:' then active = active + 1 end end
+  if active >= r.capacity then return response({kind='wait'}) end
+  local fields = scopes()
+  metadataSpace(#fields + 1)
+  local generations = {}
+  for _, field in ipairs(fields) do
+    local token = redis.call('HGET', KEYS[4], field) or r.owner
+    putMeta(field, token, now + r.metadataTtlMs)
+    generations[field] = token
+  end
+  local value = {owner=r.owner, tags=r.tags, generations=generations, deadline=now + r.fillTimeoutMs, expires=now + r.leaseMs}
+  putMeta(leaseField, cjson.encode(value), value.expires)
+  return response({kind='owner'})
+elseif r.op == 'renew' or r.op == 'publish' or r.op == 'release' then
+  local current = lease()
+  if not current or current.owner ~= r.owner then return response({owned=false}) end
+  if r.op == 'release' then removeMeta(leaseField); return response({owned=true}) end
+  for field, token in pairs(current.generations) do
+    if redis.call('HGET', KEYS[4], field) ~= token then removeMeta(leaseField); return response({owned=false}) end
+  end
+  if r.op == 'renew' then
+    current.expires = math.min(current.deadline, now + r.leaseMs)
+    putMeta(leaseField, cjson.encode(current), current.expires)
+  else
+    write(r.key, r.payload, current.tags)
+    removeMeta(leaseField)
+  end
+  return response({owned=true})
+end
+return redis.error_reply('Unknown cache operation')
+`;
 
 class RedisCacheStore {
   ttlMs;
   maxEntries;
   client;
-  inflight = new Map;
-  keyTags = new Map;
-  constructor(redisUrl, ttlMs, maxEntries) {
+  keys;
+  options;
+  fills = new Set;
+  closed = false;
+  constructor(redisUrl, ttlMs, maxEntries, options = {}) {
     this.ttlMs = ttlMs;
     this.maxEntries = maxEntries;
-    this.client = new RedisClient(redisUrl);
+    if (!Number.isSafeInteger(ttlMs) || ttlMs < 0)
+      throw new RangeError("ttlMs must be a non-negative safe integer.");
+    if (!Number.isInteger(maxEntries) || maxEntries < 1 || maxEntries > 1e4)
+      throw new RangeError("maxEntries must be between 1 and 10000.");
+    this.options = {
+      commandTimeoutMs: 5000,
+      leaseMs: 1e4,
+      fillTimeoutMs: 30000,
+      waitTimeoutMs: 35000,
+      pollMs: 25,
+      metadataTtlMs: 60000,
+      metadataLimit: 4096,
+      ...options
+    };
+    for (const [key, value] of Object.entries(this.options))
+      if (!Number.isSafeInteger(value) || value < 1)
+        throw new RangeError(`${key} must be a positive safe integer.`);
+    if (this.options.leaseMs < 30 || this.options.fillTimeoutMs < this.options.leaseMs || this.options.metadataTtlMs < this.options.fillTimeoutMs + this.options.leaseMs || this.options.metadataLimit < 66 || this.options.metadataLimit > 1e5)
+      throw new RangeError("Invalid Redis cache lease, deadline or metadata bounds.");
+    const namespace = namespacedRedisKey("cache:v3:");
+    const slot = new Bun.CryptoHasher("sha256").update(namespace).digest("hex");
+    this.keys = ["entries", "expiry", "order", "metadata", "metadata-expiry"].map((name) => `${namespace}{${slot}}:${name}`);
+    this.client = new RedisClient(redisUrl, {
+      connectionTimeout: this.options.commandTimeoutMs,
+      maxRetries: 1
+    });
+  }
+  close() {
+    this.closed = true;
+    for (const fill of this.fills)
+      fill.abort(new Error("Redis cache store is closed."));
+    this.client.close();
   }
   async get(key) {
-    const raw = await this.client.get(this.storageKey(key));
-    if (raw === null) {
-      return;
-    }
-    return JSON.parse(raw);
+    const result = await this.execute("get", key);
+    return result.kind === "value" ? JSON.parse(result.payload ?? "null") : undefined;
   }
   async set(key, value, ttlMs) {
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    const payload = JSON.stringify(value);
-    if (resolvedTtlMs > 0) {
-      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
-    } else {
-      await this.client.set(this.storageKey(key), payload);
-    }
-    await this.enforceMaxEntries();
+    await this.execute("set", key, { payload: this.serialize(value), ttlMs: ttlMs ?? this.ttlMs });
   }
   async getOrSet(key, loader, ttlMs) {
-    const cached = await this.get(key);
-    if (cached !== undefined) {
-      return cached;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then(async (value) => {
-      await this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
+    return this.getOrSetTagged(key, loader, [], ttlMs);
+  }
+  async getOrSetTagged(key, loader, tags, ttlMs) {
+    const owner = crypto.randomUUID();
+    const end = performance.now() + this.options.waitTimeoutMs;
+    while (!this.closed) {
+      const claim = await this.execute("claim", key, { owner, tags, ttlMs: ttlMs ?? this.ttlMs });
+      if (claim.kind === "value")
+        return JSON.parse(claim.payload ?? "null");
+      if (claim.kind === "owner")
+        return this.fill(key, owner, loader, ttlMs);
+      if (performance.now() >= end)
+        throw new Error("Redis cache fill wait deadline exceeded.");
+      await Bun.sleep(this.options.pollMs);
+    }
+    throw new Error("Redis cache store is closed.");
   }
   async attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      await this.client.sadd(this.tagKey(tag), key);
-    }
+    await this.execute("attach", key, { tags });
   }
   async flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const members = await this.client.smembers(this.tagKey(tag));
-      for (const member of members) {
-        keysToRemove.add(member);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (await this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      await this.client.del(this.tagKey(tag));
-    }
-    return removed;
+    return (await this.execute("tags", "", { tags })).removed ?? 0;
   }
   async invalidate(key) {
-    const deleted = await this.client.del(this.storageKey(key));
-    await this.detachKeyFromTags(key);
-    return deleted > 0;
+    return ((await this.execute("invalidate", key)).removed ?? 0) > 0;
   }
   async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
-    let removed = 0;
-    for (const storageKey of keys) {
-      const key = storageKey.slice(cacheKeyPrefix().length);
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (await this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
+    return (await this.execute("prefix", prefix)).removed ?? 0;
   }
   async clear() {
-    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
-    if (keys.length > 0) {
-      await this.client.del(...keys);
-    }
-    const tagKeys = await this.client.keys(`${cacheTagPrefix()}*`);
-    if (tagKeys.length > 0) {
-      await this.client.del(...tagKeys);
-    }
-    this.inflight.clear();
-    this.keyTags.clear();
+    await this.execute("clear", "");
   }
   async size() {
-    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
-    return keys.length;
-  }
-  storageKey(key) {
-    return `${cacheKeyPrefix()}${key}`;
-  }
-  tagKey(tag) {
-    return `${cacheTagPrefix()}${tag}`;
+    return (await this.execute("size", "")).size ?? 0;
   }
-  async detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
+  async fill(key, owner, loader, ttlMs) {
+    if (this.fills.size >= this.maxEntries) {
+      await this.execute("release", key, { owner });
+      throw new Error("Redis cache local fill capacity exceeded.");
     }
-    for (const tag of tags) {
-      await this.client.srem(this.tagKey(tag), key);
+    const controller = new AbortController;
+    this.fills.add(controller);
+    let done = false;
+    let renewing = false;
+    const renew = setInterval(() => {
+      if (renewing || done)
+        return;
+      renewing = true;
+      this.execute("renew", key, { owner }).then((result) => {
+        if (!result.owned)
+          clearInterval(renew);
+      }).catch((error) => {
+        if (!done)
+          controller.abort(error);
+      }).finally(() => {
+        renewing = false;
+      });
+    }, Math.max(10, Math.floor(this.options.leaseMs / 3)));
+    const timeout = setTimeout(() => controller.abort(new Error("Redis cache fill deadline exceeded.")), this.options.fillTimeoutMs);
+    let rejectAbort;
+    const aborted = new Promise((_, reject) => {
+      rejectAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener("abort", rejectAbort, { once: true });
+    });
+    try {
+      const value = await Promise.race([
+        Promise.resolve().then(() => loader(controller.signal)),
+        aborted
+      ]);
+      done = true;
+      clearInterval(renew);
+      await this.execute("publish", key, {
+        owner,
+        payload: this.serialize(value),
+        ttlMs: ttlMs ?? this.ttlMs
+      });
+      return value;
+    } finally {
+      done = true;
+      clearInterval(renew);
+      clearTimeout(timeout);
+      controller.signal.removeEventListener("abort", rejectAbort);
+      this.fills.delete(controller);
+      if (!this.closed)
+        await this.execute("release", key, { owner }).catch(() => {});
     }
-    this.keyTags.delete(key);
   }
-  async enforceMaxEntries() {
-    const keys = await this.client.keys(`${cacheKeyPrefix()}*`);
-    if (keys.length <= this.maxEntries) {
-      return;
-    }
-    const overflow = keys.length - this.maxEntries;
-    const keysToRemove = keys.slice(0, overflow);
-    if (keysToRemove.length > 0) {
-      await this.client.del(...keysToRemove);
+  serialize(value) {
+    const payload = JSON.stringify(value);
+    if (typeof payload !== "string")
+      throw new TypeError("Redis cache values must be JSON serializable.");
+    return payload;
+  }
+  async execute(op, key, extra = {}) {
+    if (this.closed)
+      throw new Error("Redis cache store is closed.");
+    if (Buffer.byteLength(key) > 4096)
+      throw new RangeError("Invalid Redis cache identity.");
+    const tags = Array.from(new Set(extra.tags ?? []));
+    if (tags.length > 32 || tags.some((tag) => typeof tag !== "string" || Buffer.byteLength(tag) > 1024))
+      throw new RangeError("Redis cache supports at most 32 tags of 1024 bytes each.");
+    const prefixes = [key];
+    for (let i = 0;i < key.length; i++)
+      if (key[i] === "?")
+        prefixes.push(key.slice(0, i));
+    if (prefixes.length > 33)
+      throw new RangeError("Redis cache identities support at most 32 query separators.");
+    const ttlMs = extra.ttlMs ?? this.ttlMs;
+    if (typeof ttlMs !== "number" || !Number.isSafeInteger(ttlMs) || ttlMs < 0)
+      throw new RangeError("ttlMs must be a non-negative safe integer.");
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new Error("Redis cache command deadline exceeded; recreate the store."));
+        this.close();
+      }, this.options.commandTimeoutMs);
+    });
+    try {
+      const raw = await Promise.race([
+        this.client.send("EVAL", [
+          CACHE_SCRIPT,
+          String(this.keys.length),
+          ...this.keys,
+          JSON.stringify({
+            op,
+            key,
+            capacity: this.maxEntries,
+            owner: crypto.randomUUID(),
+            ...this.options,
+            ...extra,
+            tags,
+            prefixes,
+            ttlMs
+          })
+        ]),
+        timeout
+      ]);
+      return JSON.parse(String(raw));
+    } finally {
+      clearTimeout(timer);
     }
   }
 }
@@ -3689,7 +4025,7 @@ function createCacheStore(options) {
     if (!options.redisUrl) {
       throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
     }
-    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
+    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries, options.redis);
   }
   return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
 }
@@ -3702,6 +4038,8 @@ class TaggedCache {
     this.tags = tags;
   }
   async remember(key, callback, ttlMs) {
+    if (this.store.getOrSetTagged)
+      return this.store.getOrSetTagged(key, callback, this.tags, ttlMs);
     const value = await this.store.getOrSet(key, callback, ttlMs);
     await this.store.attachTags(key, this.tags);
     return value;
@@ -3718,6 +4056,9 @@ class CacheRepository {
   constructor(store) {
     this.store = store;
   }
+  async close() {
+    await this.store.close?.();
+  }
   async get(key) {
     return this.store.get(key);
   }
@@ -3765,90 +4106,14 @@ var CACHE_TAGS = {
   careers: "careers",
   offers: "offers"
 };
-// ../../src/core/contracts/container.ts
-function createServiceToken(key) {
-  if (!key.trim())
-    throw new Error("Service token key must not be empty.");
-  return key;
-}
-
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
-  }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
-  }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
-  }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
-    }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
-    }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
-    }
-    throw new Error(`Service "${key}" is not registered.`);
-  }
-  resolve(key) {
-    return this.get(key);
-  }
-  make(key) {
-    return this.resolve(key);
-  }
-  instance(key, value) {
-    return this.set(key, value);
-  }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
-  }
-}
-
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
-  }
-  get(key) {
-    return this.values.get(key);
-  }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
-    }
-    return this.values.get(key);
-  }
-  has(key) {
-    return this.values.has(key);
-  }
-}
-// ../../src/core/database/baseRepository.ts
-init_eventBus();
-
-// ../../src/core/events/index.ts
-init_deferredModelEvents();
-init_eventBus();
-function modelEventName(tableName, action) {
-  return `${tableName}.${action}`;
+// ../../src/core/database/baseRepository.ts
+init_eventBus();
+
+// ../../src/core/events/index.ts
+init_deferredModelEvents();
+init_eventBus();
+function modelEventName(tableName, action) {
+  return `${tableName}.${action}`;
 }
 
 // ../../src/core/pagination/index.ts
@@ -3864,6 +4129,7 @@ function buildPaginationMeta(input) {
 
 // ../../src/core/database/baseRepository.ts
 init_connectionContext();
+init_dialect();
 
 // ../../src/core/database/query.ts
 init_dialect();
@@ -4684,6 +4950,7 @@ class RepositoryQuery {
   queryOptions;
   eagerLoads = [];
   whereNodes = [];
+  protectedWhere = [];
   constructor(repository, whereClause = {}, queryOptions = {}) {
     this.repository = repository;
     this.whereClause = whereClause;
@@ -4693,10 +4960,23 @@ class RepositoryQuery {
     if (typeof input === "function") {
       const builder = new WhereBuilder;
       input(builder);
-      this.whereNodes.push(...builder.nodes);
+      if (builder.nodes.length > 0)
+        this.whereNodes.push({ kind: "and", group: builder.nodes });
       return this;
     }
-    this.whereClause = { ...this.whereClause, ...input };
+    this.whereNodes.push({ kind: "and", where: { ...input } });
+    return this;
+  }
+  protectWhere() {
+    const nodes = [];
+    if (Object.keys(this.whereClause).length > 0) {
+      nodes.push({ kind: "and", where: this.whereClause });
+    }
+    nodes.push(...this.whereNodes);
+    if (nodes.length > 0)
+      this.protectedWhere.push({ kind: "and", group: nodes });
+    this.whereClause = {};
+    this.whereNodes.length = 0;
     return this;
   }
   orWhere(input) {
@@ -4810,9 +5090,10 @@ class RepositoryQuery {
     });
     return this;
   }
-  withMorphTo(as, relation, repositoriesByType, options = {}) {
+  withMorphTo(as, relation, repositoriesByType, options = {}, optionsByType) {
     this.eagerLoads.push({
       kind: "morphTo",
+      morphOptions: optionsByType,
       as,
       relation,
       repository: this.repository,
@@ -4883,6 +5164,19 @@ class RepositoryQuery {
     }
     return row[column];
   }
+  async project(columns, limit) {
+    if (columns.length === 0)
+      throw new RangeError("A projection requires at least one column.");
+    const table = this.repository.getTable();
+    for (const column of columns)
+      if (!table.columns.includes(column))
+        throw new TypeError(`Unknown projection column: ${column}`);
+    return await this.repository.findAll({
+      ...this.buildOptions(),
+      ...limit === undefined ? {} : { limit },
+      select: uniqueColumnSelect(table.name, columns)
+    });
+  }
   async attachToRows(rows) {
     return await this.attach(rows);
   }
@@ -4893,11 +5187,24 @@ class RepositoryQuery {
       perPage: options.perPage
     });
   }
+  async chunk(count, callback) {
+    await this.repository.chunk(count, async (rows) => callback(await this.attach(rows)), this.buildOptions());
+  }
+  async cursorPaginate(options) {
+    const page = await this.repository.cursorPaginate({ ...this.buildOptions(), ...options });
+    return { ...page, data: await this.attach(page.data) };
+  }
+  getOptions() {
+    return this.buildOptions();
+  }
   buildOptions() {
+    if (this.protectedWhere.length === 0) {
+      return { ...this.queryOptions, where: this.whereClause, whereNodes: this.whereNodes };
+    }
     return {
       ...this.queryOptions,
-      where: this.whereClause,
-      whereNodes: this.whereNodes
+      where: {},
+      whereNodes: [...this.protectedWhere, { kind: "and", group: [...this.whereNodes] }]
     };
   }
   addJoin(type, left, right) {
@@ -4974,10 +5281,27 @@ class RepositoryQuery {
     }
     if (load.kind === "morphTo") {
       const relation = load.relation;
-      const grouped = await this.repository.loadMorphToForChildren(rows, relation, load.morphRepositories ?? new Map, load.options);
-      for (const row of result) {
-        row[load.as] = getByRelationKey(grouped, row[relation.morphIdKey]);
-      }
+      const repositories = load.morphRepositories ?? new Map;
+      const partitions = new Map;
+      rows.forEach((row, index) => {
+        const type = String(row[relation.morphTypeKey]);
+        const target = result[index];
+        if (!target || !repositories.has(type))
+          return;
+        const partition = partitions.get(type) ?? { rows: [], targets: [] };
+        partition.rows.push(row);
+        partition.targets.push(target);
+        partitions.set(type, partition);
+      });
+      await Promise.all([...partitions.entries()].map(async ([type, partition]) => {
+        const repository = repositories.get(type);
+        if (!repository)
+          return;
+        const grouped = await this.repository.loadMorphToForChildren(partition.rows, relation, new Map([[type, repository]]), load.morphOptions?.get(type) ?? load.options);
+        for (const row of partition.targets) {
+          row[load.as] = getByRelationKey(grouped, row[relation.morphIdKey]);
+        }
+      }));
       return;
     }
     const relation = load.relation;
@@ -5099,14 +5423,20 @@ class BaseRepository {
     if (!Number.isInteger(perPage) || perPage <= 0) {
       throw new Error("Cursor page size must be a positive integer.");
     }
-    const cursorWhere = { ...where };
+    const filters = [];
+    if (Object.keys(where).length > 0)
+      filters.push({ kind: "and", where });
+    filters.push(...whereNodes ?? []);
+    const cursorFilters = [{ kind: "and", group: filters }];
     if (cursor !== undefined) {
+      const cursorWhere = {};
       cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
+      cursorFilters.push({ kind: "and", where: cursorWhere });
     }
     const rows = await this.findAll({
       ...queryOptions,
-      where: cursorWhere,
-      whereNodes,
+      where: {},
+      whereNodes: cursorFilters,
       orderBy: { [cursorColumn]: direction },
       limit: perPage + 1
     });
@@ -5330,46 +5660,29 @@ class BaseRepository {
     if (parents.length === 0) {
       return indexHasManyThroughRelation(parents, [], relation);
     }
+    if (options.joins?.some((join) => join.table === relation.throughTable)) {
+      throw new Error("A related model scope joins the through table twice; use an explicitly aliased correlated predicate instead.");
+    }
     const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
     const throughParentKey = relation.throughParentKey ?? "__through_parent_id";
     const farTable = this.table.name;
     const columns = this.table.columns.map((column) => `${qualifyColumn(farTable, column)}`).join(", ");
-    const placeholders = parentIds.map((_, index) => `$${index + 1}`).join(", ");
-    const { text: extraWhere, params: extraParams } = this.buildThroughWhere(options, parentIds.length);
-    const softDelete = this.throughSoftDeleteClause(options);
-    const sql = `SELECT ${columns}, ${qualifyColumn(relation.throughTable, relation.firstKey)} AS ${throughParentKey} FROM ${quoteIdentifier(farTable)} INNER JOIN ${quoteIdentifier(relation.throughTable)} ON ${qualifyColumn(relation.throughTable, relation.secondLocalKey)} = ${qualifyColumn(farTable, relation.secondKey)} WHERE ${qualifyColumn(relation.throughTable, relation.firstKey)} IN (${placeholders})${softDelete}${extraWhere}`;
+    const placeholders = parentIds.map((_, index) => currentSqlDialect().placeholder(index + 1)).join(", ");
+    const { text: extraWhere, params: extraParams } = this.buildThroughWhere(options, parentIds);
+    const sql = `SELECT ${columns}, ${qualifyColumn(relation.throughTable, relation.firstKey)} AS ${throughParentKey} FROM ${quoteIdentifier(farTable)} INNER JOIN ${quoteIdentifier(relation.throughTable)} ON ${qualifyColumn(relation.throughTable, relation.secondLocalKey)} = ${qualifyColumn(farTable, relation.secondKey)}${buildJoinClause(options.joins)} WHERE ${qualifyColumn(relation.throughTable, relation.firstKey)} IN (${placeholders})${extraWhere}`;
     const children = await this.connection.unsafe(sql, [
       ...parentIds,
       ...extraParams
     ]);
     return indexHasManyThroughRelation(parents, children, relation);
   }
-  throughSoftDeleteClause(options) {
-    const column = resolveSoftDeleteColumn(this.table);
-    if (!column) {
-      return "";
-    }
-    const qualified = qualifyColumn(this.table.name, column);
-    if (options.onlyTrashed) {
-      return ` AND ${qualified} IS NOT NULL`;
-    }
-    if (options.withTrashed) {
-      return "";
-    }
-    return ` AND ${qualified} IS NULL`;
-  }
-  buildThroughWhere(options, paramOffset = 1) {
-    const where = options.where ?? {};
-    const entries = Object.entries(where);
-    if (entries.length === 0) {
-      return { text: "", params: [] };
-    }
-    const params = [];
-    const clauses = entries.map(([column, value], index) => {
-      params.push(value);
-      return `${qualifyColumn(this.table.name, column)} = $${paramOffset + index + 1}`;
-    });
-    return { text: ` AND ${clauses.join(" AND ")}`, params };
+  buildThroughWhere(options, parentIds) {
+    const parameters = [...parentIds];
+    const { clause } = buildQueryWhereClause(this.table, options, options.whereNodes, parameters);
+    return {
+      text: clause ? ` AND (${clause.replace(/^ WHERE /, "")})` : "",
+      params: parameters.slice(parentIds.length)
+    };
   }
   async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
     if (children.length === 0) {
@@ -5436,7 +5749,7 @@ class BaseRepository {
       return indexBelongsToManyRelation(parents, [], [], relation);
     }
     const parentIds = [...new Set(parents.map((parent) => parent[relation.parentKey]))];
-    const placeholders = parentIds.map((_, index) => `$${index + 1}`).join(", ");
+    const placeholders = parentIds.map((_, index) => currentSqlDialect().placeholder(index + 1)).join(", ");
     const pivotRows = await this.connection.unsafe(`SELECT * FROM ${relation.pivotTable} WHERE ${String(relation.foreignPivotKey)} IN (${placeholders})`, parentIds);
     if (pivotRows.length === 0) {
       return indexBelongsToManyRelation(parents, [], [], relation);
@@ -5794,7 +6107,12 @@ async function freshDatabase(db, migrations, options = {}) {
   }
   await runFresh();
 }
+// ../../src/core/database/model.ts
+import { isDeepStrictEqual } from "util";
+init_deferredModelEvents();
+
 // ../../src/core/database/relationQuery.ts
+init_dialect();
 function asWhere(where) {
   return where;
 }
@@ -5816,13 +6134,48 @@ function pluckFromQuery(query, column, keyBy) {
   }
   return keyBy === undefined ? query.pluck(column) : query.pluck(column, keyBy);
 }
+function scopedRelatedQuery(model, repository = model.repository()) {
+  const query = repository.query();
+  const scopedModel = model;
+  return scopedModel.scopeQuery?.(query) ?? query;
+}
+function relatedOptions(model, filters, options = {}) {
+  const query = scopedRelatedQuery(model);
+  for (const filter of filters)
+    query.where(filter);
+  return { ...query.getOptions(), ...options };
+}
+function relatedRead(model, connection, binding, filters, options = {}) {
+  const query = scopedRelatedQuery(model, model.repository().withConnection(connection));
+  query.where(binding).protectWhere();
+  for (const filter of filters)
+    query.where(filter);
+  if (options.orderBy)
+    query.orderBy(options.orderBy);
+  if (options.limit !== undefined)
+    query.limit(options.limit);
+  return query;
+}
+function relatedConditions(model, filters, options = {}, parameters = [], reservedTables = []) {
+  const compiled = relatedOptions(model, filters, options);
+  if (compiled.joins?.some((join) => reservedTables.includes(join.table))) {
+    throw new Error("A related model scope joins a reserved relation table; use an explicitly aliased correlated predicate instead.");
+  }
+  const extra = buildQueryWhereClause(model.repository().getTable(), compiled, compiled.whereNodes, parameters);
+  const predicate = extra.clause.replace(/^ WHERE /, "");
+  return {
+    sql: predicate ? ` AND (${predicate})` : "",
+    joins: buildJoinClause(compiled.joins),
+    params: extra.params
+  };
+}
 
 class HasManyRelationQuery {
   parent;
   related;
   relation;
   kind = "hasMany";
-  extraWhere = {};
+  extraWhere = [];
   extraOptions = {};
   constructor(parent, related, relation) {
     this.parent = parent;
@@ -5830,7 +6183,7 @@ class HasManyRelationQuery {
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   orderBy(orderBy) {
@@ -5842,7 +6195,7 @@ class HasManyRelationQuery {
     return this;
   }
   applyEagerLoad(query, alias) {
-    query.withHasMany(alias, this.relation, this.related.repository(), this.extraOptions);
+    query.withHasMany(alias, this.relation, this.related.repository(), relatedOptions(this.related, this.extraWhere, this.extraOptions));
   }
   hydrateEager(row, alias) {
     const value = row[alias] ?? [];
@@ -5851,24 +6204,12 @@ class HasManyRelationQuery {
   }
   toExistsClause(parentTable) {
     const childTable = this.related.repository().getTable().name;
-    const extra = buildAdvancedWhereClause(childTable, this.extraWhere, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
-    const sql = `SELECT 1 FROM ${quoteIdentifier(childTable)} WHERE ${qualifyColumn(childTable, this.relation.foreignKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extraSql ? ` AND ${extraSql}` : ""}`;
+    const extra = relatedConditions(this.related, this.extraWhere, this.extraOptions, [], [parentTable]);
+    const sql = `SELECT 1 FROM ${quoteIdentifier(childTable)}${extra.joins} WHERE ${qualifyColumn(childTable, this.relation.foreignKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extra.sql}`;
     return { sql, params: extra.params };
   }
   scopedQuery() {
-    const repository = this.related.repository().withConnection(this.parent.getRepository().getConnection());
-    let query = repository.query(asWhere({
-      [this.relation.foreignKey]: this.parent.get(this.relation.localKey),
-      ...this.extraWhere
-    }));
-    if (this.extraOptions.orderBy) {
-      query = query.orderBy(this.extraOptions.orderBy);
-    }
-    if (this.extraOptions.limit !== undefined) {
-      query = query.limit(this.extraOptions.limit);
-    }
-    return query;
+    return relatedRead(this.related, this.parent.getRepository().getConnection(), asWhere({ [this.relation.foreignKey]: this.parent.get(this.relation.localKey) }), this.extraWhere, this.extraOptions);
   }
   async get() {
     const rows = await this.scopedQuery().get();
@@ -5934,7 +6275,7 @@ class HasOneRelationQuery {
     return this;
   }
   applyEagerLoad(query, alias) {
-    this.inner.limit(1).applyEagerLoad(query, alias);
+    this.inner.applyEagerLoad(query, alias);
   }
   hydrateEager(row, alias) {
     const hydrated = this.inner.hydrateEager(row, alias);
@@ -5975,7 +6316,7 @@ class BelongsToRelationQuery {
   related;
   relation;
   kind = "belongsTo";
-  extraWhere = {};
+  extraWhere = [];
   extraOptions = {};
   constructor(parent, related, relation) {
     this.parent = parent;
@@ -5983,7 +6324,7 @@ class BelongsToRelationQuery {
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   orderBy(orderBy) {
@@ -5991,7 +6332,7 @@ class BelongsToRelationQuery {
     return this;
   }
   applyEagerLoad(query, alias) {
-    query.withBelongsTo(alias, this.relation, this.related.repository(), this.extraOptions);
+    query.withBelongsTo(alias, this.relation, this.related.repository(), relatedOptions(this.related, this.extraWhere, this.extraOptions));
   }
   hydrateEager(row, alias) {
     const value = row[alias];
@@ -5999,9 +6340,8 @@ class BelongsToRelationQuery {
   }
   toExistsClause(parentTable) {
     const relatedTable = this.related.repository().getTable().name;
-    const extra = buildAdvancedWhereClause(relatedTable, this.extraWhere, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
-    const sql = `SELECT 1 FROM ${quoteIdentifier(relatedTable)} WHERE ${qualifyColumn(relatedTable, this.relation.ownerKey)} = ${qualifyColumn(parentTable, this.relation.foreignKey)}${extraSql ? ` AND ${extraSql}` : ""}`;
+    const extra = relatedConditions(this.related, this.extraWhere, this.extraOptions, [], [parentTable]);
+    const sql = `SELECT 1 FROM ${quoteIdentifier(relatedTable)}${extra.joins} WHERE ${qualifyColumn(relatedTable, this.relation.ownerKey)} = ${qualifyColumn(parentTable, this.relation.foreignKey)}${extra.sql}`;
     return { sql, params: extra.params };
   }
   async get() {
@@ -6026,12 +6366,7 @@ class BelongsToRelationQuery {
     if (foreign === null || foreign === undefined) {
       return null;
     }
-    const repository = this.related.repository().withConnection(this.parent.getRepository().getConnection());
-    let query = repository.query(asWhere({ [this.relation.ownerKey]: foreign, ...this.extraWhere }));
-    if (this.extraOptions.orderBy) {
-      query = query.orderBy(this.extraOptions.orderBy);
-    }
-    return query;
+    return relatedRead(this.related, this.parent.getRepository().getConnection(), asWhere({ [this.relation.ownerKey]: foreign }), this.extraWhere, this.extraOptions);
   }
   then(onfulfilled, onrejected) {
     return thenGet(() => this.get(), onfulfilled, onrejected);
@@ -6053,7 +6388,7 @@ class BelongsToManyRelationQuery {
   related;
   relation;
   kind = "belongsToMany";
-  extraWhere = {};
+  extraWhere = [];
   extraOptions = {};
   pivotValues = {};
   constructor(parent, related, relation) {
@@ -6062,7 +6397,7 @@ class BelongsToManyRelationQuery {
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   orderBy(orderBy) {
@@ -6070,7 +6405,7 @@ class BelongsToManyRelationQuery {
     return this;
   }
   applyEagerLoad(query, alias) {
-    query.withBelongsToMany(alias, this.relation, this.related.repository(), this.extraOptions);
+    query.withBelongsToMany(alias, this.relation, this.related.repository(), relatedOptions(this.related, this.extraWhere, this.extraOptions));
   }
   withPivotValues(values) {
     this.pivotValues = { ...this.pivotValues, ...values };
@@ -6083,31 +6418,16 @@ class BelongsToManyRelationQuery {
   }
   toExistsClause(parentTable) {
     const relatedTable = this.related.repository().getTable().name;
-    const extra = buildAdvancedWhereClause(relatedTable, this.extraWhere, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
-    const sql = `SELECT 1 FROM ${quoteIdentifier(relatedTable)} INNER JOIN ${quoteIdentifier(this.relation.pivotTable)} ON ${qualifyColumn(this.relation.pivotTable, this.relation.relatedPivotKey)} = ${qualifyColumn(relatedTable, this.relation.relatedKey)} WHERE ${qualifyColumn(this.relation.pivotTable, this.relation.foreignPivotKey)} = ${qualifyColumn(parentTable, this.relation.parentKey)}${extraSql ? ` AND ${extraSql}` : ""}`;
+    const extra = relatedConditions(this.related, this.extraWhere, this.extraOptions, [], [parentTable, this.relation.pivotTable]);
+    const sql = `SELECT 1 FROM ${quoteIdentifier(relatedTable)} INNER JOIN ${quoteIdentifier(this.relation.pivotTable)} ON ${qualifyColumn(this.relation.pivotTable, this.relation.relatedPivotKey)} = ${qualifyColumn(relatedTable, this.relation.relatedKey)}${extra.joins} WHERE ${qualifyColumn(this.relation.pivotTable, this.relation.foreignPivotKey)} = ${qualifyColumn(parentTable, this.relation.parentKey)}${extra.sql}`;
     return { sql, params: extra.params };
   }
   connection() {
     return this.parent.getRepository().getConnection();
   }
   async get() {
-    const parentId = this.parent.get(this.relation.parentKey);
-    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
-    if (pivotRows.length === 0) {
-      return [];
-    }
-    const relatedIds = [
-      ...new Set(pivotRows.map((row) => row[this.relation.relatedPivotKey]))
-    ];
-    const repository = this.related.repository().withConnection(this.connection());
-    const rows = await repository.findAll({
-      ...this.extraOptions,
-      where: asWhere({
-        [this.relation.relatedKey]: relatedIds,
-        ...this.extraWhere
-      })
-    });
+    const query = await this.relatedQuery();
+    const rows = query ? await query.get() : [];
     return rows.map((row) => this.related.newFromRecord(row));
   }
   async first() {
@@ -6115,9 +6435,8 @@ class BelongsToManyRelationQuery {
     return rows[0] ?? null;
   }
   async count() {
-    const parentId = this.parent.get(this.relation.parentKey);
-    const rows = await this.connection().unsafe(`SELECT COUNT(*) AS count FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
-    return Number(rows[0]?.count ?? 0);
+    const query = await this.relatedQuery();
+    return query ? query.count() : 0;
   }
   async pluck(column, keyBy) {
     return pluckFromQuery(await this.relatedQuery(), column, keyBy);
@@ -6128,21 +6447,14 @@ class BelongsToManyRelationQuery {
   }
   async relatedQuery() {
     const parentId = this.parent.get(this.relation.parentKey);
-    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = $1`, [parentId]);
+    const pivotRows = await this.connection().unsafe(`SELECT * FROM ${quoteIdentifier(this.relation.pivotTable)} WHERE ${quoteIdentifier(String(this.relation.foreignPivotKey))} = ${currentSqlDialect().placeholder(1)}`, [parentId]);
     if (pivotRows.length === 0) {
       return null;
     }
     const relatedIds = [
       ...new Set(pivotRows.map((row) => row[this.relation.relatedPivotKey]))
     ];
-    let query = this.related.repository().withConnection(this.connection()).query(asWhere({
-      [this.relation.relatedKey]: relatedIds,
-      ...this.extraWhere
-    }));
-    if (this.extraOptions.orderBy) {
-      query = query.orderBy(this.extraOptions.orderBy);
-    }
-    return query;
+    return relatedRead(this.related, this.connection(), asWhere({ [this.relation.relatedKey]: relatedIds }), this.extraWhere, this.extraOptions);
   }
   then(onfulfilled, onrejected) {
     return thenGet(() => this.get(), onfulfilled, onrejected);
@@ -6198,7 +6510,7 @@ class MorphManyRelationQuery {
   related;
   relation;
   kind = "morphMany";
-  extraWhere = {};
+  extraWhere = [];
   extraOptions = {};
   constructor(parent, related, relation) {
     this.parent = parent;
@@ -6206,11 +6518,11 @@ class MorphManyRelationQuery {
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   applyEagerLoad(query, alias) {
-    query.withMorphMany(alias, this.relation, this.related.repository(), this.extraOptions);
+    query.withMorphMany(alias, this.relation, this.related.repository(), relatedOptions(this.related, this.extraWhere, this.extraOptions));
   }
   hydrateEager(row, alias) {
     const value = row[alias] ?? [];
@@ -6219,20 +6531,18 @@ class MorphManyRelationQuery {
   }
   toExistsClause(parentTable) {
     const childTable = this.related.repository().getTable().name;
-    const extra = buildAdvancedWhereClause(childTable, {
-      [this.relation.morphTypeKey]: this.relation.morphType,
+    const extra = relatedConditions(this.related, [
+      asWhere({ [this.relation.morphTypeKey]: this.relation.morphType }),
       ...this.extraWhere
-    }, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
-    const sql = `SELECT 1 FROM ${quoteIdentifier(childTable)} WHERE ${qualifyColumn(childTable, this.relation.morphIdKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extraSql ? ` AND ${extraSql}` : ""}`;
+    ], this.extraOptions, [], [parentTable]);
+    const sql = `SELECT 1 FROM ${quoteIdentifier(childTable)}${extra.joins} WHERE ${qualifyColumn(childTable, this.relation.morphIdKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extra.sql}`;
     return { sql, params: extra.params };
   }
   scopedQuery() {
-    return this.related.repository().withConnection(this.parent.getRepository().getConnection()).query(asWhere({
+    return relatedRead(this.related, this.parent.getRepository().getConnection(), asWhere({
       [this.relation.morphTypeKey]: this.relation.morphType,
-      [this.relation.morphIdKey]: this.parent.get(this.relation.localKey),
-      ...this.extraWhere
-    }));
+      [this.relation.morphIdKey]: this.parent.get(this.relation.localKey)
+    }), this.extraWhere);
   }
   async get() {
     const rows = await this.scopedQuery().get();
@@ -6319,14 +6629,14 @@ class MorphToRelationQuery {
   relatedByType;
   relation;
   kind = "morphTo";
-  extraWhere = {};
+  extraWhere = [];
   constructor(parent, relatedByType, relation) {
     this.parent = parent;
     this.relatedByType = relatedByType;
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   applyEagerLoad(query, alias) {
@@ -6334,23 +6644,30 @@ class MorphToRelationQuery {
       type,
       model.repository()
     ]));
-    query.withMorphTo(alias, this.relation, repositories);
+    query.withMorphTo(alias, this.relation, repositories, {}, new Map(Object.entries(this.relatedByType).map(([type, model]) => [
+      type,
+      relatedOptions(model, this.extraWhere)
+    ])));
   }
   hydrateEager(row, alias) {
     return row[alias];
   }
   toExistsClause(parentTable) {
-    const type = String(this.parent.get(this.relation.morphTypeKey) ?? "");
-    const related = this.relatedByType[type];
-    if (!related) {
-      return { sql: "SELECT 1 WHERE 1 = 0", params: [] };
-    }
-    const relatedTable = related.repository().getTable();
-    const extra = buildAdvancedWhereClause(relatedTable.name, this.extraWhere, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
+    const params = [];
+    const type = this.parent.get(this.relation.morphTypeKey);
+    if (type !== undefined && type !== null && !this.relatedByType[String(type)]) {
+      return { sql: "SELECT 1 WHERE 1 = 0", params };
+    }
+    const branches = Object.entries(this.relatedByType).map(([type, related]) => {
+      params.push(type);
+      const discriminator = currentSqlDialect().placeholder(params.length);
+      const table = related.repository().getTable();
+      const extra = relatedConditions(related, this.extraWhere, {}, params, [parentTable]);
+      return `(${qualifyColumn(parentTable, this.relation.morphTypeKey)} = ${discriminator} AND EXISTS (SELECT 1 FROM ${quoteIdentifier(table.name)}${extra.joins} WHERE ${qualifyColumn(table.name, table.primaryKey)} = ${qualifyColumn(parentTable, this.relation.morphIdKey)}${extra.sql}))`;
+    });
     return {
-      sql: `SELECT 1 FROM ${quoteIdentifier(relatedTable.name)} WHERE ${qualifyColumn(relatedTable.name, relatedTable.primaryKey)} = ${qualifyColumn(parentTable, this.relation.morphIdKey)}${extraSql ? ` AND ${extraSql}` : ""}`,
-      params: extra.params
+      sql: `SELECT 1 WHERE ${branches.length > 0 ? branches.join(" OR ") : "1 = 0"}`,
+      params
     };
   }
   async get() {
@@ -6378,7 +6695,7 @@ class MorphToRelationQuery {
       return null;
     }
     const table = related.repository().getTable();
-    return related.repository().withConnection(this.parent.getRepository().getConnection()).query(asWhere({ [table.primaryKey]: id, ...this.extraWhere }));
+    return relatedRead(related, this.parent.getRepository().getConnection(), asWhere({ [table.primaryKey]: id }), this.extraWhere);
   }
   then(onfulfilled, onrejected) {
     return thenGet(() => this.get(), onfulfilled, onrejected);
@@ -6390,7 +6707,7 @@ class HasManyThroughRelationQuery {
   related;
   relation;
   kind = "hasManyThrough";
-  extraWhere = {};
+  extraWhere = [];
   extraOptions = {};
   constructor(parent, related, relation) {
     this.parent = parent;
@@ -6398,7 +6715,7 @@ class HasManyThroughRelationQuery {
     this.relation = relation;
   }
   where(where) {
-    this.extraWhere = { ...this.extraWhere, ...where };
+    this.extraWhere.push({ ...where });
     return this;
   }
   orderBy(orderBy) {
@@ -6410,7 +6727,7 @@ class HasManyThroughRelationQuery {
     return this;
   }
   applyEagerLoad(query, alias) {
-    query.withHasManyThrough(alias, this.relation, this.related.repository(), this.extraOptions);
+    query.withHasManyThrough(alias, this.relation, this.related.repository(), relatedOptions(this.related, this.extraWhere, this.extraOptions));
   }
   hydrateEager(row, alias) {
     const value = row[alias] ?? [];
@@ -6419,9 +6736,8 @@ class HasManyThroughRelationQuery {
   }
   toExistsClause(parentTable) {
     const farTable = this.related.repository().getTable().name;
-    const extra = buildAdvancedWhereClause(farTable, this.extraWhere, [], []);
-    const extraSql = extra.clause.replace(/^ WHERE /, "");
-    const sql = `SELECT 1 FROM ${quoteIdentifier(farTable)} INNER JOIN ${quoteIdentifier(this.relation.throughTable)} ON ${qualifyColumn(this.relation.throughTable, this.relation.secondLocalKey)} = ${qualifyColumn(farTable, this.relation.secondKey)} WHERE ${qualifyColumn(this.relation.throughTable, this.relation.firstKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extraSql ? ` AND ${extraSql}` : ""}`;
+    const extra = relatedConditions(this.related, this.extraWhere, this.extraOptions, [], [parentTable, this.relation.throughTable]);
+    const sql = `SELECT 1 FROM ${quoteIdentifier(farTable)} INNER JOIN ${quoteIdentifier(this.relation.throughTable)} ON ${qualifyColumn(this.relation.throughTable, this.relation.secondLocalKey)} = ${qualifyColumn(farTable, this.relation.secondKey)}${extra.joins} WHERE ${qualifyColumn(this.relation.throughTable, this.relation.firstKey)} = ${qualifyColumn(parentTable, this.relation.localKey)}${extra.sql}`;
     return { sql, params: extra.params };
   }
   async get() {
@@ -6446,8 +6762,7 @@ class HasManyThroughRelationQuery {
   }
   async farRows() {
     return this.related.repository().withConnection(this.parent.getRepository().getConnection()).findHasManyThrough(this.parent.get(this.relation.localKey), this.relation, {
-      ...this.extraOptions,
-      where: this.extraWhere
+      ...relatedOptions(this.related, this.extraWhere, this.extraOptions)
     });
   }
   then(onfulfilled, onrejected) {
@@ -6456,7 +6771,17 @@ class HasManyThroughRelationQuery {
 }
 
 // ../../src/core/database/model.ts
+function snapshotAttributes(values) {
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [
+    key,
+    Buffer.isBuffer(value) ? Buffer.from(value) : structuredClone(value)
+  ]));
+}
+function changedAttributes(values, original) {
+  return Object.fromEntries(Object.entries(values).filter(([key, value]) => !(key in original) || !isDeepStrictEqual(value, original[key])));
+}
 var modelRepositories = new WeakMap;
+var modelRepositoryFactories = new WeakMap;
 var namedModels = new Map;
 var modelGlobalScopes = new WeakMap;
 var modelObservers = new WeakMap;
@@ -6547,12 +6872,54 @@ async function eagerLoadOnModels(models, paths) {
 async function loadNested(model, path) {
   await eagerLoadOnModels([model], [path]);
 }
+function nameModel(model) {
+  const { name, $morphClass } = model;
+  if (name)
+    namedModels.set(name, model);
+  if ($morphClass)
+    namedModels.set($morphClass, model);
+}
 function resolveModelRepository(model) {
-  const repository = modelRepositories.get(model);
-  if (!repository) {
-    throw new Error(`${model.name}.repository() is not implemented.`);
+  const existing = modelRepositories.get(model);
+  if (existing)
+    return existing;
+  for (let current = model;current; current = Object.getPrototypeOf(current)) {
+    const factory = modelRepositoryFactories.get(current);
+    if (!factory)
+      continue;
+    const repository = factory();
+    modelRepositories.set(model, repository);
+    nameModel(model);
+    return repository;
+  }
+  throw new Error(`${model.name}.repository() is not implemented.`);
+}
+function defineModel(table) {
+
+  class TableModel extends Model {
+  }
+  modelRepositoryFactories.set(TableModel, () => new baseRepository_default(table));
+  return TableModel;
+}
+function bootModels(models) {
+  const names = new Map;
+  for (const model of models) {
+    const { name, $morphClass } = model;
+    for (const alias of [name, $morphClass]) {
+      if (!alias)
+        continue;
+      const existing = names.get(alias);
+      if (existing && existing !== model)
+        throw new Error(`Duplicate model name [${alias}].`);
+      names.set(alias, model);
+    }
+  }
+  for (const model of models)
+    nameModel(model);
+  for (const model of models) {
+    resolveModelRepository(model);
+    ensureBooted(model);
   }
-  return repository;
 }
 function registerModelClass(name, model) {
   namedModels.set(name, model);
@@ -6603,10 +6970,26 @@ function ensureBooted(model) {
   if (modelBooted.has(model)) {
     return;
   }
+  nameModel(model);
   modelBooted.add(model);
+  const scopes = modelGlobalScopes.get(model);
+  const observers = modelObservers.get(model);
   const boot = model.boot;
   if (typeof boot === "function") {
-    boot.call(model);
+    try {
+      boot.call(model);
+    } catch (error) {
+      modelBooted.delete(model);
+      if (scopes)
+        modelGlobalScopes.set(model, scopes);
+      else
+        modelGlobalScopes.delete(model);
+      if (observers)
+        modelObservers.set(model, observers);
+      else
+        modelObservers.delete(model);
+      throw error;
+    }
   }
 }
 function getGlobalScopes(model) {
@@ -6734,6 +7117,19 @@ function applyTimestampsOnUpdate(columns, values, enabled) {
   return result;
 }
 
+class ModelProjection {
+  load;
+  constructor(load) {
+    this.load = load;
+  }
+  get() {
+    return this.load();
+  }
+  async first() {
+    return (await this.load(1))[0] ?? null;
+  }
+}
+
 class ModelQuery {
   modelClass;
   query;
@@ -6766,6 +7162,16 @@ class ModelQuery {
     this.query.orWhere(input);
     return this;
   }
+  whereDynamic(input) {
+    this.query.where(input);
+    return this;
+  }
+  select(...columns) {
+    return new ModelProjection(async (limit) => {
+      const rows = await this.query.project(columns, limit);
+      return rows.map((row) => applyCasts(row, modelStatics(this.modelClass).$casts, "hydrate"));
+    });
+  }
   orderBy(orderBy) {
     this.query.orderBy(orderBy);
     return this;
@@ -6914,7 +7320,7 @@ class ModelQuery {
   }
   async find(id) {
     const primaryKey = resolveModelRepository(this.modelClass).getTable().primaryKey;
-    return this.where({ [primaryKey]: id }).first();
+    return this.whereDynamic({ [primaryKey]: id }).first();
   }
   async findOrFail(id, errorFactory) {
     const model = await this.find(id);
@@ -6971,6 +7377,7 @@ class Model {
   static $appends;
   static $morphClass;
   _exists;
+  originalAttributes;
   loadedRelations = {};
   hiddenOverrides = [];
   visibleOverrides = [];
@@ -6980,6 +7387,24 @@ class Model {
     this.repository = repository;
     this._exists = exists;
     this.attributes = modelStatics(this.constructor).hydrateAttributes(attributes);
+    this.originalAttributes = snapshotAttributes(this.attributes);
+  }
+  acceptPersistedAttributes(record) {
+    const original = this.originalAttributes;
+    const beforeWrite = snapshotAttributes(this.attributes);
+    const existed = this._exists;
+    this.attributes = modelStatics(this.constructor).hydrateAttributes(record);
+    this.originalAttributes = snapshotAttributes(this.attributes);
+    const written = this.originalAttributes;
+    this._exists = true;
+    onDeferredModelRollback(() => {
+      this.attributes = {
+        ...beforeWrite,
+        ...changedAttributes(this.attributes, written)
+      };
+      this.originalAttributes = original;
+      this._exists = existed;
+    });
   }
   getRepository() {
     return this.repository;
@@ -7072,21 +7497,30 @@ class Model {
     ]);
   }
   static repository() {
-    return resolveModelRepository(this);
+    const repository = resolveModelRepository(this);
+    ensureBooted(this);
+    return repository;
+  }
+  static scopeQuery(query) {
+    ensureBooted(this);
+    let scoped = query;
+    for (const scope of getGlobalScopes(this))
+      scoped = scope(scoped).protectWhere();
+    return scoped;
   }
   static query() {
     ensureBooted(this);
     const repository = resolveModelRepository(this);
-    let query = repository.query();
-    for (const scope of getGlobalScopes(this)) {
-      query = scope(query);
-    }
-    return new ModelQuery(this, query);
+    const scopeQuery = Model.scopeQuery;
+    return new ModelQuery(this, scopeQuery.call(this, repository.query()));
   }
   static newFromRecord(record, exists = true) {
     const repository = resolveModelRepository(this);
     return modelStatics(this).fromRecord(record, repository, exists);
   }
+  static newFromTrustedRecord(record, exists = true) {
+    return modelStatics(this).newFromRecord(record, exists);
+  }
   static async create(attributes, forced = {}) {
     const statics = modelStatics(this);
     ensureBooted(this);
@@ -7124,14 +7558,14 @@ class Model {
   static async chunk(count, callback) {
     const statics = modelStatics(this);
     ensureBooted(this);
-    await resolveModelRepository(this).chunk(count, async (rows) => {
+    await Model.query.call(this).query.chunk(count, async (rows) => {
       return await callback(rows.map((row) => statics.newFromRecord(row, true)));
     });
   }
   static async cursorPaginate(options) {
     const statics = modelStatics(this);
     ensureBooted(this);
-    const page = await resolveModelRepository(this).cursorPaginate({
+    const page = await Model.query.call(this).query.cursorPaginate({
       perPage: options.perPage,
       cursor: options.cursor
     });
@@ -7239,9 +7673,14 @@ class Model {
       return this;
     }
     if (updating) {
-      const changes = applyTimestampsOnUpdate(table.columns, await applyCasts(this.attributes, casts, "dehydrate"), timestamps);
+      const dirty = changedAttributes(this.attributes, this.originalAttributes);
+      if (Object.keys(dirty).length === 0) {
+        await runObservers(this, "saved");
+        return this;
+      }
+      const changes = applyTimestampsOnUpdate(table.columns, await applyCasts(dirty, casts, "dehydrate"), timestamps);
       const record = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record);
+      this.acceptPersistedAttributes(record);
       await runObservers(this, "updated");
       await runObservers(this, "saved");
       return this;
@@ -7250,8 +7689,7 @@ class Model {
     const withTimestamps = applyTimestampsOnCreate(table.columns, assignable, timestamps);
     const payload = await ModelClass.dehydrateAttributes(withTimestamps);
     const record = await this.repository.create(payload);
-    this.attributes = ModelClass.hydrateAttributes(record);
-    this._exists = true;
+    this.acceptPersistedAttributes(record);
     await runObservers(this, "created");
     await runObservers(this, "saved");
     return this;
@@ -7276,12 +7714,11 @@ class Model {
     return await this.repository.forceDeleteById(this.id);
   }
   async restore() {
-    const ModelClass = modelStatics(this.constructor);
     const record = await this.repository.restoreById(this.id);
     if (!record) {
       return null;
     }
-    this.attributes = ModelClass.hydrateAttributes(record);
+    this.acceptPersistedAttributes(record);
     return this;
   }
   async loadHasMany(as, relation, childRepository, options = {}) {
@@ -7436,14 +7873,7 @@ class Model {
 }
 function registerModelRepository(model, repository) {
   modelRepositories.set(model, repository);
-  const name = model.name;
-  if (name) {
-    namedModels.set(name, model);
-  }
-  const morphClass = model.$morphClass;
-  if (morphClass) {
-    namedModels.set(morphClass, model);
-  }
+  nameModel(model);
   ensureBooted(model);
   return model;
 }
@@ -9168,29 +9598,95 @@ function storageFacade() {
   return storage();
 }
 // ../../src/core/http/bodySizeLimitMiddleware.ts
+var guards = new WeakMap;
+function guardBody(request, maxBytes) {
+  const existing = guards.get(request);
+  if (existing && existing.maxBytes <= maxBytes)
+    return existing;
+  const state = { maxBytes, exceeded: false };
+  const body = request.body;
+  if (!body)
+    return state;
+  let consumed = 0;
+  const stream = body.pipeThrough(new TransformStream({
+    transform(chunk, controller) {
+      const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+      consumed += bytes.byteLength;
+      if (consumed > maxBytes) {
+        state.exceeded = true;
+        throw new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+      }
+      controller.enqueue(bytes);
+    }
+  }));
+  const bounded = new Request(request, { body: stream });
+  const decorateClone = (clone) => {
+    for (const field of ["params", "cookies"]) {
+      if (field in request)
+        Object.defineProperty(clone, field, { value: Reflect.get(request, field) });
+    }
+    const nativeClone = () => Reflect.apply(Request.prototype.clone, clone, []);
+    Object.defineProperty(clone, "clone", {
+      value: () => decorateClone(nativeClone())
+    });
+    guards.set(clone, state);
+    return clone;
+  };
+  const descriptors = {
+    body: { configurable: true, get: () => bounded.body },
+    bodyUsed: { configurable: true, get: () => bounded.bodyUsed },
+    clone: {
+      configurable: true,
+      value: () => decorateClone(Reflect.apply(Request.prototype.clone, bounded, []))
+    }
+  };
+  for (const method of [
+    "text",
+    "json",
+    "formData",
+    "arrayBuffer",
+    "blob",
+    "bytes",
+    "textStream"
+  ]) {
+    descriptors[method] = { configurable: true, value: bounded[method].bind(bounded) };
+  }
+  Object.defineProperties(request, descriptors);
+  guards.set(request, state);
+  return state;
+}
 var DEFAULT_MAX_BODY_BYTES = 1048576;
 function resolveMaxBodyBytes() {
   const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
   if (!raw) {
     return DEFAULT_MAX_BODY_BYTES;
   }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
     return DEFAULT_MAX_BODY_BYTES;
   }
   return parsed;
 }
 function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+    throw new RangeError("Body limit must be a positive safe integer.");
   return async (request, next) => {
-    const contentLength = request.headers.get("content-length");
-    if (contentLength) {
-      const bytes = Number.parseInt(contentLength, 10);
-      if (Number.isInteger(bytes) && bytes > maxBytes) {
-        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-        return Response.json({ error: error.message }, { status: error.status });
-      }
+    const tooLarge = () => {
+      const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+      return Response.json({ error: error.message }, { status: error.status });
+    };
+    const length = Number(request.headers.get("content-length"));
+    if (Number.isFinite(length) && length > maxBytes)
+      return tooLarge();
+    const state = guardBody(request, maxBytes);
+    try {
+      const response = await next();
+      return state.exceeded ? tooLarge() : response;
+    } catch (error) {
+      if (state.exceeded || error instanceof PayloadTooLargeError)
+        return tooLarge();
+      throw error;
     }
-    return await next();
   };
 }
 // ../../src/core/http/requestMetaContext.ts
@@ -10718,6 +11214,67 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     return response;
   };
 }
+// ../../src/core/runtime/boundedThrottleStore.ts
+class BoundedThrottleStore {
+  decayMs;
+  now;
+  buckets = new Map;
+  maxBuckets;
+  pruneBatchSize;
+  disposed = false;
+  pruned = 0;
+  constructor(decayMs, options = {}, now = () => performance.now()) {
+    this.decayMs = decayMs;
+    this.now = now;
+    this.maxBuckets = options.maxBuckets ?? 1e4;
+    this.pruneBatchSize = options.pruneBatchSize ?? 32;
+    if (!Number.isFinite(decayMs) || decayMs < 0 || decayMs > 2147483647) {
+      throw new Error("Invalid memory throttle window.");
+    }
+    if (!Number.isSafeInteger(this.maxBuckets) || this.maxBuckets < 1 || this.maxBuckets > 1e6 || !Number.isSafeInteger(this.pruneBatchSize) || this.pruneBatchSize < 1 || this.pruneBatchSize > 1024) {
+      throw new Error("Invalid memory throttle storage bounds.");
+    }
+  }
+  consume(key) {
+    this.pruned = 0;
+    if (this.disposed)
+      return null;
+    const now = this.now();
+    const entries = this.buckets.entries();
+    for (let i = 0;i < this.pruneBatchSize; i++) {
+      const oldest = entries.next().value;
+      if (!oldest || oldest[1].resetAt > now)
+        break;
+      this.buckets.delete(oldest[0]);
+      this.pruned++;
+    }
+    const existing = this.buckets.get(key);
+    if (existing && existing.resetAt > now) {
+      existing.count = Math.min(Number.MAX_SAFE_INTEGER, existing.count + 1);
+      return existing.count;
+    }
+    this.buckets.delete(key);
+    if (this.buckets.size >= this.maxBuckets)
+      return null;
+    this.buckets.set(key, { count: 1, resetAt: now + this.decayMs });
+    return 1;
+  }
+  clear() {
+    this.buckets.clear();
+  }
+  dispose() {
+    this.disposed = true;
+    this.clear();
+  }
+  stats() {
+    return {
+      retainedBuckets: this.buckets.size,
+      prunedOnLastConsume: this.pruned,
+      disposed: this.disposed
+    };
+  }
+}
+
 // ../../src/core/http/throttleMiddleware.ts
 import { createHash as createHash3 } from "crypto";
 init_tenantContext();
@@ -10762,28 +11319,32 @@ if ttl < 0 then
 end
 return count
 `;
-function redisThrottleKey(request, prefix, identity) {
+function redisThrottleKey(request, prefix, identity, tenantId = currentTenant()?.id ?? null) {
   const bucket = JSON.stringify([
-    currentTenant()?.id ?? null,
+    tenantId,
     request.method,
     currentRequestMeta().routeTemplate ?? "__unmatched__",
     identity
   ]);
   return namespacedRedisKey(`${prefix}:${createHash3("sha256").update(bucket).digest("hex")}`);
 }
-async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000) {
-  if (!Number.isFinite(decaySeconds) || decaySeconds < 0 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000, signal) {
+  const expiryMs = Math.max(1, Math.ceil(decaySeconds * 1000));
+  if (!Number.isFinite(decaySeconds) || decaySeconds < 0 || !Number.isSafeInteger(expiryMs) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
     throw new Error("Invalid throttle expiry or command timeout.");
   }
+  if (signal?.aborted)
+    throw new Error("Throttle consumer is disposed.");
+  let onAbort;
   let timer;
   try {
+    const cancelled = new Promise((_resolve, reject) => {
+      onAbort = () => reject(new Error("Throttle consumer is disposed."));
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
     const result = await Promise.race([
-      client.send("EVAL", [
-        CONSUME_THROTTLE,
-        "1",
-        key,
-        String(Math.max(1, Math.ceil(decaySeconds * 1000)))
-      ]),
+      cancelled,
+      client.send("EVAL", [CONSUME_THROTTLE, "1", key, String(expiryMs)]),
       new Promise((_resolve, reject) => {
         timer = setTimeout(() => reject(new Error("Throttle store deadline exceeded.")), timeoutMs);
       })
@@ -10794,11 +11355,16 @@ async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000)
     return count;
   } finally {
     clearTimeout(timer);
+    if (onAbort)
+      signal?.removeEventListener("abort", onAbort);
   }
 }
 function createRedisThrottleConsumer(options) {
   let ownedClient;
-  return async (key, decaySeconds) => {
+  const controller = new AbortController;
+  const consume = async (key, decaySeconds) => {
+    if (controller.signal.aborted)
+      throw new Error("Throttle consumer is disposed.");
     if (!options.redisClient && !ownedClient) {
       ownedClient = new RedisClient2(options.redisUrl, { autoReconnect: false, maxRetries: 0 });
     }
@@ -10806,7 +11372,10 @@ function createRedisThrottleConsumer(options) {
     if (!client)
       throw new Error("Throttle client is required.");
     try {
-      return await consumeRedisThrottle(client, key, decaySeconds, options.commandTimeoutMs);
+      const attempts = await consumeRedisThrottle(client, key, decaySeconds, options.commandTimeoutMs, controller.signal);
+      if (controller.signal.aborted)
+        throw new Error("Throttle consumer is disposed.");
+      return attempts;
     } catch (error) {
       if (client === ownedClient) {
         ownedClient.close();
@@ -10815,6 +11384,17 @@ function createRedisThrottleConsumer(options) {
       throw error;
     }
   };
+  return Object.assign(consume, {
+    isDisposed: () => controller.signal.aborted,
+    dispose() {
+      if (controller.signal.aborted)
+        return;
+      controller.abort();
+      const client = ownedClient;
+      ownedClient = undefined;
+      client?.close();
+    }
+  });
 }
 function throttleUnavailableResponse() {
   return Response.json({ error: "Rate limiting is temporarily unavailable." }, {
@@ -10822,27 +11402,52 @@ function throttleUnavailableResponse() {
     headers: { "retry-after": "1" }
   });
 }
+function resolveThrottleQuota(request, options, identity = resolveThrottleIdentity(request)) {
+  const limit = options.quotaPolicy ? options.quotaPolicy({
+    request,
+    tenant: currentTenant(),
+    identity,
+    routeTemplate: currentRequestMeta().routeTemplate ?? "__unmatched__",
+    maxAttempts: options.maxAttempts
+  }) : options.maxAttempts;
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new Error("Invalid application quota.");
+  }
+  return limit;
+}
 function createThrottleMiddleware(options) {
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0) {
+    throw new Error("Throttle maxAttempts must be a non-negative safe integer.");
+  }
   const consume = createRedisThrottleConsumer(options);
   const prefix = options.keyPrefix ?? "throttle";
-  return async (request, next) => {
-    const key = redisThrottleKey(request, prefix, resolveThrottleIdentity(request));
+  const middleware = async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    let maxAttempts;
+    try {
+      maxAttempts = resolveThrottleQuota(request, options, identity);
+    } catch {
+      return throttleUnavailableResponse();
+    }
+    const key = redisThrottleKey(request, prefix, identity);
     let attempts;
     try {
       attempts = await consume(key, options.decaySeconds);
     } catch {
       return throttleUnavailableResponse();
     }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (consume.isDisposed())
+      return throttleUnavailableResponse();
     if (attempts > maxAttempts) {
       return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
     }
     return await next();
   };
+  return Object.assign(middleware, { dispose: () => consume.dispose() });
 }
 
 // ../../src/core/http/loginThrottleMiddleware.ts
-var memoryLoginBuckets = new Map;
+var resetGeneration = 0;
 function resolveLoginIdentity(request) {
   return readClientIp(request) ?? "unknown";
 }
@@ -10860,33 +11465,31 @@ async function resolveLoginEmail(request) {
     return "unknown";
   }
 }
-function consumeMemoryAttempt(key, decaySeconds) {
-  const now = Date.now();
-  const existing = memoryLoginBuckets.get(key);
-  if (!existing || existing.resetAt <= now) {
-    memoryLoginBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
-    return 1;
-  }
-  existing.count += 1;
-  return existing.count;
-}
 function createMemoryLoginThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
+  const store = new BoundedThrottleStore(options.decaySeconds * 1000, options);
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0)
+    throw new Error("Invalid memory throttle limit.");
+  let generation = resetGeneration;
+  const middleware = async (request, next) => {
+    if (generation !== resetGeneration) {
+      store.clear();
+      generation = resetGeneration;
+    }
     const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = consumeMemoryAttempt(throttleKey, options.decaySeconds);
-    if (attempts > options.maxAttempts) {
+    const key = redisThrottleKey(request, options.keyPrefix ?? "login-throttle", JSON.stringify([resolveLoginIdentity(request), email]));
+    const attempts = store.consume(key);
+    if (attempts === null)
+      return throttleUnavailableResponse();
+    if (attempts > options.maxAttempts)
       return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
-    }
     return await next();
   };
+  return Object.assign(middleware, { dispose: () => store.dispose(), stats: () => store.stats() });
 }
 function createRedisLoginThrottleMiddleware(options) {
   const consume = createRedisThrottleConsumer(options);
   const prefix = options.keyPrefix ?? "login-throttle";
-  return async (request, next) => {
+  const middleware = async (request, next) => {
     const identity = resolveLoginIdentity(request);
     const email = await resolveLoginEmail(request);
     const throttleKey = redisThrottleKey(request, prefix, JSON.stringify([identity, email]));
@@ -10896,11 +11499,14 @@ function createRedisLoginThrottleMiddleware(options) {
     } catch {
       return throttleUnavailableResponse();
     }
+    if (consume.isDisposed())
+      return throttleUnavailableResponse();
     if (attempts > options.maxAttempts) {
       return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
     }
     return await next();
   };
+  return Object.assign(middleware, { dispose: () => consume.dispose() });
 }
 function createLoginThrottleMiddleware(options) {
   const redisUrl = options.redisUrl?.trim() ?? "";
@@ -10910,35 +11516,37 @@ function createLoginThrottleMiddleware(options) {
   return createMemoryLoginThrottleMiddleware(options);
 }
 function resetMemoryLoginThrottleForTests() {
-  memoryLoginBuckets.clear();
+  resetGeneration++;
 }
 // ../../src/core/http/memoryThrottleMiddleware.ts
-var throttleBucketRegistries = new Set;
+var resetGeneration2 = 0;
 function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? namespacedRedisKey("memory-throttle:");
-  const buckets = new Map;
-  throttleBucketRegistries.add(buckets);
-  return async (request, next) => {
-    const path = new URL(request.url).pathname;
-    const identity = readClientIp(request) ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
-    const key = `${prefix}${identity}:${path}`;
-    const now = Date.now();
-    const existing = buckets.get(key);
-    if (!existing || existing.resetAt <= now) {
-      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
-      return await next();
+  const store = new BoundedThrottleStore(options.decaySeconds * 1000, options);
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0)
+    throw new Error("Invalid memory throttle limit.");
+  let generation = resetGeneration2;
+  const middleware = async (request, next) => {
+    if (generation !== resetGeneration2) {
+      store.clear();
+      generation = resetGeneration2;
+    }
+    let maxAttempts;
+    try {
+      maxAttempts = resolveThrottleQuota(request, options);
+    } catch {
+      return throttleUnavailableResponse();
     }
-    existing.count += 1;
-    if (existing.count > options.maxAttempts) {
+    const attempts = store.consume(redisThrottleKey(request, options.keyPrefix ?? "memory-throttle", resolveThrottleIdentity(request)));
+    if (attempts === null)
+      return throttleUnavailableResponse();
+    if (attempts > maxAttempts)
       return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
-    }
     return await next();
   };
+  return Object.assign(middleware, { dispose: () => store.dispose(), stats: () => store.stats() });
 }
 function resetMemoryThrottleForTests() {
-  for (const buckets of throttleBucketRegistries) {
-    buckets.clear();
-  }
+  resetGeneration2++;
 }
 // ../../src/core/metrics/prometheus.ts
 var HTTP_DURATION_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 1e4];
@@ -11208,8 +11816,6 @@ function createRequireWebAuthMiddleware(auth) {
 }
 // ../../src/core/http/scimThrottleMiddleware.ts
 import { createHash as createHash4 } from "crypto";
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-var memoryBuckets = new Map;
 function resolveScimIdentity(request) {
   const authorization = request.headers.get("authorization") ?? "";
   const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
@@ -11218,40 +11824,44 @@ function resolveScimIdentity(request) {
   }
   return readClientIp(request) ?? "unknown";
 }
-function throttleFromMemory(key, maxAttempts, decaySeconds) {
-  const now = Date.now();
-  const existing = memoryBuckets.get(key);
-  if (!existing || existing.resetAt <= now) {
-    memoryBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
-    return null;
-  }
-  existing.count += 1;
-  if (existing.count > maxAttempts) {
-    return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(decaySeconds) } });
-  }
-  return null;
-}
 function createScimThrottleMiddleware(options) {
-  const client = options.redisUrl ? new RedisClient3(options.redisUrl) : null;
-  return async (request, next) => {
+  if (!Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 0)
+    throw new Error("Invalid SCIM throttle limit.");
+  const redisUrl = options.redisUrl?.trim() ?? "";
+  const distributed = Boolean(redisUrl || options.redisClient);
+  const store = distributed ? null : new BoundedThrottleStore(options.decaySeconds * 1000, options);
+  const consume = distributed ? createRedisThrottleConsumer({ ...options, redisUrl }) : null;
+  let disposed = false;
+  const middleware = async (request, next) => {
+    if (disposed)
+      return throttleUnavailableResponse();
     const identity = resolveScimIdentity(request);
-    const key = `${namespacedRedisKey("scim-throttle:")}${identity}`;
-    if (client) {
-      const attempts = Number(await client.incr(key));
-      if (attempts === 1) {
-        await client.expire(key, options.decaySeconds);
-      }
-      if (attempts > options.maxAttempts) {
-        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
-      }
-      return await next();
-    }
-    const limited = throttleFromMemory(key, options.maxAttempts, options.decaySeconds);
-    if (limited) {
-      return limited;
+    const token = request.headers.get("authorization")?.startsWith("Bearer ") ? request.headers.get("authorization")?.slice("Bearer ".length).trim() ?? "" : "";
+    const key = redisThrottleKey(request, options.keyPrefix ?? "scim-throttle:v2", identity, resolveScimTenantFromToken(token) ?? undefined);
+    let attempts;
+    try {
+      attempts = consume ? await consume(key, options.decaySeconds) : store?.consume(key);
+    } catch {
+      return throttleUnavailableResponse();
     }
+    if (disposed)
+      return throttleUnavailableResponse();
+    if (attempts === null || attempts === undefined)
+      return throttleUnavailableResponse();
+    if (attempts > options.maxAttempts)
+      return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
     return await next();
   };
+  return Object.assign(middleware, {
+    dispose: () => {
+      if (disposed)
+        return;
+      disposed = true;
+      store?.dispose();
+      consume?.dispose();
+    },
+    stats: () => store?.stats()
+  });
 }
 // ../../src/core/http/securityHeadersMiddleware.ts
 function createSecurityHeadersMiddleware(options = {}) {
@@ -11419,47 +12029,150 @@ class WebFormRequest {
   }
 }
 // ../../src/core/lifecycle/gracefulShutdown.ts
-var shutdownHandlers = new Map;
-var shutdownInstalled = false;
-var shuttingDown = false;
-function registerShutdownHandler(name, handler) {
-  shutdownHandlers.set(name, handler);
-  return () => {
-    shutdownHandlers.delete(name);
-  };
+function resolveShutdownTimeoutMs() {
+  const configured = process.env.SHUTDOWN_TIMEOUT_MS;
+  const value = configured === undefined ? 30000 : Number(configured);
+  if (!Number.isSafeInteger(value) || value <= 0 || value > 2147483647)
+    throw new RangeError("SHUTDOWN_TIMEOUT_MS must be an integer between 1 and 2147483647.");
+  return value;
 }
-async function runGracefulShutdown(signal) {
-  if (shuttingDown) {
-    return;
-  }
-  shuttingDown = true;
-  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
-  for (const [name, handler] of shutdownHandlers) {
-    try {
-      await handler();
-      console.log(`[shutdown] Completed ${name}`);
-    } catch (error) {
-      console.error(`[shutdown] Failed ${name}:`, error);
-    }
+
+class LifecycleCoordinator {
+  handlers = new Map;
+  running;
+  timeoutMs;
+  constructor(options = {}) {
+    this.timeoutMs = options.timeoutMs ?? resolveShutdownTimeoutMs();
+    if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs <= 0 || this.timeoutMs > 2147483647)
+      throw new RangeError("Shutdown timeout must be an integer between 1 and 2147483647.");
+  }
+  get isShuttingDown() {
+    return this.running !== undefined;
+  }
+  register(name, handler, phase = "close") {
+    if (this.isShuttingDown)
+      throw new Error("Cannot register resources during shutdown.");
+    if (!["stop", "drain", "flush", "close", "force"].includes(phase))
+      throw new TypeError("Unknown shutdown phase.");
+    const registration = { name, handler, phase };
+    this.handlers.set(name, registration);
+    return () => {
+      if (this.handlers.get(name) === registration)
+        this.handlers.delete(name);
+    };
   }
-}
-function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
-  if (shutdownInstalled) {
-    return;
+  shutdown(reason = "MANUAL") {
+    if (this.running)
+      return this.running;
+    this.running = Promise.resolve().then(() => this.execute(reason));
+    return this.running;
   }
-  shutdownInstalled = true;
-  for (const signal of signals) {
-    process.on(signal, () => {
-      runGracefulShutdown(signal).finally(() => {
-        process.exit(0);
-      });
+  async execute(reason) {
+    const registrations = [...this.handlers.values()];
+    const controller = new AbortController;
+    const context = { signal: controller.signal, reason };
+    const errors = [];
+    let timedOut = false;
+    let forced = false;
+    const record = (entry, error) => {
+      errors.push({ name: entry.name, phase: entry.phase, error });
+      console.error(`[shutdown] Failed ${entry.phase}:${entry.name}:`, error);
+    };
+    const force = () => {
+      if (forced)
+        return;
+      forced = true;
+      for (const entry of registrations.filter((entry) => entry.phase === "force")) {
+        try {
+          Promise.resolve(entry.handler(context)).catch((error) => record(entry, error));
+        } catch (error) {
+          record(entry, error);
+        }
+      }
+    };
+    let timer;
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        const error = new Error(`Shutdown deadline exceeded after ${this.timeoutMs}ms.`);
+        errors.push({ name: "deadline", phase: "force", error });
+        controller.abort(error);
+        force();
+        resolve();
+      }, this.timeoutMs);
     });
+    const sequence = (async () => {
+      let unsafeToClose = false;
+      for (const phase of ["stop", "drain", "flush", "close"]) {
+        if (controller.signal.aborted)
+          return;
+        if (unsafeToClose && (phase === "flush" || phase === "close")) {
+          controller.abort(new Error("Admission or drain failed; infrastructure remains open."));
+          force();
+          return;
+        }
+        for (const entry of registrations.filter((entry) => entry.phase === phase)) {
+          if (controller.signal.aborted)
+            return;
+          try {
+            await entry.handler(context);
+          } catch (error) {
+            record(entry, error);
+            if (phase === "stop" || phase === "drain")
+              unsafeToClose = true;
+          }
+        }
+      }
+    })();
+    try {
+      await Promise.race([sequence, deadline]);
+    } finally {
+      clearTimeout(timer);
+      this.handlers.clear();
+    }
+    return { successful: errors.length === 0 && !timedOut, timedOut, errors: [...errors] };
   }
 }
+var defaultLifecycle = new LifecycleCoordinator;
+var installations = new Map;
+function registerShutdownHandler(name, handler, phase = "close") {
+  return defaultLifecycle.register(name, handler, phase);
+}
+function runGracefulShutdown(signal) {
+  return defaultLifecycle.shutdown(signal);
+}
+function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"], lifecycle = defaultLifecycle) {
+  const existing = installations.get(lifecycle);
+  if (existing)
+    return existing;
+  let exiting = false;
+  const handler = (signal) => {
+    if (exiting)
+      return;
+    exiting = true;
+    lifecycle.shutdown(signal).then((result) => process.exit(result.successful ? 0 : 1), (error) => {
+      console.error("[shutdown] Coordinator failed:", error);
+      process.exit(1);
+    });
+  };
+  const callbacks = signals.map((signal) => {
+    const callback = () => handler(signal);
+    process.on(signal, callback);
+    return () => process.off(signal, callback);
+  });
+  const uninstall = () => {
+    for (const remove of callbacks)
+      remove();
+    if (installations.get(lifecycle) === uninstall)
+      installations.delete(lifecycle);
+  };
+  installations.set(lifecycle, uninstall);
+  return uninstall;
+}
 function resetGracefulShutdownForTests() {
-  shutdownHandlers.clear();
-  shutdownInstalled = false;
-  shuttingDown = false;
+  for (const remove of [...installations.values()])
+    remove();
+  defaultLifecycle = new LifecycleCoordinator;
 }
 // ../../src/core/logging/requestLoggingMiddleware.ts
 function createRequestLoggingMiddleware() {
@@ -11738,12 +12451,37 @@ class SyncQueue {
 }
 
 class AsyncQueue {
+  active = new Set;
+  closing;
+  closed = false;
+  assertOpen() {
+    if (this.closed)
+      throw new Error("Async queue is closed.");
+  }
+  enqueue(task, onError) {
+    this.assertOpen();
+    const running = new Promise((resolve) => {
+      setTimeout(() => {
+        Promise.resolve().then(task).catch(onError).finally(resolve);
+      }, 0);
+    });
+    this.active.add(running);
+    running.then(() => {
+      this.active.delete(running);
+    });
+  }
   async dispatch(job, payload) {
-    setTimeout(() => {
-      job.handle(payload).catch((error) => {
-        console.error("[AsyncQueue] Job failed:", error);
-      });
-    }, 0);
+    this.enqueue(() => job.handle(payload), (error) => {
+      console.error("[AsyncQueue] Job failed:", error);
+    });
+  }
+  close() {
+    this.closing ??= (async () => {
+      while (this.active.size)
+        await Promise.all([...this.active]);
+      this.closed = true;
+    })();
+    return this.closing;
   }
 }
 function createQueue(driver) {
@@ -11753,7 +12491,7 @@ function createQueue(driver) {
 var failedJobTable = defineTable({
   name: "failed_job",
   primaryKey: "id",
-  columns: ["id", "job_name", "payload", "exception", "failed_at"],
+  columns: ["id", "job_name", "job_id", "payload", "exception", "failed_at"],
   defaultOrderBy: { column: "failed_at", direction: "DESC" }
 });
 
@@ -11774,6 +12512,7 @@ class FailedJobService {
   async recordFailure(input) {
     return await this.repository.create({
       job_name: input.jobName,
+      job_id: input.jobId ?? null,
       payload: input.payload,
       exception: input.exception,
       failed_at: new Date
@@ -11785,8 +12524,11 @@ class FailedJobService {
       orderBy: { column: "failed_at", direction: "DESC" }
     });
   }
-  async retry(id) {
+  async retry(id, enqueue) {
+    if (typeof enqueue !== "function")
+      throw new Error("Failed-job retry requires an admission callback.");
     const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
+    await enqueue(failedJob);
     await this.repository.deleteById(id);
     return failedJob;
   }
@@ -11809,6 +12551,9 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
+// ../../src/core/queue/jobRunner.ts
+import { setTimeout as delay } from "timers/promises";
+
 // ../../src/core/queue/queueConfig.ts
 function resolveQueueConfig() {
   const driver = process.env.QUEUE_DRIVER;
@@ -11831,22 +12576,82 @@ var queueConfig = {
     return resolveQueueConfig().backoffMs;
   }
 };
+function resolveRedisQueueTransport() {
+  const transport = process.env.QUEUE_REDIS_TRANSPORT ?? "lists";
+  if (transport !== "lists" && transport !== "streams")
+    throw new Error('QUEUE_REDIS_TRANSPORT must be "lists" or "streams".');
+  return transport;
+}
+function readQueueVisibilityMs() {
+  const value = Number(process.env.QUEUE_VISIBILITY_MS ?? "60000");
+  if (!Number.isSafeInteger(value) || value < 30)
+    throw new Error("QUEUE_VISIBILITY_MS must be an integer of at least 30 milliseconds.");
+  return value;
+}
 
 // ../../src/core/queue/jobRunner.ts
+function parseQueueJobEnvelope(rawPayload) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    console.error("[QueueWorker] Ignoring malformed queue payload");
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    console.error("[QueueWorker] Ignoring non-object queue payload");
+    return null;
+  }
+  const envelope = parsed;
+  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
+    console.error("[QueueWorker] Ignoring queue payload without job name");
+    return null;
+  }
+  if (!jobRegistry.create(envelope.name)) {
+    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
+    return null;
+  }
+  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
+    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
+    return null;
+  }
+  if (envelope.jobId !== undefined && (typeof envelope.jobId !== "string" || !envelope.jobId.length))
+    return null;
+  if (envelope.attempts !== undefined && (!Number.isSafeInteger(envelope.attempts) || envelope.attempts < 0))
+    return null;
+  if (envelope.deadlineAtMs !== undefined && (!Number.isSafeInteger(envelope.deadlineAtMs) || envelope.deadlineAtMs <= 0))
+    return null;
+  if (envelope.cancellable !== undefined && (typeof envelope.cancellable !== "boolean" || envelope.cancellable && !envelope.jobId))
+    return null;
+  return {
+    ...envelope.cancellable ? { cancellable: true } : {},
+    ...envelope.deadlineAtMs === undefined ? {} : { deadlineAtMs: envelope.deadlineAtMs },
+    jobId: envelope.jobId,
+    name: envelope.name,
+    payload: envelope.payload ?? {},
+    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
+  };
+}
 async function runQueueJob(envelope, failedJobs, options = {}) {
+  options.context?.signal.throwIfAborted();
   const job = jobRegistry.create(envelope.name);
   if (!job) {
     throw new Error(`Unknown job "${envelope.name}".`);
   }
   const attempts = envelope.attempts ?? 0;
   try {
-    await job.handle(envelope.payload);
+    await job.handle(envelope.payload, options.context);
   } catch (error) {
+    options.context?.signal.throwIfAborted();
     const nextAttempt = attempts + 1;
     const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
     if (nextAttempt < maxAttempts) {
       const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
-      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
+      if (options.deferRetry) {
+        await options.deferRetry({ ...envelope, attempts: nextAttempt }, backoffMs * nextAttempt);
+        return;
+      }
+      await delay(backoffMs * nextAttempt, undefined, { signal: options.context?.signal });
       await runQueueJob({
         ...envelope,
         attempts: nextAttempt
@@ -11855,6 +12660,7 @@ async function runQueueJob(envelope, failedJobs, options = {}) {
     }
     await failedJobs.recordFailure({
       jobName: envelope.name,
+      jobId: options.context?.jobId ?? envelope.jobId,
       payload: envelope.payload,
       exception: error instanceof Error ? error.stack ?? error.message : String(error)
     });
@@ -11865,6 +12671,8 @@ async function runQueueJob(envelope, failedJobs, options = {}) {
 
 // ../../src/core/queue/redisQueue.ts
 var {RedisClient: RedisClient4 } = globalThis.Bun;
+
+// ../../src/core/queue/redisQueueKeys.ts
 function queueListKey() {
   return namespacedRedisKey("queue:default");
 }
@@ -11877,21 +12685,10 @@ function queueLowKey() {
 var QUEUE_LIST_KEY = queueListKey();
 var QUEUE_HIGH_KEY = queueHighKey();
 var QUEUE_LOW_KEY = queueLowKey();
-var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
-var DEFAULT_VISIBILITY_MS = 60000;
-function queueProcessingKey(queueKey) {
-  return `${queueKey}:processing`;
-}
-function queueProcessingLeaseKey(queueKey) {
-  return `${queueKey}:processing:leases`;
-}
-function readVisibilityMs() {
-  const parsed = Number(process.env.QUEUE_VISIBILITY_MS ?? String(DEFAULT_VISIBILITY_MS));
-  if (!Number.isSafeInteger(parsed) || parsed < 30) {
-    throw new Error("QUEUE_VISIBILITY_MS must be an integer of at least 30 milliseconds.");
-  }
-  return parsed;
+function defaultQueueKeys() {
+  return [queueHighKey(), queueListKey(), queueLowKey()];
 }
+var QUEUE_KEYS = defaultQueueKeys();
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
@@ -11902,36 +12699,557 @@ function queueKeyForPriority(priority = "default") {
       return queueListKey();
   }
 }
-function parseQueueJobEnvelope(rawPayload) {
-  let parsed;
+
+// ../../src/core/queue/redisStreams.ts
+var {RedisClient: RedisClient3 } = globalThis.Bun;
+var STREAM_GROUP = "strata-workers-v1";
+function streamQueueKey(queueKey) {
+  return `${queueKey}:stream`;
+}
+function streamDeadLetterKey(queueKey) {
+  return `${streamQueueKey(queueKey)}:invalid`;
+}
+function streamRetryKey(queueKey) {
+  return `${streamQueueKey(queueKey)}:retries`;
+}
+function streamControlKey(key, jobId) {
+  const prefix = `${streamQueueKey(key)}/`;
+  if (!jobId.startsWith(prefix) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(jobId.slice(prefix.length)))
+    throw new Error("Invalid cancellable Streams job ID");
+  return `${streamQueueKey(key)}:control:${jobId.slice(prefix.length)}`;
+}
+var ENQUEUE_CONTROLLED = `
+local kind = redis.call('TYPE', KEYS[1]).ok
+if kind ~= 'none' and kind ~= 'stream' then return redis.error_reply('Invalid stream admission key type') end
+if redis.call('EXISTS', KEYS[2]) ~= 0 then return redis.error_reply('Streams control identity already exists') end
+redis.call('XADD', KEYS[1], '*', 'payload', ARGV[1])
+redis.call('HSET', KEYS[2], 'state', 'active')
+return 1
+`;
+var CANCEL_STREAM = `
+local state = redis.call('HGET', KEYS[1], 'state')
+if not state then return 0 end
+local kind = redis.call('TYPE', KEYS[2]).ok
+if kind ~= 'none' and kind ~= 'zset' then return redis.error_reply('Invalid stream retry key type') end
+local payload = redis.call('HGET', KEYS[1], 'retryPayload')
+if payload and redis.call('ZSCORE', KEYS[2], payload) then redis.call('ZADD', KEYS[2], 0, payload) end
+redis.call('HSET', KEYS[1], 'state', 'cancelled')
+return 1
+`;
+async function cancelStreamJob(client, key, jobId) {
+  return Number(await client.send("EVAL", [
+    CANCEL_STREAM,
+    "2",
+    streamControlKey(key, jobId),
+    streamRetryKey(key)
+  ])) === 1;
+}
+async function readStreamCancellation(client, controlKey) {
+  const state = await client.send("HGET", [controlKey, "state"]);
+  if (state !== "active" && state !== "cancelled")
+    throw new Error("Missing or invalid Streams control state");
+  return state === "cancelled";
+}
+var MAX_TIMER_MS = 2147483647;
+async function readStreamTime(client) {
+  const value = await client.send("TIME", []);
+  if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== "string" || typeof value[1] !== "string" || !/^\d+$/.test(value[0]) || !/^\d+$/.test(value[1]))
+    throw new Error("Invalid Redis TIME response");
+  const seconds = Number(value[0]);
+  const micros = Number(value[1]);
+  const now = seconds * 1000 + Math.floor(micros / 1000);
+  if (!Number.isSafeInteger(seconds) || seconds < 0 || !Number.isSafeInteger(micros) || micros < 0 || micros >= 1e6 || !Number.isSafeInteger(now))
+    throw new Error("Invalid Redis TIME response");
+  return now;
+}
+function watchStreamDeadline(client, deadlineAtMs, remainingMs, expire, fail) {
+  let stopped = false;
+  let timer;
+  const schedule = (remaining) => {
+    timer = setTimeout(() => {
+      (async () => {
+        try {
+          const remaining = deadlineAtMs - await readStreamTime(client);
+          if (stopped)
+            return;
+          if (remaining <= 0)
+            expire();
+          else
+            schedule(remaining);
+        } catch (error) {
+          if (!stopped)
+            fail(error);
+        }
+      })();
+    }, Math.max(1, Math.min(MAX_TIMER_MS, remaining)));
+  };
+  schedule(remainingMs);
+  return () => {
+    stopped = true;
+    clearTimeout(timer);
+  };
+}
+var SCHEDULE_RETRY = `
+local pending = redis.call('XPENDING', KEYS[1], ARGV[1], ARGV[2], ARGV[2], 1)
+if #pending == 0 or pending[1][2] ~= ARGV[3] or tonumber(pending[1][3]) >= tonumber(ARGV[4]) then return 0 end
+local kind = redis.call('TYPE', KEYS[2]).ok
+if kind ~= 'none' and kind ~= 'zset' then return redis.error_reply('Invalid stream retry key type') end
+if ARGV[8] == '1' then
+  local state = redis.call('HGET', KEYS[3], 'state')
+  if state == 'cancelled' then return redis.error_reply('Streams job cancelled') end
+  if state ~= 'active' then return redis.error_reply('Missing or invalid Streams control state') end
+end
+local now = redis.call('TIME')
+local due = tonumber(now[1])*1000 + math.floor(tonumber(now[2])/1000) + tonumber(ARGV[5])
+if ARGV[7] ~= '' then due = math.min(due, tonumber(ARGV[7])) end
+redis.call('ZADD', KEYS[2], due, ARGV[6])
+if ARGV[8] == '1' then redis.call('HSET', KEYS[3], 'retryPayload', ARGV[6]) end
+redis.call('XACK', KEYS[1], ARGV[1], ARGV[2])
+redis.call('XDEL', KEYS[1], ARGV[2])
+if #redis.call('XPENDING', KEYS[1], ARGV[1], '-', '+', 1, ARGV[3]) == 0 then redis.call('XGROUP', 'DELCONSUMER', KEYS[1], ARGV[1], ARGV[3]) end
+return 1
+`;
+var PROMOTE_RETRIES = `
+local kinds = {'stream','zset'}
+for i=1,2 do
+  local kind = redis.call('TYPE', KEYS[i]).ok
+  if kind ~= 'none' and kind ~= kinds[i] then return redis.error_reply('Invalid stream retry promotion key type') end
+end
+local now = redis.call('TIME')
+local due = tonumber(now[1])*1000 + math.floor(tonumber(now[2])/1000)
+local entries = redis.call('ZRANGE', KEYS[2], '-inf', due, 'BYSCORE', 'LIMIT', 0, 100)
+for _, payload in ipairs(entries) do
+  redis.call('XADD', KEYS[1], '*', 'payload', payload)
+  redis.call('ZREM', KEYS[2], payload)
+end
+return #entries
+`;
+async function scheduleStreamRetry(client, key, reservation, envelope, delayMs) {
+  if (!Number.isSafeInteger(delayMs) || delayMs < 0 || delayMs > Number.MAX_SAFE_INTEGER / 2)
+    throw new Error("Invalid Streams retry delay");
+  const scheduled = await client.send("EVAL", [
+    SCHEDULE_RETRY,
+    "3",
+    streamQueueKey(key),
+    streamRetryKey(key),
+    envelope.cancellable ? streamControlKey(key, envelope.jobId ?? "") : streamQueueKey(key),
+    STREAM_GROUP,
+    reservation.id,
+    reservation.owner,
+    String(readQueueVisibilityMs()),
+    String(delayMs),
+    JSON.stringify(envelope),
+    envelope.deadlineAtMs === undefined ? "" : String(envelope.deadlineAtMs),
+    envelope.cancellable ? "1" : "0"
+  ]);
+  if (Number(scheduled) !== 1)
+    throw new Error("Queue lease lost while scheduling retry");
+}
+async function promoteStreamRetries(client, key) {
+  return Number(await client.send("EVAL", [PROMOTE_RETRIES, "2", streamQueueKey(key), streamRetryKey(key)]));
+}
+async function readStreamQueueDepth(client, key) {
+  return Number(await client.send("EVAL", [
+    "return redis.call('XLEN', KEYS[1]) + redis.call('ZCARD', KEYS[2])",
+    "2",
+    streamQueueKey(key),
+    streamRetryKey(key)
+  ]));
+}
+var ASSERT_DRAINED = `
+if redis.call('LLEN', KEYS[1]) > 0 or redis.call('LLEN', KEYS[2]) > 0 or redis.call('HLEN', KEYS[3]) > 0 then
+  return redis.error_reply('Legacy queue state requires maintenance conversion before Streams activation')
+end
+return 1
+`;
+async function assertLegacyDrained(client, key) {
+  await client.send("EVAL", [
+    ASSERT_DRAINED,
+    "3",
+    key,
+    `${key}:processing`,
+    `${key}:processing:leases`
+  ]);
+}
+var UPDATE_STREAM = `
+local pending = redis.call('XPENDING', KEYS[1], ARGV[1], ARGV[2], ARGV[2], 1)
+if #pending == 0 or pending[1][2] ~= ARGV[3] or tonumber(pending[1][3]) >= tonumber(ARGV[4]) then return 0 end
+if ARGV[7] == '1' then
+  local kind = redis.call('TYPE', KEYS[3]).ok
+  if kind ~= 'none' and kind ~= 'hash' then return redis.error_reply('Invalid stream control key type') end
+end
+if ARGV[5] == 'renew' then
+  local claimed = redis.call('XCLAIM', KEYS[1], ARGV[1], ARGV[3], 0, ARGV[2], 'JUSTID')
+  return #claimed
+end
+if ARGV[5] == 'quarantine' then
+  local kind = redis.call('TYPE', KEYS[2]).ok
+  if kind ~= 'none' and kind ~= 'stream' then return redis.error_reply('Invalid stream quarantine key type') end
+  redis.call('XADD', KEYS[2], '*', 'sourceId', ARGV[2], 'payload', ARGV[6])
+end
+local acknowledged = redis.call('XACK', KEYS[1], ARGV[1], ARGV[2])
+if acknowledged == 1 then
+  redis.call('XDEL', KEYS[1], ARGV[2])
+  if ARGV[7] == '1' then redis.call('DEL', KEYS[3]) end
+end
+if #redis.call('XPENDING', KEYS[1], ARGV[1], '-', '+', 1, ARGV[3]) == 0 then redis.call('XGROUP', 'DELCONSUMER', KEYS[1], ARGV[1], ARGV[3]) end
+return acknowledged
+`;
+var CLAIM_STREAM = `
+local window = redis.call('XPENDING', KEYS[1], ARGV[1], ARGV[4], '+', 10)
+local claimed = redis.call('XAUTOCLAIM', KEYS[1], ARGV[1], ARGV[2], ARGV[3], ARGV[4], 'COUNT', 1)
+for _, entry in ipairs(window) do
+  if entry[2] ~= ARGV[2] and #redis.call('XPENDING', KEYS[1], ARGV[1], '-', '+', 1, entry[2]) == 0 then redis.call('XGROUP', 'DELCONSUMER', KEYS[1], ARGV[1], entry[2]) end
+end
+if #redis.call('XPENDING', KEYS[1], ARGV[1], '-', '+', 1, ARGV[2]) == 0 then redis.call('XGROUP', 'DELCONSUMER', KEYS[1], ARGV[1], ARGV[2]) end
+return claimed
+`;
+var READ_STREAM = `
+local entries = redis.call('XREADGROUP', 'GROUP', ARGV[1], ARGV[2], 'COUNT', 1, 'STREAMS', KEYS[1], '>')
+if not entries and #redis.call('XPENDING', KEYS[1], ARGV[1], '-', '+', 1, ARGV[2]) == 0 then redis.call('XGROUP', 'DELCONSUMER', KEYS[1], ARGV[1], ARGV[2]) end
+return entries
+`;
+async function ensureStreamGroup(client, key) {
+  await assertLegacyDrained(client, key);
   try {
-    parsed = JSON.parse(rawPayload);
-  } catch {
-    console.error("[QueueWorker] Ignoring malformed queue payload");
-    return null;
+    await client.send("XGROUP", ["CREATE", streamQueueKey(key), STREAM_GROUP, "0", "MKSTREAM"]);
+  } catch (error) {
+    if (!(error instanceof Error) || !error.message.includes("BUSYGROUP"))
+      throw error;
   }
-  if (!parsed || typeof parsed !== "object") {
-    console.error("[QueueWorker] Ignoring non-object queue payload");
-    return null;
+}
+function readStreamEntry(value, owner) {
+  if (!Array.isArray(value) || typeof value[0] !== "string" || !Array.isArray(value[1]))
+    throw new Error("Invalid Redis stream entry response");
+  const fields = value[1];
+  let payload;
+  for (let index = 0;index < fields.length; index += 2) {
+    if (fields[index] === "payload" && typeof fields[index + 1] === "string")
+      payload = fields[index + 1];
   }
-  const envelope = parsed;
-  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
-    console.error("[QueueWorker] Ignoring queue payload without job name");
-    return null;
+  return { id: value[0], owner, payload: payload ?? "" };
+}
+async function updateStreamReservation(client, key, reservation, action, controlKey) {
+  return Number(await client.send("EVAL", [
+    UPDATE_STREAM,
+    "3",
+    streamQueueKey(key),
+    streamDeadLetterKey(key),
+    controlKey ?? streamQueueKey(key),
+    STREAM_GROUP,
+    reservation.id,
+    reservation.owner,
+    String(readQueueVisibilityMs()),
+    action,
+    reservation.payload,
+    controlKey ? "1" : "0"
+  ])) === 1;
+}
+async function reserveStreamJob(client, key, owner, cursor = "0-0") {
+  const claimed = await client.send("EVAL", [
+    CLAIM_STREAM,
+    "1",
+    streamQueueKey(key),
+    STREAM_GROUP,
+    owner,
+    String(readQueueVisibilityMs()),
+    cursor
+  ]);
+  if (!Array.isArray(claimed) || typeof claimed[0] !== "string" || !Array.isArray(claimed[1]))
+    throw new Error("Invalid Redis XAUTOCLAIM response");
+  const nextCursor = claimed[0];
+  if (claimed[1].length > 0)
+    return { reservation: readStreamEntry(claimed[1][0], owner), cursor: nextCursor };
+  const fresh = await client.send("EVAL", [
+    READ_STREAM,
+    "1",
+    streamQueueKey(key),
+    STREAM_GROUP,
+    owner
+  ]);
+  if (fresh === null)
+    return { reservation: null, cursor: nextCursor };
+  if (!Array.isArray(fresh) || !Array.isArray(fresh[0]) || !Array.isArray(fresh[0][1]))
+    throw new Error("Invalid Redis XREADGROUP response");
+  return { reservation: readStreamEntry(fresh[0][1][0], owner), cursor: nextCursor };
+}
+
+class RedisStreamsQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient3(redisUrl);
   }
-  if (!jobRegistry.create(envelope.name)) {
-    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
-    return null;
+  close() {
+    this.client.close();
   }
-  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
-    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
-    return null;
+  async dispatch(job, payload) {
+    await this.enqueue(job, payload);
+  }
+  async enqueue(job, payload, options = {}) {
+    return this.admit(job, payload, options);
+  }
+  async replay(job, payload, jobId) {
+    const prefix = defaultQueueKeys().find((key) => jobId.startsWith(`${streamQueueKey(key)}/`));
+    if (!prefix || !/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9]+-[0-9]+)$/.test(jobId.slice(streamQueueKey(prefix).length + 1)))
+      throw new Error("Replay identity does not belong to this Streams namespace");
+    await this.admit(job, payload, {}, jobId);
+  }
+  async admit(job, payload, options, replayId) {
+    if (options.cancellable !== undefined && typeof options.cancellable !== "boolean")
+      throw new Error("cancellable must be a boolean");
+    if (options.timeoutMs !== undefined && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > MAX_TIMER_MS))
+      throw new Error("Streams timeoutMs must be an integer between 1 and 2147483647");
+    const name = jobRegistry.resolveName(job);
+    if (!name)
+      throw new Error("Job is not registered with the queue worker registry.");
+    const key = queueKeyForPriority(job.priority);
+    await assertLegacyDrained(this.client, key);
+    const jobId = replayId ?? `${streamQueueKey(key)}/${crypto.randomUUID()}`;
+    const deadlineAtMs = options.timeoutMs === undefined ? undefined : await readStreamTime(this.client) + options.timeoutMs;
+    const envelope = JSON.stringify({
+      name,
+      payload,
+      attempts: 0,
+      jobId,
+      deadlineAtMs,
+      ...options.cancellable ? { cancellable: true } : {}
+    });
+    if (options.cancellable)
+      await this.client.send("EVAL", [
+        ENQUEUE_CONTROLLED,
+        "2",
+        streamQueueKey(key),
+        streamControlKey(key, jobId),
+        envelope
+      ]);
+    else
+      await this.client.send("XADD", [streamQueueKey(key), "*", "payload", envelope]);
+    return jobId;
+  }
+  async cancel(jobId) {
+    const key = defaultQueueKeys().find((key) => jobId.startsWith(`${streamQueueKey(key)}/`));
+    if (!key)
+      throw new Error("Invalid cancellable Streams job ID");
+    return cancelStreamJob(this.client, key, jobId);
   }
-  return {
-    name: envelope.name,
-    payload: envelope.payload ?? {},
-    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
-  };
+}
+
+class RedisStreamsWorker {
+  failedJobs;
+  timeoutSeconds;
+  queueKeys;
+  client;
+  owner = crypto.randomUUID();
+  cursors = new Map;
+  processing = false;
+  initialized = false;
+  running = false;
+  stopping = false;
+  active;
+  constructor(redisUrl, failedJobs, timeoutSeconds = 5, queueKeys = defaultQueueKeys()) {
+    this.failedJobs = failedJobs;
+    this.timeoutSeconds = timeoutSeconds;
+    this.queueKeys = queueKeys;
+    readQueueVisibilityMs();
+    this.client = new RedisClient3(redisUrl);
+  }
+  requestStop() {
+    this.stopping = true;
+  }
+  isRunning() {
+    return this.running;
+  }
+  close() {
+    this.stopping = true;
+    this.active?.abort(new Error("Queue worker closed"));
+    this.client.close();
+  }
+  async initialize() {
+    if (this.initialized)
+      return;
+    for (const key of this.queueKeys)
+      await ensureStreamGroup(this.client, key);
+    this.initialized = true;
+  }
+  async reserve(key) {
+    await promoteStreamRetries(this.client, key);
+    const result = await reserveStreamJob(this.client, key, this.owner, this.cursors.get(key));
+    this.cursors.set(key, result.cursor);
+    return result.reservation;
+  }
+  async processNext() {
+    if (this.processing)
+      throw new Error("Queue worker already processing a job.");
+    this.processing = true;
+    try {
+      return await this.processOne();
+    } finally {
+      this.processing = false;
+    }
+  }
+  async processOne() {
+    if (this.stopping)
+      return false;
+    await this.initialize();
+    const deadline = performance.now() + this.timeoutSeconds * 1000;
+    do {
+      for (const key of this.queueKeys) {
+        if (this.stopping)
+          return false;
+        const reservation = await this.reserve(key);
+        if (!reservation)
+          continue;
+        await this.handle(key, reservation);
+        return true;
+      }
+      if (performance.now() >= deadline || this.stopping)
+        return false;
+      await Bun.sleep(Math.min(100, Math.max(1, deadline - performance.now())));
+    } while (!this.stopping);
+    return false;
+  }
+  async handle(key, reservation) {
+    const envelope = parseQueueJobEnvelope(reservation.payload);
+    if (!envelope) {
+      await updateStreamReservation(this.client, key, reservation, "quarantine");
+      return;
+    }
+    envelope.jobId ??= `${streamQueueKey(key)}/${reservation.id}`;
+    let controlKey;
+    if (envelope.cancellable) {
+      try {
+        controlKey = streamControlKey(key, envelope.jobId);
+      } catch {
+        await updateStreamReservation(this.client, key, reservation, "quarantine");
+        return;
+      }
+    }
+    const cancellationError = new Error("Streams job cancelled");
+    if (controlKey && await readStreamCancellation(this.client, controlKey)) {
+      await this.failedJobs.recordFailure({
+        jobName: envelope.name,
+        jobId: envelope.jobId,
+        payload: envelope.payload,
+        exception: cancellationError.message
+      });
+      await updateStreamReservation(this.client, key, reservation, "ack", controlKey);
+      return;
+    }
+    const remainingMs = envelope.deadlineAtMs === undefined ? undefined : envelope.deadlineAtMs - await readStreamTime(this.client);
+    const deadlineError = new Error("Streams job deadline exceeded");
+    if (remainingMs !== undefined && remainingMs <= 0) {
+      await this.failedJobs.recordFailure({
+        jobName: envelope.name,
+        jobId: envelope.jobId,
+        payload: envelope.payload,
+        exception: deadlineError.message
+      });
+      await updateStreamReservation(this.client, key, reservation, "ack", controlKey);
+      return;
+    }
+    const controller = new AbortController;
+    this.active = controller;
+    let acknowledge = false;
+    let released = false;
+    let ownershipLost = false;
+    let renewal;
+    let deadlineExpired = false;
+    let cancellationRequested = false;
+    let failureRecorded = false;
+    const loseOwnership = (error) => {
+      ownershipLost = true;
+      controller.abort(error);
+    };
+    const stopDeadlineWatch = remainingMs === undefined || envelope.deadlineAtMs === undefined ? undefined : watchStreamDeadline(this.client, envelope.deadlineAtMs, remainingMs, () => {
+      deadlineExpired = true;
+      controller.abort(deadlineError);
+    }, loseOwnership);
+    const heartbeat = setInterval(() => {
+      if (renewal || ownershipLost || released)
+        return;
+      renewal = (async () => {
+        try {
+          if (!await updateStreamReservation(this.client, key, reservation, "renew", controlKey))
+            loseOwnership(new Error("Queue lease lost"));
+          else if (controlKey && await readStreamCancellation(this.client, controlKey)) {
+            cancellationRequested = true;
+            controller.abort(cancellationError);
+          }
+        } catch (error) {
+          loseOwnership(error);
+          console.error("[StreamsWorker] Lease renewal failed:", error);
+        }
+      })().finally(() => {
+        renewal = undefined;
+      });
+    }, Math.max(1, Math.floor(readQueueVisibilityMs() / 3)));
+    try {
+      await runQueueJob(envelope, this.failedJobs, {
+        context: {
+          jobId: envelope.jobId,
+          signal: controller.signal,
+          deadlineAtMs: envelope.deadlineAtMs
+        },
+        deferRetry: async (next, delayMs) => {
+          controller.signal.throwIfAborted();
+          await scheduleStreamRetry(this.client, key, reservation, next, delayMs);
+          released = true;
+        },
+        onFailureRecorded: () => {
+          acknowledge = true;
+          failureRecorded = true;
+        }
+      });
+      acknowledge = true;
+    } catch (error) {
+      console.error("[StreamsWorker] Job failed:", error);
+    } finally {
+      stopDeadlineWatch?.();
+      clearInterval(heartbeat);
+      await renewal;
+      this.active = undefined;
+    }
+    if (!ownershipLost && !released && controlKey && (cancellationRequested || await readStreamCancellation(this.client, controlKey))) {
+      if (!failureRecorded)
+        await this.failedJobs.recordFailure({
+          jobName: envelope.name,
+          jobId: envelope.jobId,
+          payload: envelope.payload,
+          exception: cancellationError.message
+        });
+      failureRecorded = true;
+      acknowledge = true;
+    }
+    if (!ownershipLost && !released && envelope.deadlineAtMs !== undefined && (deadlineExpired || envelope.deadlineAtMs <= await readStreamTime(this.client))) {
+      if (!failureRecorded)
+        await this.failedJobs.recordFailure({
+          jobName: envelope.name,
+          jobId: envelope.jobId,
+          payload: envelope.payload,
+          exception: deadlineError.message
+        });
+      acknowledge = true;
+    }
+    if (acknowledge && !ownershipLost && !released)
+      await updateStreamReservation(this.client, key, reservation, "ack", controlKey);
+  }
+  async run() {
+    this.running = true;
+    try {
+      while (!this.stopping)
+        await this.processNext();
+    } finally {
+      this.running = false;
+    }
+  }
+}
+
+// ../../src/core/queue/redisQueue.ts
+function queueProcessingKey(queueKey) {
+  return `${queueKey}:processing`;
+}
+function queueProcessingLeaseKey(queueKey) {
+  return `${queueKey}:processing:leases`;
 }
 var SCRIPT_HEADER = `
 local function checkType(key, expected)
@@ -12020,7 +13338,7 @@ async function reserveQueueJob(client, queueKey, owner) {
     queueProcessingLeaseKey(queueKey),
     crypto.randomUUID(),
     owner,
-    String(readVisibilityMs())
+    String(readQueueVisibilityMs())
   ]);
   if (typeof raw !== "string")
     return null;
@@ -12038,7 +13356,7 @@ async function updateQueueReservation(client, queueKey, reservation, action) {
     reservation.owner,
     reservation.record,
     action,
-    String(readVisibilityMs()),
+    String(readQueueVisibilityMs()),
     reservation.payload
   ])) === 1;
 }
@@ -12051,7 +13369,7 @@ async function reclaimExpiredQueueReservations(client, queueKeys = QUEUE_KEYS) {
       key,
       queueProcessingKey(key),
       queueProcessingLeaseKey(key),
-      String(readVisibilityMs())
+      String(readQueueVisibilityMs())
     ]));
   }
   return reclaimed;
@@ -12062,6 +13380,9 @@ class RedisQueue {
   constructor(redisUrl) {
     this.client = new RedisClient4(redisUrl);
   }
+  close() {
+    this.client.close();
+  }
   async dispatch(job, payload) {
     const name = jobRegistry.resolveName(job);
     if (!name) {
@@ -12144,7 +13465,7 @@ class QueueWorker {
       })().finally(() => {
         renewal = undefined;
       });
-    }, Math.max(1, Math.floor(readVisibilityMs() / 3)));
+    }, Math.max(1, Math.floor(readQueueVisibilityMs() / 3)));
     try {
       await runQueueJob(envelope, this.failedJobs, {
         onFailureRecorded: () => {
@@ -12179,14 +13500,16 @@ class QueueWorker {
 }
 
 // ../../src/core/queue/resilientQueue.ts
-class ResilientQueue {
+class ResilientQueue extends AsyncQueue {
   failedJobs;
   asyncDispatch;
   constructor(failedJobs, asyncDispatch = false) {
+    super();
     this.failedJobs = failedJobs;
     this.asyncDispatch = asyncDispatch;
   }
   async dispatch(job, payload) {
+    this.assertOpen();
     const name = jobRegistry.resolveName(job);
     if (!name) {
       throw new Error("Job is not registered with the queue worker registry.");
@@ -12197,11 +13520,9 @@ class ResilientQueue {
       attempts: 0
     };
     if (this.asyncDispatch) {
-      setTimeout(() => {
-        runQueueJob(envelope, this.failedJobs).catch((error) => {
-          console.error("[ResilientQueue] Job failed:", error);
-        });
-      }, 0);
+      this.enqueue(() => runQueueJob(envelope, this.failedJobs), (error) => {
+        console.error("[ResilientQueue] Job failed:", error);
+      });
       return;
     }
     await runQueueJob(envelope, this.failedJobs);
@@ -12222,22 +13543,30 @@ function createProductionQueue(driver, options = {}) {
     if (!options.redisUrl) {
       throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
     }
-    return new RedisQueue(options.redisUrl);
+    return resolveRedisQueueTransport() === "streams" ? new RedisStreamsQueue(options.redisUrl) : new RedisQueue(options.redisUrl);
   }
   return new ResilientQueue(failedJobs, driver === "async");
 }
 function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
-  return new QueueWorker(redisUrl, failedJobs);
+  return resolveRedisQueueTransport() === "streams" ? new RedisStreamsWorker(redisUrl, failedJobs) : new QueueWorker(redisUrl, failedJobs);
 }
 // ../../src/core/queue/queueMetrics.ts
 var {RedisClient: RedisClient5 } = globalThis.Bun;
 async function readRedisQueueDepth(redisUrl) {
   const client = new RedisClient5(redisUrl);
-  const [high, defaultQueue, low] = await Promise.all([
-    client.llen(QUEUE_HIGH_KEY),
-    client.llen(QUEUE_LIST_KEY),
-    client.llen(QUEUE_LOW_KEY)
-  ]);
+  let high;
+  let defaultQueue;
+  let low;
+  try {
+    const readDepth = async (key) => resolveRedisQueueTransport() === "streams" ? readStreamQueueDepth(client, key) : client.llen(key);
+    [high, defaultQueue, low] = await Promise.all([
+      readDepth(defaultQueueKeys()[0]),
+      readDepth(defaultQueueKeys()[1]),
+      readDepth(defaultQueueKeys()[2])
+    ]);
+  } finally {
+    client.close();
+  }
   return {
     high: Number(high ?? 0),
     default: Number(defaultQueue ?? 0),
@@ -12280,6 +13609,149 @@ async function collectQueueMetrics() {
     failedCount
   };
 }
+// ../../src/core/scheduler/schedule.ts
+import { createHash as createHash6 } from "crypto";
+
+// ../../src/core/scheduler/leases.ts
+import { createHash as createHash5 } from "crypto";
+var {RedisClient: RedisClient6 } = globalThis.Bun;
+var LEASE_SCRIPT = `
+for _, key in ipairs(KEYS) do
+  local kind = redis.call('TYPE', key).ok
+  if kind ~= 'none' and kind ~= 'string' then return redis.error_reply('Unexpected scheduler key type') end
+end
+local action = ARGV[1]
+local token = ARGV[2]
+local ttl = tonumber(ARGV[3])
+if action == 'acquire' then
+  if redis.call('EXISTS', KEYS[3]) == 1 or redis.call('EXISTS', KEYS[1]) == 1 or redis.call('EXISTS', KEYS[2]) == 1 then return 0 end
+  redis.call('SET', KEYS[1], token, 'PX', ttl)
+  redis.call('SET', KEYS[2], token, 'PX', ttl)
+  return 1
+end
+if redis.call('GET', KEYS[1]) ~= token or redis.call('GET', KEYS[2]) ~= token then return 0 end
+if action == 'renew' then
+  redis.call('PEXPIRE', KEYS[1], ttl)
+  redis.call('PEXPIRE', KEYS[2], ttl)
+elseif action == 'complete' then
+  redis.call('SET', KEYS[3], 'completed', 'PX', ttl)
+  redis.call('DEL', KEYS[1], KEYS[2])
+elseif action == 'release' then
+  redis.call('DEL', KEYS[1], KEYS[2])
+else return redis.error_reply('Unexpected scheduler action') end
+return 1
+`;
+
+class RedisSchedulerLeaseStore {
+  client;
+  owned;
+  namespace;
+  timeoutMs;
+  constructor(options) {
+    this.namespace = options.namespace.trim();
+    if (!this.namespace || this.namespace.length > 512)
+      throw new TypeError("Invalid scheduler namespace.");
+    this.timeoutMs = options.commandTimeoutMs ?? 1000;
+    if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1 || this.timeoutMs > 60000)
+      throw new RangeError("Invalid scheduler command timeout.");
+    if (options.client)
+      this.client = options.client;
+    else {
+      const client = new RedisClient6(options.redisUrl, { autoReconnect: false, maxRetries: 0 });
+      this.owned = client;
+      this.client = client;
+    }
+  }
+  keys(lease) {
+    const task = createHash5("sha256").update(JSON.stringify([this.namespace, lease.taskId])).digest("hex");
+    const occurrence = createHash5("sha256").update(lease.occurrenceId).digest("hex");
+    const prefix = `scheduler:{${task}}`;
+    return [
+      `${prefix}:active`,
+      `${prefix}:occurrence:${occurrence}`,
+      `${prefix}:completed:${occurrence}`
+    ];
+  }
+  async execute(action, lease, ttl) {
+    if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > 2147483647)
+      throw new RangeError("Invalid scheduler TTL.");
+    let timer;
+    try {
+      const result = await Promise.race([
+        this.client.send("EVAL", [
+          LEASE_SCRIPT,
+          "3",
+          ...this.keys(lease),
+          action,
+          lease.token,
+          String(ttl)
+        ]),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error("Scheduler store deadline exceeded.")), this.timeoutMs);
+        })
+      ]);
+      if (result !== 0 && result !== 1)
+        throw new Error("Invalid scheduler store response.");
+      return result === 1;
+    } catch (error) {
+      this.owned?.close();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  acquire(lease, leaseMs) {
+    return this.execute("acquire", lease, leaseMs);
+  }
+  renew(lease, leaseMs) {
+    return this.execute("renew", lease, leaseMs);
+  }
+  complete(lease, retentionMs) {
+    return this.execute("complete", lease, retentionMs);
+  }
+  async release(lease) {
+    await this.execute("release", lease, 1);
+  }
+  close() {
+    this.owned?.close();
+  }
+}
+
+class SingleRunnerLeaseStore {
+  tasks = new Map;
+  async acquire(lease, leaseMs) {
+    const task = this.tasks.get(lease.taskId) ?? { expires: 0 };
+    if (task.active && task.expires > performance.now())
+      return false;
+    if ((task.completed ?? -Infinity) >= Number(lease.occurrenceId))
+      return false;
+    task.active = lease;
+    task.expires = performance.now() + leaseMs;
+    this.tasks.set(lease.taskId, task);
+    return true;
+  }
+  async renew(lease, leaseMs) {
+    const task = this.tasks.get(lease.taskId);
+    if (!task || task.active?.token !== lease.token || task.expires <= performance.now())
+      return false;
+    task.expires = performance.now() + leaseMs;
+    return true;
+  }
+  async complete(lease) {
+    const task = this.tasks.get(lease.taskId);
+    if (!task || task.active?.token !== lease.token || task.expires <= performance.now())
+      return false;
+    task.completed = Number(lease.occurrenceId);
+    task.active = undefined;
+    return true;
+  }
+  async release(lease) {
+    const task = this.tasks.get(lease.taskId);
+    if (task?.active?.token === lease.token)
+      task.active = undefined;
+  }
+}
+
 // ../../src/core/scheduler/osCron.ts
 function parseScheduleExpression(expression, from = new Date) {
   return Bun.cron.parse(expression, from);
@@ -12310,11 +13782,25 @@ function assertScheduleExpression(expression) {
 }
 
 // ../../src/core/scheduler/schedule.ts
+class SchedulerLeaseLostError extends Error {
+  constructor(taskName, options) {
+    super(`Scheduler lease lost for task ${taskName}.`, options);
+    this.name = "SchedulerLeaseLostError";
+  }
+}
+
 class Schedule {
   tasks = [];
   command(expression, name, run) {
     assertScheduleExpression(expression);
-    this.tasks.push({ expression, name, run });
+    if (typeof run !== "function")
+      throw new TypeError("Scheduled task handler must be a function.");
+    const normalized = name.trim();
+    if (!normalized || normalized.length > 200 || this.tasks.some((task) => task.name === normalized))
+      throw new TypeError("Scheduled task names must be nonempty and unique (at most 200 characters).");
+    if (this.tasks.length >= 4096)
+      throw new RangeError("A schedule supports at most 4096 tasks.");
+    this.tasks.push({ expression, name: normalized, run });
     return this;
   }
   dueTasks(now = new Date) {
@@ -12325,12 +13811,125 @@ class Schedule {
   }
 }
 var appSchedule = new Schedule;
-async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
+var localStores = new WeakMap;
+function bounded(value, min, max, name) {
+  if (!Number.isSafeInteger(value) || value < min || value > max)
+    throw new RangeError(`Invalid scheduler ${name}.`);
+  return value;
+}
+async function runDueScheduledTasks(schedule = appSchedule, now = new Date, options = {}) {
+  const timestamp = now.getTime();
+  if (!Number.isFinite(timestamp))
+    throw new TypeError("Invalid scheduler date.");
   const due = schedule.dueTasks(now);
-  for (const task of due) {
-    await task.run();
+  if (!due.length || options.signal?.aborted)
+    return 0;
+  const coordination = options.coordination ?? process.env.SCHEDULER_COORDINATION ?? (isProductionEnv() ? "redis" : "single-runner");
+  if (coordination !== "redis" && coordination !== "single-runner")
+    throw new TypeError("Unsupported scheduler coordination.");
+  const leaseMs = bounded(options.leaseMs ?? 30000, 100, 3600000, "leaseMs");
+  const renewalMs = bounded(options.renewalMs ?? Math.floor(leaseMs / 3), 1, Math.floor(leaseMs / 3), "renewalMs");
+  const timeoutMs = bounded(options.commandTimeoutMs ?? Math.min(1000, Math.floor(leaseMs / 4)), 1, Math.floor(leaseMs / 3), "commandTimeoutMs");
+  const retention = bounded(options.completedRetentionMs ?? 7 * 86400000, leaseMs, 2147483647, "completedRetentionMs");
+  const namespace = (options.namespace ?? namespacedRedisKey("schedule")).trim();
+  if (!namespace || namespace.length > 512)
+    throw new TypeError("Invalid scheduler namespace.");
+  let owned;
+  let store = options.leaseStore;
+  if (!store && coordination === "redis") {
+    const redisUrl = options.redisUrl ?? process.env.REDIS_URL?.trim();
+    if (!redisUrl)
+      throw new Error("Redis scheduler coordination requires REDIS_URL.");
+    owned = new RedisSchedulerLeaseStore({
+      redisUrl,
+      namespace,
+      commandTimeoutMs: timeoutMs
+    });
+    store = owned;
+  }
+  if (!store) {
+    let local = localStores.get(schedule);
+    if (!local) {
+      local = new SingleRunnerLeaseStore;
+      localStores.set(schedule, local);
+    }
+    store = local;
+  }
+  const occurrenceId = String(Math.floor(timestamp / 60000) * 60000);
+  let completed = 0;
+  try {
+    for (const task of due) {
+      if (options.signal?.aborted)
+        break;
+      const lease = { taskId: task.name, occurrenceId, token: crypto.randomUUID() };
+      if (!await store.acquire(lease, leaseMs))
+        continue;
+      if (options.signal?.aborted) {
+        await store.release(lease);
+        break;
+      }
+      const controller = new AbortController;
+      let lost;
+      const lose = (cause) => {
+        lost ??= new SchedulerLeaseLostError(task.name, { cause });
+        controller.abort(lost);
+        return lost;
+      };
+      let timer;
+      let renewal;
+      let stopped = false;
+      const renew = async () => {
+        try {
+          if (!await store.renew(lease, leaseMs))
+            throw lose();
+        } catch (error) {
+          throw lose(error);
+        }
+      };
+      const tick = () => {
+        renewal = renew().catch(() => {}).finally(() => {
+          if (!stopped && !lost)
+            timer = setTimeout(tick, renewalMs);
+        });
+      };
+      timer = setTimeout(tick, renewalMs);
+      try {
+        await task.run({
+          taskName: task.name,
+          occurrenceId: createHash6("sha256").update(JSON.stringify([namespace, task.name, occurrenceId])).digest("hex"),
+          scheduledAt: new Date(Number(occurrenceId)),
+          signal: controller.signal,
+          async assertOwnership() {
+            if (lost)
+              throw lost;
+            await renew();
+          }
+        });
+        stopped = true;
+        clearTimeout(timer);
+        await renewal;
+        if (lost || !await store.complete(lease, retention))
+          throw lost ?? lose();
+        completed++;
+      } catch (error) {
+        stopped = true;
+        clearTimeout(timer);
+        await renewal;
+        try {
+          await store.release(lease);
+        } catch (releaseError) {
+          throw new AggregateError([error, releaseError], "Scheduled task and lease release failed.");
+        }
+        throw error;
+      } finally {
+        stopped = true;
+        clearTimeout(timer);
+      }
+    }
+    return completed;
+  } finally {
+    owned?.close();
   }
-  return due.length;
 }
 // ../../src/core/security/publicReads.ts
 function isPublicReadsEnabled() {
@@ -12452,17 +14051,62 @@ init_tenantContext();
 init_tenantDatabaseScope();
 
 // ../../src/core/tenant/tenantMiddleware.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 init_repositoryConnection();
 init_databaseTenantContext();
+
+// ../../src/core/tenant/publicTenantHost.ts
+import { BlockList, isIP } from "net";
+function normalizeTenantHostname(authority) {
+  if (!authority || authority !== authority.trim() || /[\s\\/@?#%,]/.test(authority)) {
+    throw new ForbiddenError("Invalid tenant hostname.");
+  }
+  let url;
+  try {
+    url = new URL(`http://${authority}`);
+  } catch {
+    throw new ForbiddenError("Invalid tenant hostname.");
+  }
+  const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  const ip = hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
+  if (!isIP(ip) && (hostname.length > 253 || !hostname.split(".").every((label) => label.length > 0 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)))) {
+    throw new ForbiddenError("Invalid tenant hostname.");
+  }
+  return hostname;
+}
+function createPublicTenantSelector(options) {
+  const addresses = options.trustedProxyAddresses ?? [];
+  if (addresses.length > 128)
+    throw new Error("Public tenancy supports at most 128 trusted proxy addresses.");
+  const proxies = new BlockList;
+  for (const address of addresses) {
+    const version = isIP(address);
+    if (!version)
+      throw new Error("Trusted proxy addresses must be literal IP addresses.");
+    proxies.addAddress(address, version === 6 ? "ipv6" : "ipv4");
+  }
+  return async (request) => {
+    const peer = currentRequestMeta().peerAddress;
+    const version = peer ? isIP(peer) : 0;
+    const trusted = peer && version && proxies.check(peer, version === 6 ? "ipv6" : "ipv4");
+    const forwarded = trusted ? request.headers.get("x-forwarded-host") : null;
+    const authority = forwarded ?? request.headers.get("host") ?? new URL(request.url).host;
+    const id = await options.resolveTenantId(normalizeTenantHostname(authority));
+    if (id === null)
+      throw new ForbiddenError("Tenant host not found.");
+    if (!Number.isSafeInteger(id) || id <= 0)
+      throw new Error("Public tenant resolver returned an invalid identity.");
+    return id;
+  };
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
 init_tenancyConfig();
 init_tenantContext();
 init_tenantDatabaseScope();
 var DEFAULT_TENANT = {
   id: 1,
-  slug: "default",
-  plan: "free",
-  region: "eu"
+  slug: "default"
 };
 async function resolveUserTenantId(userId) {
   if (!isTenancyEnabled()) {
@@ -12479,49 +14123,57 @@ async function resolveUserTenantId(userId) {
   });
 }
 function auditChecksum(payload) {
-  return createHash5("sha256").update(JSON.stringify(payload)).digest("hex");
+  return createHash7("sha256").update(JSON.stringify(payload)).digest("hex");
 }
-async function resolveTenantForRequest(request) {
+async function resolveTenantForRequest(request, resolver, selectPublicTenant) {
+  const hostTenantId = selectPublicTenant ? await selectPublicTenant(request) : null;
   const user = currentAuthUser();
   const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number(headerValue) : Number.NaN;
   if (user) {
     const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
     if (Number.isInteger(userId) && userId > 0) {
       const userTenantId = await resolveUserTenantId(userId);
       if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+        if (Number.isSafeInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
           throw new ForbiddenError("Tenant header does not match your account.");
         }
-        const memberTenant = await resolveTenant(userTenantId);
+        const memberTenant = await resolver(userTenantId);
         if (memberTenant) {
           return memberTenant;
         }
         return DEFAULT_TENANT;
       }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        const headerTenant = await resolveTenant(parsedHeader);
+      if (Number.isSafeInteger(parsedHeader) && parsedHeader > 0) {
+        const headerTenant = await resolver(parsedHeader);
         if (headerTenant) {
           return headerTenant;
         }
         return DEFAULT_TENANT;
       }
-      const adminTenant = await resolveTenant(userTenantId);
+      const adminTenant = await resolver(userTenantId);
       if (adminTenant) {
         return adminTenant;
       }
       return DEFAULT_TENANT;
     }
   }
-  const headerTenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : null;
-  const tenantId = isPublicReadsEnabled() && headerTenantId !== null ? headerTenantId : DEFAULT_TENANT.id;
-  const guestTenant = await resolveTenant(tenantId);
+  const headerTenantId = Number.isSafeInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : null;
+  const tenantId = hostTenantId !== null ? hostTenantId : !isProductionEnv() && process.env.TENANT_DEV_HEADERS === "true" && headerTenantId !== null ? headerTenantId : DEFAULT_TENANT.id;
+  if (isProductionEnv() && !selectPublicTenant) {
+    throw new ForbiddenError("Public tenant host resolver is required.");
+  }
+  const guestTenant = await resolver(tenantId);
+  if (selectPublicTenant && !guestTenant)
+    throw new ForbiddenError("Tenant not found.");
   if (guestTenant) {
     return guestTenant;
   }
   return DEFAULT_TENANT;
 }
-function createTenantMiddleware() {
+function createTenantMiddleware(options = {}) {
+  const resolver = options.resolveTenant ?? resolveTenant;
+  const selectPublicTenant = options.publicTenancy ? createPublicTenantSelector(options.publicTenancy) : undefined;
   return async (request, next) => {
     const pathname = new URL(request.url).pathname;
     if (pathname.startsWith("/scim/")) {
@@ -12531,7 +14183,16 @@ function createTenantMiddleware() {
       return await runWithTenant(DEFAULT_TENANT, next);
     }
     try {
-      const tenant = await resolveTenantForRequest(request);
+      const tenant = await resolveTenantForRequest(request, async (id) => {
+        const tenant = await resolver(id);
+        if (options.resolveTenant && tenant === null) {
+          throw new ForbiddenError("Tenant not found.");
+        }
+        if (tenant && tenant.id !== id) {
+          throw new Error("Tenant resolver returned a different tenant identity.");
+        }
+        return tenant;
+      }, selectPublicTenant);
       return await runWithTenantDatabase(tenant, async () => {
         return await next();
       });
@@ -12553,99 +14214,185 @@ function runWithTraceContext(context, callback) {
 function currentTraceId() {
   return traceContextStorage.getStore()?.traceId ?? null;
 }
+// ../../src/core/tracing/tracingMiddleware.ts
+import { ROOT_CONTEXT, SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+
 // ../../src/core/tracing/otel.ts
-import { randomBytes as randomBytes5 } from "crypto";
-function randomHex(bytes) {
-  return randomBytes5(bytes).toString("hex");
-}
-function createSpan(input) {
-  const spanId = randomHex(8);
-  return {
-    traceId: input.traceId,
-    spanId,
-    name: input.name,
-    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
-    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
-    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
-      key,
-      value: { stringValue: value }
-    })),
-    status: { code: 1 }
-  };
+import { context } from "@opentelemetry/api";
+import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
+import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { resourceFromAttributes } from "@opentelemetry/resources";
+import {
+  AlwaysOffSampler,
+  AlwaysOnSampler,
+  BatchSpanProcessor,
+  ParentBasedSampler,
+  TraceIdRatioBasedSampler
+} from "@opentelemetry/sdk-trace-base";
+import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+function numberOption(value, fallback, name, max = 1e6) {
+  const result = value ?? fallback;
+  if (!Number.isInteger(result) || result < 1 || result > max)
+    throw new TypeError(`Invalid tracing ${name}.`);
+  return result;
 }
-async function exportOtelSpan(span) {
-  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-  if (!endpoint) {
+function ensureContextManager() {
+  const key = Symbol.for("@getstrata/otel-context-installed");
+  const state = globalThis;
+  if (state[key])
     return;
+  const manager = new AsyncLocalStorageContextManager().enable();
+  if (!context.setGlobalContextManager(manager))
+    manager.disable();
+  state[key] = true;
+}
+function createTracingRuntime(options = {}) {
+  ensureContextManager();
+  const disabled = process.env.OTEL_SDK_DISABLED === "true";
+  const samplerName = options.sampleRatio === undefined ? process.env.OTEL_TRACES_SAMPLER ?? "parentbased_traceidratio" : "parentbased_traceidratio";
+  const rootName = samplerName.replace(/^parentbased_/, "");
+  if (!["always_on", "always_off", "traceidratio"].includes(rootName))
+    throw new TypeError("Unsupported tracing sampler.");
+  const ratio = options.sampleRatio ?? Number(process.env.OTEL_TRACES_SAMPLER_ARG ?? "1");
+  if (!Number.isFinite(ratio) || ratio < 0 || ratio > 1)
+    throw new TypeError("Invalid tracing sampleRatio.");
+  const rootSampler = rootName === "always_on" ? new AlwaysOnSampler : rootName === "always_off" ? new AlwaysOffSampler : new TraceIdRatioBasedSampler(ratio);
+  const sampler = disabled ? new AlwaysOffSampler : samplerName.startsWith("parentbased_") ? new ParentBasedSampler({ root: rootSampler }) : rootSampler;
+  const queueSize = numberOption(options.maxQueueSize, 2048, "maxQueueSize");
+  const batchSize = numberOption(options.maxExportBatchSize, Math.min(512, queueSize), "maxExportBatchSize", queueSize);
+  const timeout = numberOption(options.exportTimeoutMillis, 5000, "exportTimeoutMillis", 60000);
+  const delay = numberOption(options.scheduledDelayMillis, 5000, "scheduledDelayMillis", 60000);
+  let endpoint = options.endpoint ?? process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+  if (!endpoint) {
+    const base = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+    if (base)
+      endpoint = base.endsWith("/v1/traces") ? base : `${base.replace(/\/$/, "")}/v1/traces`;
   }
-  const serviceName = otelServiceName();
-  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await safeFetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      resourceSpans: [
-        {
-          resource: {
-            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
-          },
-          scopeSpans: [{ spans: [span] }]
-        }
-      ]
-    })
-  }, {
-    allowHttp: !isProductionEnv(),
-    allowPrivate: !isProductionEnv(),
-    timeoutMs: 5000,
-    maxRedirects: 0
+  if (endpoint) {
+    let url;
+    try {
+      url = new URL(endpoint);
+    } catch {
+      throw new TypeError("Invalid tracing collector endpoint.");
+    }
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+      throw new TypeError("Invalid tracing collector endpoint.");
+  }
+  const exporter = disabled ? undefined : options.exporter ?? (endpoint ? new OTLPTraceExporter({ url: endpoint, timeoutMillis: timeout, concurrencyLimit: 1 }) : undefined);
+  const provider = new NodeTracerProvider({
+    resource: resourceFromAttributes({ "service.name": options.serviceName ?? otelServiceName() }),
+    sampler,
+    spanProcessors: exporter ? [
+      new BatchSpanProcessor(exporter, {
+        maxQueueSize: queueSize,
+        maxExportBatchSize: batchSize,
+        scheduledDelayMillis: delay,
+        exportTimeoutMillis: timeout
+      })
+    ] : [],
+    spanLimits: {
+      attributeCountLimit: 16,
+      attributeValueLengthLimit: 256,
+      eventCountLimit: 8,
+      linkCountLimit: 8
+    },
+    forceFlushTimeoutMillis: timeout
   });
+  let shutdown;
+  return {
+    tracer: provider.getTracer("@getstrata/http"),
+    propagator: new W3CTraceContextPropagator,
+    run: (parent, callback) => context.with(parent, callback),
+    forceFlush: () => provider.forceFlush(),
+    shutdown: () => shutdown ??= provider.shutdown()
+  };
+}
+var runtimeKey = Symbol.for("@getstrata/otel-runtime");
+function runtimeState() {
+  const state = globalThis;
+  state[runtimeKey] ??= { owners: 0 };
+  return state[runtimeKey];
+}
+function getTracingRuntime() {
+  const state = runtimeState();
+  state.runtime ??= createTracingRuntime();
+  return state.runtime;
+}
+function acquireTracingRuntime() {
+  const state = runtimeState();
+  const runtime = getTracingRuntime();
+  state.owners++;
+  let released = false;
+  return {
+    flush: () => runtime.forceFlush(),
+    async release() {
+      if (released)
+        return;
+      released = true;
+      if (--state.owners === 0) {
+        if (state.runtime === runtime)
+          state.runtime = undefined;
+        await runtime.shutdown();
+      }
+    }
+  };
 }
 
 // ../../src/core/tracing/tracingMiddleware.ts
-function readClientTraceId(request) {
-  if (!envFlagEnabled(process.env.APP_DEBUG)) {
-    return null;
-  }
-  const raw = request.headers.get("x-trace-id")?.trim() ?? "";
-  if (!raw) {
-    return null;
-  }
-  const compact = raw.replace(/-/g, "");
-  return /^[0-9a-f]{32}$/iu.test(compact) ? compact.toLowerCase() : null;
-}
-function createTracingMiddleware() {
+var headerGetter = {
+  keys: (headers) => [...headers.keys()],
+  get: (headers, key) => headers.get(key) ?? undefined
+};
+var methods = new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "CONNECT",
+  "TRACE"
+]);
+function createTracingMiddleware(runtime) {
   return async (request, next) => {
-    const traceId = readClientTraceId(request) ?? crypto.randomUUID().replace(/-/g, "");
-    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
-    const startedAt = performance.now();
-    const path = new URL(request.url).pathname;
-    return await runWithTraceContext({ traceId, spanId }, async () => {
-      const response = await next();
-      const endedAt = performance.now();
-      const headers = new Headers(response.headers);
-      headers.set("x-trace-id", traceId);
-      headers.set("x-span-id", spanId);
-      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
-      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
-      exportOtelSpan(createSpan({
-        traceId,
-        name: `${request.method} ${path}`,
-        startedAt,
-        endedAt,
-        attributes: {
-          "http.method": request.method,
-          "http.route": path,
-          "http.status_code": String(response.status)
-        }
-      })).catch(() => {
-        return;
-      });
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    });
+    const telemetry = runtime ?? getTracingRuntime();
+    const method = methods.has(request.method) ? request.method : "_OTHER";
+    const route = currentRequestMeta().routeTemplate ?? "__unmatched__";
+    const parent = telemetry.propagator.extract(ROOT_CONTEXT, request.headers, headerGetter);
+    const span = telemetry.tracer.startSpan(`${method} ${route}`, {
+      kind: SpanKind.SERVER,
+      attributes: { "http.request.method": method, "http.route": route }
+    }, parent);
+    const identity = span.spanContext();
+    const started = performance.now();
+    return await telemetry.run(trace.setSpan(parent, span), () => runWithTraceContext({ traceId: identity.traceId, spanId: identity.spanId }, async () => {
+      try {
+        const response = await next();
+        span.setAttribute("http.response.status_code", response.status);
+        if (response.status >= 500)
+          span.setStatus({ code: SpanStatusCode.ERROR });
+        const headers = new Headers(response.headers);
+        headers.delete("tracestate");
+        headers.set("x-trace-id", identity.traceId);
+        headers.set("x-span-id", identity.spanId);
+        telemetry.propagator.inject(trace.setSpan(parent, span), headers, {
+          set: (carrier, key, value) => carrier.set(key, value)
+        });
+        headers.set("server-timing", `app;dur=${(performance.now() - started).toFixed(2)}`);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      } catch (error) {
+        span.setStatus({ code: SpanStatusCode.ERROR });
+        throw error;
+      } finally {
+        span.end();
+      }
+    }));
   };
 }
 // ../../src/core/validation/rules.ts
@@ -13056,6 +14803,7 @@ export {
   JobRegistry,
   JsonResource,
   JwtGuard,
+  LifecycleCoordinator,
   LocalStorageDriver,
   LogMailDriver,
   MAX_PER_PAGE,
@@ -13081,12 +14829,14 @@ export {
   QueueWorker,
   RLS_HELPER_SQL,
   RedisQueue,
+  RedisSchedulerLeaseStore,
   RepositoryQuery,
   ResilientQueue,
   ResourceCollection,
   SamlProvider,
   SamlServiceProvider,
   Schedule,
+  SchedulerLeaseLostError,
   Schema,
   ServiceContainer,
   SqlOutbox,
@@ -13100,6 +14850,7 @@ export {
   WebFormRequest,
   WhereBuilder,
   absoluteTemporarySignedUrl,
+  acquireTracingRuntime,
   apiPrefix,
   appCookieName,
   appDevSecret,
@@ -13130,6 +14881,7 @@ export {
   bindBunSql,
   bindDatabaseConnection,
   bindRouteModel,
+  bootModels,
   buildAdvancedWhereClause,
   buildCountQuery,
   buildDeleteByIdQuery,
@@ -13149,6 +14901,7 @@ export {
   buildUpdateQuery,
   buildWhereClause,
   cache,
+  clearActiveApplicationContext,
   collectQueueMetrics,
   compileBlueprint,
   completePasswordLogin,
@@ -13205,6 +14958,7 @@ export {
   createThrottleMiddleware,
   createTokenAbilityChecker,
   createTracingMiddleware,
+  createTracingRuntime,
   createTrackedJob,
   createValidateSignatureMiddleware,
   createdResponse,
@@ -13217,6 +14971,7 @@ export {
   currentTenant,
   currentTenantId,
   currentTraceId,
+  defineModel,
   defineTable,
   dehydrateValue,
   dialectFor,
@@ -13248,6 +15003,7 @@ export {
   getNamedConnection,
   getQueryParams,
   getRouteParams,
+  getTracingRuntime,
   grammarForDriver,
   guestCanViewResource,
   hasActiveDatabaseConnection,
@@ -13311,6 +15067,7 @@ export {
   namespacedRedisKey,
   noContentResponse,
   normalizeFieldErrors,
+  normalizeTenantHostname,
   notFoundHtmlResponse,
   notModifiedResponse,
   otelServiceName,
@@ -13331,7 +15088,6 @@ export {
   qualifyColumn,
   queue,
   quoteIdentifier,
-  rateLimitMultiplierForPlan,
   readBunRequestCookie,
   readClientIp,
   readOptionalEnum,