@holo-js/core 0.1.2 → 0.1.3

package/dist/chunk-AD2ZYGLN.mjs

@@ -0,0 +1,2741 @@
+// src/portable/dbRuntime.ts
+import {
+  createAdapter,
+  createDialect,
+  createRuntimeConnectionOptions,
+  createRuntimeLogger,
+  isSupportedDatabaseDriver,
+  parseDatabaseDriver,
+  resolveRuntimeConnectionManagerOptions
+} from "@holo-js/db";
+
+// src/portable/registry.ts
+import { readFile } from "fs/promises";
+import { resolve } from "path";
+import { DEFAULT_HOLO_PROJECT_PATHS } from "@holo-js/db";
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeLegacyGeneratedProjectRegistry(value) {
+  const paths = isRecord(value.paths) ? value.paths : void 0;
+  if (paths && typeof paths.jobs !== "string") {
+    paths.jobs = DEFAULT_HOLO_PROJECT_PATHS.jobs;
+  }
+  if (paths && typeof paths.events !== "string") {
+    paths.events = DEFAULT_HOLO_PROJECT_PATHS.events;
+  }
+  if (paths && typeof paths.listeners !== "string") {
+    paths.listeners = DEFAULT_HOLO_PROJECT_PATHS.listeners;
+  }
+  if (paths && typeof paths.broadcast !== "string") {
+    paths.broadcast = "server/broadcast";
+  }
+  if (paths && typeof paths.channels !== "string") {
+    paths.channels = "server/channels";
+  }
+  if (paths && typeof paths.authorizationPolicies !== "string") {
+    paths.authorizationPolicies = "server/policies";
+  }
+  if (paths && typeof paths.authorizationAbilities !== "string") {
+    paths.authorizationAbilities = "server/abilities";
+  }
+  if (!Array.isArray(value.jobs)) {
+    value.jobs = [];
+  }
+  if (!Array.isArray(value.events)) {
+    value.events = [];
+  }
+  if (!Array.isArray(value.listeners)) {
+    value.listeners = [];
+  }
+  if (!Array.isArray(value.broadcast)) {
+    value.broadcast = [];
+  }
+  if (!Array.isArray(value.channels)) {
+    value.channels = [];
+  }
+  if (!Array.isArray(value.authorizationPolicies)) {
+    value.authorizationPolicies = [];
+  }
+  if (!Array.isArray(value.authorizationAbilities)) {
+    value.authorizationAbilities = [];
+  }
+}
+function isGeneratedProjectRegistry(value) {
+  if (!isRecord(value)) {
+    return false;
+  }
+  normalizeLegacyGeneratedProjectRegistry(value);
+  return value.version === 1 && isRecord(value.paths) && Array.isArray(value.models) && Array.isArray(value.migrations) && Array.isArray(value.seeders) && Array.isArray(value.commands) && Array.isArray(value.jobs) && Array.isArray(value.events) && Array.isArray(value.listeners) && Array.isArray(value.broadcast) && Array.isArray(value.channels) && Array.isArray(value.authorizationPolicies) && Array.isArray(value.authorizationAbilities);
+}
+function resolveGeneratedProjectRegistryPath(projectRoot) {
+  return resolve(projectRoot, ".holo-js", "generated", "registry.json");
+}
+async function loadGeneratedProjectRegistry(projectRoot) {
+  const filePath = resolveGeneratedProjectRegistryPath(projectRoot);
+  const contents = await readFile(filePath, "utf8").catch(() => void 0);
+  if (!contents) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(contents);
+    return isGeneratedProjectRegistry(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createGeneratedBroadcastManifest(registry) {
+  return Object.freeze({
+    version: 1,
+    generatedAt: registry.generatedAt,
+    events: Object.freeze(registry.broadcast.map((entry) => Object.freeze({
+      name: entry.name,
+      channels: Object.freeze(entry.channels.map((channel) => Object.freeze({
+        type: channel.type,
+        pattern: channel.pattern
+      })))
+    }))),
+    channels: Object.freeze(registry.channels.map((entry) => Object.freeze({
+      name: entry.pattern,
+      pattern: entry.pattern,
+      type: entry.type,
+      params: Object.freeze([...entry.params]),
+      whispers: Object.freeze([...entry.whispers])
+    })))
+  });
+}
+async function loadGeneratedBroadcastManifest(projectRoot) {
+  const registry = await loadGeneratedProjectRegistry(projectRoot);
+  if (!registry) {
+    return void 0;
+  }
+  return createGeneratedBroadcastManifest(registry);
+}
+var registryInternals = {
+  createGeneratedBroadcastManifest,
+  isGeneratedProjectRegistry,
+  normalizeLegacyGeneratedProjectRegistry
+};
+
+// src/portable/holo.ts
+import { createHash, createHmac } from "crypto";
+import { createRequire } from "module";
+import { resolve as resolve3 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+import {
+  config as globalConfig,
+  configureConfigRuntime,
+  createConfigAccessors,
+  loadConfigDirectory,
+  resetConfigRuntime,
+  useConfig as globalUseConfig
+} from "@holo-js/config";
+import {
+  configureDB,
+  DB,
+  resetDB
+} from "@holo-js/db";
+
+// src/runtimeModule.ts
+import { mkdtemp, mkdir, rm, stat, writeFile } from "fs/promises";
+import { basename, extname, join } from "path";
+import { pathToFileURL } from "url";
+async function importModule(specifier) {
+  if (process.env.VITEST) {
+    return import(
+      /* @vite-ignore */
+      specifier
+    );
+  }
+  return import(
+    /* webpackIgnore: true */
+    specifier
+  );
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function writeLoaderTsconfig(projectRoot, tempDir) {
+  const projectTsconfigPath = join(projectRoot, "tsconfig.json");
+  if (await pathExists(projectTsconfigPath)) {
+    return projectTsconfigPath;
+  }
+  const tsconfigPath = join(tempDir, "tsconfig.json");
+  const contents = JSON.stringify({
+    compilerOptions: {
+      baseUrl: projectRoot,
+      paths: {
+        "~/*": ["./*"],
+        "@/*": ["./*"]
+      }
+    }
+  }, null, 2);
+  await writeFile(tsconfigPath, `${contents}
+`, "utf8");
+  return tsconfigPath;
+}
+async function bundleRuntimeModule(projectRoot, entryPath) {
+  const runtimeTempRoot = join(projectRoot, ".holo-js", "runtime");
+  await mkdir(runtimeTempRoot, { recursive: true });
+  const tempDir = await mkdtemp(join(runtimeTempRoot, "bundle-"));
+  const tsconfigPath = await writeLoaderTsconfig(projectRoot, tempDir);
+  const outfile = join(tempDir, `${basename(entryPath, extname(entryPath))}.mjs`);
+  const cleanup = async () => {
+    await rm(tempDir, { recursive: true, force: true });
+  };
+  try {
+    await runtimeModuleInternals.runEsbuild({
+      absWorkingDir: projectRoot,
+      bundle: true,
+      entryPoints: [entryPath],
+      outfile,
+      format: "esm",
+      logLevel: "silent",
+      packages: "external",
+      platform: "node",
+      target: "node20",
+      tsconfig: tsconfigPath,
+      sourcemap: false
+    });
+    return {
+      path: outfile,
+      cleanup
+    };
+  } catch (error) {
+    await cleanup();
+    if (error && typeof error === "object" && Array.isArray(error.errors)) {
+      const message = error.errors.map((entry) => {
+        if (typeof entry.text === "string" && entry.text.trim()) {
+          return entry.text;
+        }
+        if (typeof entry.message === "string" && entry.message.trim()) {
+          return entry.message;
+        }
+        return "Unknown build error.";
+      }).join("\n");
+      throw new Error(message);
+    }
+    if (error instanceof Error && error.message) {
+      throw error;
+    }
+    throw new Error(`Failed to load ${entryPath}.`);
+  }
+}
+async function importBundledRuntimeModule(projectRoot, entryPath) {
+  const bundled = await bundleRuntimeModule(projectRoot, entryPath);
+  try {
+    return await runtimeModuleInternals.importModule(
+      `${pathToFileURL(bundled.path).href}?t=${Date.now()}`
+    );
+  } finally {
+    await bundled.cleanup();
+  }
+}
+async function loadEsbuild() {
+  const module = await import(
+    /* webpackIgnore: true */
+    "esbuild"
+  );
+  if ("build" in module) {
+    return module;
+  }
+  return module.default;
+}
+async function runEsbuild(options) {
+  const esbuild = await runtimeModuleInternals.loadEsbuild();
+  return esbuild.build(options);
+}
+var runtimeModuleInternals = {
+  bundleRuntimeModule,
+  importModule,
+  loadEsbuild,
+  pathExists,
+  runEsbuild,
+  writeLoaderTsconfig
+};
+
+// src/storageRuntime.ts
+import { mkdir as mkdir2, readFile as readFile2, readdir, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { dirname, join as join2, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+async function importOptionalModule(specifier) {
+  try {
+    if (process.env.VITEST) {
+      return await import(
+        /* @vite-ignore */
+        specifier
+      );
+    }
+    return await import(
+      /* webpackIgnore: true */
+      specifier
+    );
+  } catch (error) {
+    const message = error && typeof error === "object" && "message" in error && typeof error.message === "string" ? error.message : "";
+    const resolvedSpecifier = specifier.startsWith("file://") ? fileURLToPath(specifier) : specifier;
+    const failedTarget = message.match(/Cannot find package '([^']+)'|Cannot find module '([^']+)'|Failed to load url ([^ ]+)/)?.slice(1).find((value) => typeof value === "string");
+    const matchesRequestedTarget = failedTarget === specifier || failedTarget === resolvedSpecifier;
+    if (error && typeof error === "object" && ("code" in error && error.code === "ERR_MODULE_NOT_FOUND" || message.startsWith("Cannot find package '") && matchesRequestedTarget || message.startsWith("Cannot find module '") && matchesRequestedTarget || message.includes("Does the file exist?") && message.startsWith("Failed to load url ") && matchesRequestedTarget)) {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function resolveStorageKeyPath(root, key) {
+  const segments = key.split(":").filter(Boolean);
+  if (segments.includes("..")) {
+    throw new Error('[Holo Storage] Storage paths must not contain ".." segments.');
+  }
+  return resolve2(root, ...segments);
+}
+function createFileStorageBackend(root) {
+  async function listStorageKeys(currentRoot, prefix = "") {
+    const entries = await readdir(currentRoot, { withFileTypes: true }).catch(() => []);
+    const keys = [];
+    for (const entry of entries) {
+      const nextPrefix = prefix ? `${prefix}:${entry.name}` : entry.name;
+      const entryPath = join2(currentRoot, entry.name);
+      if (entry.isDirectory()) {
+        keys.push(...await listStorageKeys(entryPath, nextPrefix));
+        continue;
+      }
+      if (entry.isFile()) {
+        keys.push(nextPrefix);
+      }
+    }
+    return keys;
+  }
+  return {
+    async getItem(key) {
+      const value = await this.getItemRaw(key);
+      if (value === null) {
+        return null;
+      }
+      const serialized = Buffer.isBuffer(value) ? value.toString("utf8") : value instanceof Uint8Array ? Buffer.from(value).toString("utf8") : value instanceof ArrayBuffer ? Buffer.from(value).toString("utf8") : String(value);
+      return JSON.parse(serialized);
+    },
+    async getItemRaw(key) {
+      const targetPath = resolveStorageKeyPath(root, key);
+      try {
+        return await readFile2(targetPath);
+      } catch {
+        return null;
+      }
+    },
+    async setItem(key, value) {
+      await this.setItemRaw(key, JSON.stringify(value));
+    },
+    async setItemRaw(key, value) {
+      const targetPath = resolveStorageKeyPath(root, key);
+      await mkdir2(dirname(targetPath), { recursive: true });
+      await writeFile2(
+        targetPath,
+        value instanceof ArrayBuffer ? new Uint8Array(value) : value
+      );
+    },
+    async hasItem(key) {
+      return await this.getItemRaw(key) !== null;
+    },
+    async removeItem(key) {
+      const targetPath = resolveStorageKeyPath(root, key);
+      await rm2(targetPath, { force: true });
+      await rm2(`${targetPath}$`, { force: true });
+    },
+    async getKeys(base = "") {
+      const prefix = base.replace(/:+$/, "");
+      const keys = await listStorageKeys(root);
+      return keys.filter((key) => {
+        if (!prefix) {
+          return true;
+        }
+        return key === prefix || key.startsWith(`${prefix}:`);
+      });
+    },
+    async getMeta(key) {
+      return this.getItem(`${key}$`);
+    },
+    async setMeta(key, value) {
+      await this.setItem(`${key}$`, value);
+    },
+    async removeMeta(key) {
+      await this.removeItem(`${key}$`);
+    },
+    async clear(base = "") {
+      const prefix = base.replace(/:+$/, "");
+      const targetPath = prefix ? resolveStorageKeyPath(root, prefix) : root;
+      await rm2(targetPath, { recursive: true, force: true });
+      if (!prefix) {
+        await mkdir2(root, { recursive: true });
+      }
+    }
+  };
+}
+async function createS3StorageBackend(disk) {
+  const storageS3 = await importOptionalModule("@holo-js/storage/runtime/drivers/s3");
+  if (!storageS3) {
+    throw new Error("[@holo-js/core] Storage config references an s3 disk but @holo-js/storage-s3 is not installed.");
+  }
+  return storageS3.default({
+    bucket: disk.bucket,
+    region: disk.region,
+    endpoint: disk.endpoint,
+    accessKeyId: disk.accessKeyId,
+    secretAccessKey: disk.secretAccessKey,
+    sessionToken: disk.sessionToken,
+    forcePathStyleEndpoint: disk.forcePathStyleEndpoint
+  });
+}
+async function configurePlainNodeStorageRuntime(projectRoot, loadedConfig) {
+  const storageModule = await storageRuntimeInternals.importOptionalModule("@holo-js/storage");
+  const storageRuntime = await storageRuntimeInternals.importOptionalModule("@holo-js/storage/runtime");
+  if (!storageModule || !storageRuntime) {
+    throw new Error("[@holo-js/core] Storage is configured but @holo-js/storage is not installed.");
+  }
+  const normalizedStorage = storageModule.normalizeModuleOptions({
+    defaultDisk: loadedConfig.storage.defaultDisk,
+    routePrefix: loadedConfig.storage.routePrefix,
+    disks: loadedConfig.storage.disks
+  });
+  const backends = /* @__PURE__ */ new Map();
+  for (const [diskName, disk] of Object.entries(normalizedStorage.disks)) {
+    const backend = disk.driver === "s3" ? await createS3StorageBackend(disk) : createFileStorageBackend(resolve2(projectRoot, disk.root));
+    backends.set(diskName, backend);
+  }
+  storageRuntime.configureStorageRuntime({
+    getRuntimeConfig: () => ({
+      holoStorage: normalizedStorage,
+      holo: { appUrl: loadedConfig.app.url }
+    }),
+    getStorage: (base) => {
+      const diskName = base.replace(/^holo:/, "");
+      const backend = backends.get(diskName);
+      if (!backend) {
+        throw new Error(`[Holo Storage] Disk "${diskName}" backend is not configured.`);
+      }
+      return backend;
+    }
+  });
+}
+async function resetOptionalStorageRuntime() {
+  const storageRuntime = await storageRuntimeInternals.importOptionalModule("@holo-js/storage/runtime");
+  storageRuntime?.resetStorageRuntime();
+}
+var storageRuntimeInternals = {
+  importOptionalModule
+};
+
+// src/portable/holo.ts
+function closeSessionRedisAdapter(adapter) {
+  return adapter.disconnect?.() || adapter.close?.();
+}
+var CORE_BROADCAST_PUBLISHER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.core.broadcast.publisher");
+function getRuntimeState() {
+  const runtime = globalThis;
+  runtime.__holoRuntime__ ??= {};
+  return runtime.__holoRuntime__;
+}
+function configureHoloRenderingRuntime(bindings) {
+  getRuntimeState().renderView = bindings?.renderView;
+}
+function resetHoloRenderingRuntime() {
+  getRuntimeState().renderView = void 0;
+}
+function restoreHoloRenderingRuntime(renderView) {
+  if (renderView) {
+    configureHoloRenderingRuntime({
+      renderView
+    });
+    return;
+  }
+  resetHoloRenderingRuntime();
+}
+function snapshotOptionalSubsystemRuntimeBindings() {
+  const state = getRuntimeState();
+  const runtime = globalThis;
+  return Object.freeze({
+    ...runtime.__holoMailRuntime__?.bindings ? { mail: runtime.__holoMailRuntime__.bindings } : {},
+    ...runtime.__holoNotificationsRuntime__?.bindings ? { notifications: runtime.__holoNotificationsRuntime__.bindings } : {},
+    ...runtime.__holoBroadcastRuntime__?.bindings ? { broadcast: runtime.__holoBroadcastRuntime__.bindings } : {},
+    /* v8 ignore start -- this snapshot branch only applies when restoring externally managed session adapters across runtime swaps */
+    ...state.sessionRedisAdapters ? {
+      session: Object.freeze({
+        sessionRedisAdapters: state.sessionRedisAdapters
+      })
+    } : {},
+    /* v8 ignore stop */
+    ...runtime.__holoSecurityRuntime__?.bindings || state.securityRedisAdapter || typeof state.securityRateLimitStoreManaged !== "undefined" ? {
+      security: Object.freeze({
+        ...runtime.__holoSecurityRuntime__?.bindings ? { bindings: runtime.__holoSecurityRuntime__.bindings } : {},
+        ...state.securityRedisAdapter ? { securityRedisAdapter: state.securityRedisAdapter } : {},
+        ...typeof state.securityRateLimitStoreManaged !== "undefined" ? { securityRateLimitStoreManaged: state.securityRateLimitStoreManaged } : {}
+      })
+    } : {}
+  });
+}
+function restoreOptionalSubsystemRuntimeBindings(bindings) {
+  const state = getRuntimeState();
+  const runtime = globalThis;
+  if (bindings.mail || runtime.__holoMailRuntime__) {
+    runtime.__holoMailRuntime__ ??= {};
+    runtime.__holoMailRuntime__.bindings = bindings.mail;
+  }
+  if (bindings.notifications || runtime.__holoNotificationsRuntime__) {
+    runtime.__holoNotificationsRuntime__ ??= {};
+    runtime.__holoNotificationsRuntime__.bindings = bindings.notifications;
+  }
+  if (bindings.broadcast || runtime.__holoBroadcastRuntime__) {
+    runtime.__holoBroadcastRuntime__ ??= {};
+    runtime.__holoBroadcastRuntime__.bindings = bindings.broadcast;
+  }
+  state.sessionRedisAdapters = bindings.session?.sessionRedisAdapters;
+  if (bindings.security || runtime.__holoSecurityRuntime__) {
+    runtime.__holoSecurityRuntime__ ??= {};
+    runtime.__holoSecurityRuntime__.bindings = bindings.security?.bindings;
+    state.securityRedisAdapter = bindings.security?.securityRedisAdapter;
+    state.securityRateLimitStoreManaged = bindings.security?.securityRateLimitStoreManaged;
+  }
+}
+var BROADCAST_PUBLISH_TIMEOUT_MS = 1e4;
+var portableRuntimeRequire = createRequire(import.meta.url);
+function resolveOptionalImportSpecifier(specifier, projectRoot) {
+  if (!projectRoot) {
+    return specifier;
+  }
+  try {
+    const resolved = portableRuntimeRequire.resolve(specifier, {
+      paths: [projectRoot]
+    });
+    return pathToFileURL2(resolved).href;
+  } catch {
+    return specifier;
+  }
+}
+async function importOptionalModule2(specifier, options = {}) {
+  const resolvedSpecifier = resolveOptionalImportSpecifier(specifier, options.projectRoot);
+  try {
+    return await import(
+      /* webpackIgnore: true */
+      resolvedSpecifier
+    );
+  } catch (error) {
+    if (error instanceof Error && (error.message.includes(`Cannot find package '${specifier}'`) || error.message.includes(`Cannot find module '${specifier}'`) || error.message.includes(`Failed to load url ${specifier}`) || error.message.includes(`Could not resolve "${specifier}"`) || error.message.includes(`Cannot find package '${resolvedSpecifier}'`) || error.message.includes(`Cannot find module '${resolvedSpecifier}'`) || error.message.includes(`Failed to load url ${resolvedSpecifier}`) || error.message.includes(`Could not resolve "${resolvedSpecifier}"`))) {
+      return void 0;
+    }
+    throw error;
+  }
+}
+var portableRuntimeModuleInternals = {
+  importOptionalModule: importOptionalModule2
+};
+function hasLoadedConfigFile(loadedConfig, configName) {
+  return loadedConfig.loadedFiles.some((filePath) => {
+    const normalizedPath = filePath.replaceAll("\\", "/");
+    return normalizedPath.endsWith(`/config/${configName}.ts`) || normalizedPath.endsWith(`/config/${configName}.mts`) || normalizedPath.endsWith(`/config/${configName}.js`) || normalizedPath.endsWith(`/config/${configName}.mjs`) || normalizedPath.endsWith(`/config/${configName}.cts`) || normalizedPath.endsWith(`/config/${configName}.cjs`);
+  });
+}
+function queueConfigUsesDatabaseDriver(loadedConfig) {
+  return Object.values(loadedConfig.queue.connections).some((connection) => connection.driver === "database");
+}
+function queueConfigUsesDatabaseBackedFailedStore(loadedConfig) {
+  return loadedConfig.queue.failed !== false;
+}
+function registryHasJobs(registry) {
+  return (registry?.jobs.length ?? 0) > 0;
+}
+function registryHasEvents(registry) {
+  return (registry?.events.length ?? 0) > 0 || (registry?.listeners.length ?? 0) > 0;
+}
+function authConfigUsesSocialProviders(loadedConfig) {
+  return Object.keys(loadedConfig.auth.social).length > 0;
+}
+function authConfigUsesWorkosProviders(loadedConfig) {
+  return Object.keys(loadedConfig.auth.workos).length > 0;
+}
+function authConfigUsesClerkProviders(loadedConfig) {
+  return Object.keys(loadedConfig.auth.clerk).length > 0;
+}
+var HOLO_AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
+function bindAuthRuntimeToContext(runtime, authContext) {
+  const activate = () => {
+    authContext.activate();
+  };
+  return Object.freeze({
+    check() {
+      activate();
+      return runtime.check();
+    },
+    user() {
+      activate();
+      return runtime.user();
+    },
+    refreshUser() {
+      activate();
+      return runtime.refreshUser();
+    },
+    id() {
+      activate();
+      return runtime.id();
+    },
+    currentAccessToken() {
+      activate();
+      return runtime.currentAccessToken();
+    },
+    hashPassword(password) {
+      activate();
+      return runtime.hashPassword(password);
+    },
+    verifyPassword(password, digest) {
+      activate();
+      return runtime.verifyPassword(password, digest);
+    },
+    needsPasswordRehash(digest) {
+      activate();
+      return runtime.needsPasswordRehash(digest);
+    },
+    login(credentials) {
+      activate();
+      return runtime.login(credentials);
+    },
+    loginUsing(user, options) {
+      activate();
+      return runtime.loginUsing(user, options);
+    },
+    loginUsingId(userId, options) {
+      activate();
+      return runtime.loginUsingId(userId, options);
+    },
+    impersonate(user, options) {
+      activate();
+      return runtime.impersonate(user, options);
+    },
+    impersonateById(userId, options) {
+      activate();
+      return runtime.impersonateById(userId, options);
+    },
+    impersonation() {
+      activate();
+      return runtime.impersonation();
+    },
+    stopImpersonating() {
+      activate();
+      return runtime.stopImpersonating();
+    },
+    logout() {
+      activate();
+      return runtime.logout();
+    },
+    register(input) {
+      activate();
+      return runtime.register(input);
+    },
+    logoutAll(guardName) {
+      activate();
+      return runtime.logoutAll(guardName);
+    },
+    guard(name) {
+      const guard = runtime.guard(name);
+      return Object.freeze({
+        check() {
+          activate();
+          return guard.check();
+        },
+        user() {
+          activate();
+          return guard.user();
+        },
+        refreshUser() {
+          activate();
+          return guard.refreshUser();
+        },
+        id() {
+          activate();
+          return guard.id();
+        },
+        currentAccessToken() {
+          activate();
+          return guard.currentAccessToken();
+        },
+        login(credentials) {
+          activate();
+          return guard.login(credentials);
+        },
+        loginUsing(user, options) {
+          activate();
+          return guard.loginUsing(user, options);
+        },
+        loginUsingId(userId, options) {
+          activate();
+          return guard.loginUsingId(userId, options);
+        },
+        impersonate(user, options) {
+          activate();
+          return guard.impersonate(user, options);
+        },
+        impersonateById(userId, options) {
+          activate();
+          return guard.impersonateById(userId, options);
+        },
+        impersonation() {
+          activate();
+          return guard.impersonation();
+        },
+        stopImpersonating() {
+          activate();
+          return guard.stopImpersonating();
+        },
+        logout() {
+          activate();
+          return guard.logout();
+        }
+      });
+    },
+    tokens: Object.freeze({
+      create(user, options) {
+        activate();
+        return runtime.tokens.create(user, options);
+      },
+      list(user, options) {
+        activate();
+        return runtime.tokens.list(user, options);
+      },
+      revoke(options) {
+        activate();
+        return runtime.tokens.revoke(options);
+      },
+      revokeAll(user, options) {
+        activate();
+        return runtime.tokens.revokeAll(user, options);
+      },
+      authenticate(plainTextToken) {
+        activate();
+        return runtime.tokens.authenticate(plainTextToken);
+      },
+      can(token, ability) {
+        activate();
+        return runtime.tokens.can(token, ability);
+      }
+    }),
+    verification: Object.freeze({
+      create(user, options) {
+        activate();
+        return runtime.verification.create(user, options);
+      },
+      consume(plainTextToken) {
+        activate();
+        return runtime.verification.consume(plainTextToken);
+      }
+    }),
+    passwords: Object.freeze({
+      request(email, options) {
+        activate();
+        return runtime.passwords.request(email, options);
+      },
+      consume(input) {
+        activate();
+        return runtime.passwords.consume(input);
+      }
+    })
+  });
+}
+async function loadQueueModule(required = false) {
+  const queueModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/queue");
+  if (!queueModule && required) {
+    throw new Error("[@holo-js/core] Queue support requires @holo-js/queue to be installed.");
+  }
+  return queueModule;
+}
+async function loadQueueDbModule() {
+  return portableRuntimeModuleInternals.importOptionalModule("@holo-js/queue-db");
+}
+async function loadCacheModule(required = false, projectRoot) {
+  const cacheModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/cache", {
+    projectRoot
+  });
+  if (!cacheModule && required) {
+    throw new Error("[@holo-js/core] Cache support requires @holo-js/cache to be installed.");
+  }
+  return cacheModule;
+}
+function resetCacheRuntimeGlobalsFallback() {
+  const runtime = globalThis;
+  if (runtime.__holoCacheRuntime__) {
+    runtime.__holoCacheRuntime__.bindings = void 0;
+  }
+  if (runtime.__holoCacheQueryBridge__) {
+    runtime.__holoCacheQueryBridge__.dependencyIndex = void 0;
+  }
+  if (runtime.__holoDbQueryCacheBridge__) {
+    runtime.__holoDbQueryCacheBridge__.bridge = void 0;
+  }
+}
+async function loadEventsModule(required = false) {
+  const eventsModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/events");
+  if (!eventsModule && required) {
+    throw new Error("[@holo-js/core] Events support requires @holo-js/events to be installed.");
+  }
+  return eventsModule;
+}
+async function loadSessionModule(required = false) {
+  const sessionModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/session");
+  if (!sessionModule && required) {
+    throw new Error("[@holo-js/core] Session support requires @holo-js/session to be installed.");
+  }
+  return sessionModule;
+}
+async function loadSecurityModule(required = false) {
+  const securityModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/security");
+  if (!securityModule && required) {
+    throw new Error("[@holo-js/core] Security support requires @holo-js/security to be installed.");
+  }
+  return securityModule;
+}
+async function loadSecurityRedisAdapterModule(required = false) {
+  const securityRedisAdapterModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/security/drivers/redis-adapter");
+  if (!securityRedisAdapterModule && required) {
+    throw new Error("[@holo-js/core] Redis-backed security rate limits require @holo-js/security/drivers/redis-adapter to be installed.");
+  }
+  return securityRedisAdapterModule;
+}
+async function loadSessionRedisAdapterModule(required = false) {
+  const sessionRedisAdapterModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/session/drivers/redis-adapter");
+  if (!sessionRedisAdapterModule && required) {
+    throw new Error("[@holo-js/core] Redis-backed session stores require @holo-js/session/drivers/redis-adapter to be installed.");
+  }
+  return sessionRedisAdapterModule;
+}
+async function loadNotificationsModule(required = false) {
+  const notificationsModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/notifications");
+  if (!notificationsModule && required) {
+    throw new Error("[@holo-js/core] Notifications support requires @holo-js/notifications to be installed.");
+  }
+  return notificationsModule;
+}
+async function loadBroadcastModule(required = false, projectRoot) {
+  const broadcastModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/broadcast", {
+    projectRoot
+  });
+  if (!broadcastModule && required) {
+    throw new Error("[@holo-js/core] Broadcast support requires @holo-js/broadcast to be installed.");
+  }
+  return broadcastModule;
+}
+async function loadMailModule(required = false) {
+  const mailModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/mail");
+  if (!mailModule && required) {
+    throw new Error("[@holo-js/core] Mail support requires @holo-js/mail to be installed.");
+  }
+  return mailModule;
+}
+async function loadAuthModule(required = false) {
+  const authModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/auth");
+  if (!authModule && required) {
+    throw new Error("[@holo-js/core] Auth support requires @holo-js/auth to be installed.");
+  }
+  return authModule;
+}
+async function loadAuthorizationModule(required = false) {
+  const authorizationModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/authorization");
+  if (!authorizationModule && required) {
+    throw new Error("[@holo-js/core] Authorization support requires @holo-js/authorization to be installed.");
+  }
+  return authorizationModule;
+}
+async function loadSocialModule(required = false) {
+  const socialModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/auth-social");
+  if (!socialModule && required) {
+    throw new Error("[@holo-js/core] Social auth config requires @holo-js/auth-social to be installed.");
+  }
+  return socialModule;
+}
+async function loadWorkosModule(required = false) {
+  const workosModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/auth-workos");
+  if (!workosModule && required) {
+    throw new Error("[@holo-js/core] WorkOS auth config requires @holo-js/auth-workos to be installed.");
+  }
+  return workosModule;
+}
+async function loadClerkModule(required = false) {
+  const clerkModule = await portableRuntimeModuleInternals.importOptionalModule("@holo-js/auth-clerk");
+  if (!clerkModule && required) {
+    throw new Error("[@holo-js/core] Clerk auth config requires @holo-js/auth-clerk to be installed.");
+  }
+  return clerkModule;
+}
+function resolveQueueJobExport(queueModule, moduleValue) {
+  const exports = moduleValue;
+  if (queueModule.isQueueJobDefinition(exports.default)) {
+    return exports.default;
+  }
+  return Object.values(exports).find((value) => queueModule.isQueueJobDefinition(value));
+}
+function resolveAuthorizationDefinitionExport(moduleValue, exportName, matcher) {
+  const exports = moduleValue;
+  if (exportName && exportName !== "default" && matcher(exports[exportName])) {
+    return exports[exportName];
+  }
+  if (matcher(exports.default)) {
+    return exports.default;
+  }
+  return Object.entries(exports).find(([name, value]) => name !== exportName && matcher(value))?.[1];
+}
+var HOLO_EVENT_DEFINITION_MARKER = /* @__PURE__ */ Symbol.for("holo-js.events.definition");
+var HOLO_LISTENER_DEFINITION_MARKER = /* @__PURE__ */ Symbol.for("holo-js.events.listener");
+function hasEventDefinitionMarker(value) {
+  return !!value && typeof value === "object" && HOLO_EVENT_DEFINITION_MARKER in value;
+}
+function hasListenerDefinitionMarker(value) {
+  return !!value && typeof value === "object" && HOLO_LISTENER_DEFINITION_MARKER in value;
+}
+function resolveEventExport(moduleValue) {
+  const exports = moduleValue;
+  if (hasEventDefinitionMarker(exports.default)) {
+    return exports.default;
+  }
+  return Object.values(exports).find((value) => hasEventDefinitionMarker(value));
+}
+function resolveListenerExport(eventsModule, moduleValue) {
+  const exports = moduleValue;
+  if (hasListenerDefinitionMarker(exports.default) || eventsModule.isListenerDefinition(exports.default)) {
+    return exports.default;
+  }
+  return Object.values(exports).find((value) => hasListenerDefinitionMarker(value) || eventsModule.isListenerDefinition(value));
+}
+function resolveProjectRelativePath(projectRoot, value) {
+  return value.startsWith(".") || !value.startsWith("/") ? resolve3(projectRoot, value) : value;
+}
+function normalizeDateLike(value) {
+  return value instanceof Date ? value : new Date(String(value));
+}
+function normalizeSessionRecordFromRow(row) {
+  const decodedData = (() => {
+    if (row.data && typeof row.data === "object") {
+      return row.data;
+    }
+    if (typeof row.data === "string") {
+      try {
+        const parsed = JSON.parse(row.data);
+        return parsed && typeof parsed === "object" ? parsed : {};
+      } catch {
+        return {};
+      }
+    }
+    return {};
+  })();
+  return Object.freeze({
+    id: String(row.id),
+    /* v8 ignore next -- runtime rows usually carry an explicit store name; this preserves a safe default */
+    store: typeof row.store === "string" ? row.store : "database",
+    data: Object.freeze(decodedData),
+    createdAt: normalizeDateLike(row.created_at),
+    lastActivityAt: normalizeDateLike(row.last_activity_at),
+    expiresAt: normalizeDateLike(row.expires_at),
+    rememberTokenHash: typeof row.remember_token_hash === "string" ? row.remember_token_hash : void 0
+  });
+}
+function serializeSessionRecordForRow(record) {
+  return {
+    id: record.id,
+    store: record.store,
+    /* v8 ignore next -- record.data is always present in runtime flows; nullish fallback is purely defensive */
+    data: JSON.stringify(record.data ?? {}),
+    created_at: record.createdAt.toISOString(),
+    last_activity_at: record.lastActivityAt.toISOString(),
+    expires_at: record.expiresAt.toISOString(),
+    invalidated_at: null,
+    remember_token_hash: record.rememberTokenHash ?? null
+  };
+}
+function normalizeNotificationRecordFromRow(row) {
+  const decodedData = normalizeJsonValue(row.data);
+  return Object.freeze({
+    id: String(row.id),
+    type: typeof row.type === "string" ? row.type : void 0,
+    notifiableType: String(row.notifiable_type),
+    notifiableId: typeof row.notifiable_id === "number" ? row.notifiable_id : String(row.notifiable_id),
+    data: decodedData,
+    readAt: row.read_at ? normalizeDateLike(row.read_at) : null,
+    createdAt: normalizeDateLike(row.created_at),
+    updatedAt: normalizeDateLike(row.updated_at)
+  });
+}
+function serializeNotificationRecordForRow(record) {
+  return {
+    id: record.id,
+    type: record.type ?? null,
+    notifiable_type: record.notifiableType,
+    notifiable_id: String(record.notifiableId),
+    data: JSON.stringify(record.data ?? null),
+    read_at: record.readAt ? record.readAt.toISOString() : null,
+    created_at: record.createdAt.toISOString(),
+    updated_at: record.updatedAt.toISOString()
+  };
+}
+function getEntityAttributes(value) {
+  if (value && typeof value === "object") {
+    const candidate = value;
+    if (typeof candidate.toAttributes === "function") {
+      return candidate.toAttributes();
+    }
+    if (typeof candidate.toJSON === "function") {
+      const serialized = candidate.toJSON();
+      if (serialized && typeof serialized === "object") {
+        return serialized;
+      }
+    }
+    return value;
+  }
+  return {};
+}
+function markProviderUser(value, providerName) {
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  try {
+    Object.defineProperty(value, HOLO_AUTH_PROVIDER_MARKER, {
+      value: providerName,
+      enumerable: false,
+      configurable: true
+    });
+  } catch {
+  }
+  return value;
+}
+async function createCoreManagedSessionStores(projectRoot, loadedConfig, sessionModule) {
+  const stores = {};
+  const redisAdapters = [];
+  for (const [name, config] of Object.entries(loadedConfig.session.stores)) {
+    if (config.driver === "file") {
+      stores[name] = sessionModule.createFileSessionStore(resolveProjectRelativePath(projectRoot, config.path));
+      continue;
+    }
+    if (config.driver === "database") {
+      const connectionName = config.connection === "default" && !(config.connection in loadedConfig.database.connections) ? loadedConfig.database.defaultConnection : config.connection;
+      stores[name] = sessionModule.createDatabaseSessionStore({
+        async read(sessionId) {
+          const row = await DB.table(config.table, connectionName).where("id", sessionId).whereNull("invalidated_at").first();
+          return row ? normalizeSessionRecordFromRow(row) : null;
+        },
+        async write(record) {
+          const normalized = serializeSessionRecordForRow(record);
+          const existing = await DB.table(config.table, connectionName).find(String(normalized.id));
+          if (existing) {
+            await DB.table(config.table, connectionName).where("id", normalized.id).update(normalized);
+            return;
+          }
+          await DB.table(config.table, connectionName).insert(normalized);
+        },
+        async delete(sessionId) {
+          await DB.table(config.table, connectionName).where("id", sessionId).delete();
+        }
+      });
+      continue;
+    }
+    if (config.driver === "redis") {
+      const sessionRedisAdapterModule = await loadSessionRedisAdapterModule(true);
+      const adapter = sessionRedisAdapterModule.createSessionRedisAdapter(config);
+      try {
+        await adapter.connect?.();
+        redisAdapters.push(adapter);
+        const store = sessionModule.createRedisSessionStore(adapter);
+        stores[name] = store;
+      } catch (error) {
+        const originalError = error;
+        const cleanupResults = await Promise.allSettled([
+          closeSessionRedisAdapter(adapter),
+          ...redisAdapters.filter((existingAdapter) => existingAdapter !== adapter).map((existingAdapter) => closeSessionRedisAdapter(existingAdapter))
+        ]);
+        const cleanupErrors = cleanupResults.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+        if (cleanupErrors.length > 0 && originalError instanceof Error) {
+          Object.defineProperty(originalError, "cleanupErrors", {
+            value: Object.freeze(cleanupErrors),
+            configurable: true,
+            enumerable: false
+          });
+        }
+        throw originalError;
+      }
+      continue;
+    }
+  }
+  if (!(loadedConfig.session.driver in stores)) {
+    throw new Error(
+      `[@holo-js/core] Session driver "${loadedConfig.session.driver}" is configured but the runtime cannot boot it automatically.`
+    );
+  }
+  return Object.freeze({
+    stores: Object.freeze(stores),
+    redisAdapters: Object.freeze(redisAdapters)
+  });
+}
+async function createCoreSessionStores(projectRoot, loadedConfig, sessionModule) {
+  return (await createCoreManagedSessionStores(projectRoot, loadedConfig, sessionModule)).stores;
+}
+function createCoreNotificationStore(loadedConfig) {
+  const tableName = loadedConfig.notifications.table;
+  const connectionName = loadedConfig.database.defaultConnection;
+  const store = {
+    async create(record) {
+      await DB.table(tableName, connectionName).insert(serializeNotificationRecordForRow(record));
+    },
+    async list(notifiable) {
+      const rows = await DB.table(tableName, connectionName).where("notifiable_type", notifiable.type).where("notifiable_id", String(notifiable.id)).orderBy("created_at", "desc").get();
+      return Object.freeze(rows.map((row) => normalizeNotificationRecordFromRow(row)));
+    },
+    async unread(notifiable) {
+      const rows = await DB.table(tableName, connectionName).where("notifiable_type", notifiable.type).where("notifiable_id", String(notifiable.id)).whereNull("read_at").orderBy("created_at", "desc").get();
+      return Object.freeze(rows.map((row) => normalizeNotificationRecordFromRow(row)));
+    },
+    async markAsRead(ids) {
+      if (ids.length === 0) {
+        return 0;
+      }
+      const result = await DB.table(tableName, connectionName).whereIn("id", ids).update({
+        read_at: (/* @__PURE__ */ new Date()).toISOString(),
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return result.affectedRows ?? 0;
+    },
+    async markAsUnread(ids) {
+      if (ids.length === 0) {
+        return 0;
+      }
+      const result = await DB.table(tableName, connectionName).whereIn("id", ids).update({
+        read_at: null,
+        updated_at: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      return result.affectedRows ?? 0;
+    },
+    async delete(ids) {
+      if (ids.length === 0) {
+        return 0;
+      }
+      const result = await DB.table(tableName, connectionName).whereIn("id", ids).delete();
+      return result.affectedRows ?? 0;
+    }
+  };
+  return Object.freeze(store);
+}
+function createAuthNotificationsDeliveryHook(notificationsModule) {
+  return Object.freeze({
+    async sendEmailVerification(input) {
+      const recipientName = typeof input.user?.name === "string" ? input.user.name?.trim() : void 0;
+      const notification = notificationsModule.defineNotification({
+        type: "auth.email-verification",
+        via() {
+          return ["email"];
+        },
+        build: {
+          email() {
+            return {
+              subject: "Verify your email address",
+              ...recipientName ? { greeting: `Hello ${recipientName},` } : {},
+              lines: [
+                "Use this token to verify your email address:",
+                input.token.plainTextToken,
+                `Provider: ${input.provider}`,
+                `Expires at: ${input.token.expiresAt.toISOString()}`
+              ],
+              metadata: {
+                provider: input.provider,
+                tokenId: input.token.id
+              }
+            };
+          }
+        }
+      });
+      await notificationsModule.notifyUsing().channel("email", recipientName ? {
+        email: input.email,
+        name: recipientName
+      } : input.email).notify(notification);
+    },
+    async sendPasswordReset(input) {
+      const notification = notificationsModule.defineNotification({
+        type: "auth.password-reset",
+        via() {
+          return ["email"];
+        },
+        build: {
+          email() {
+            return {
+              subject: "Reset your password",
+              lines: [
+                "Use this token to reset your password:",
+                input.token.plainTextToken,
+                `Provider: ${input.provider}`,
+                `Expires at: ${input.token.expiresAt.toISOString()}`
+              ],
+              metadata: {
+                provider: input.provider,
+                tokenId: input.token.id
+              }
+            };
+          }
+        }
+      });
+      await notificationsModule.notifyUsing().channel("email", input.email).notify(notification);
+    }
+  });
+}
+function createCoreNotificationBroadcaster(broadcastModule) {
+  const normalizeChannels = (route) => {
+    if (typeof route === "string") {
+      const value = route.trim();
+      if (value) {
+        return Object.freeze([value]);
+      }
+    }
+    if (Array.isArray(route)) {
+      const channels = route.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean);
+      if (channels.length > 0) {
+        return Object.freeze(channels);
+      }
+    }
+    if (route && typeof route === "object" && "channels" in route && Array.isArray(route.channels)) {
+      const channels = route.channels.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean);
+      if (channels.length > 0) {
+        return Object.freeze(channels);
+      }
+    }
+    throw new Error("[@holo-js/core] Broadcast notifications require at least one resolved channel route.");
+  };
+  return Object.freeze({
+    async send(message, context) {
+      const channels = normalizeChannels(context.route);
+      const event = typeof message.event === "string" && message.event.trim() ? message.event.trim() : "notifications.message";
+      await broadcastModule.broadcastRaw({
+        event,
+        channels,
+        payload: Object.freeze({
+          ...typeof context.notificationType === "string" && context.notificationType.trim() ? { type: context.notificationType.trim() } : {},
+          data: message.data ?? null
+        })
+      });
+    }
+  });
+}
+function createCoreBroadcastPublisher(loadedConfig) {
+  const connectionHosts = /* @__PURE__ */ new Set(["holo", "pusher"]);
+  const publish = async (input, context) => {
+    const connection = loadedConfig.connections[input.connection];
+    if (!connection) {
+      throw new Error(`[@holo-js/core] Broadcast connection "${input.connection}" is not configured.`);
+    }
+    if (!("appId" in connection) || !("key" in connection) || !("secret" in connection)) {
+      throw new Error(`[@holo-js/core] Broadcast connection "${input.connection}" cannot be published automatically.`);
+    }
+    if (!connectionHosts.has(connection.driver)) {
+      throw new Error(`[@holo-js/core] Broadcast connection "${input.connection}" cannot be published automatically.`);
+    }
+    const options = connection.options;
+    const protocol = options.scheme === "http" ? "http:" : "https:";
+    const url = new URL(`/apps/${encodeURIComponent(connection.appId)}/events`, `${protocol}//${options.host}`);
+    if (typeof options.port === "number") {
+      url.port = String(options.port);
+    }
+    const body = JSON.stringify({
+      name: input.event,
+      channels: input.channels,
+      data: JSON.stringify(input.payload),
+      /* v8 ignore next -- tests do not pass socketId through the publish binding */
+      ...typeof input.socketId === "undefined" ? {} : { socket_id: input.socketId }
+    });
+    const bodyMd5 = createHash("md5").update(body).digest("hex");
+    url.searchParams.set("auth_key", connection.key);
+    url.searchParams.set("auth_timestamp", String(Math.floor(Date.now() / 1e3)));
+    url.searchParams.set("auth_version", "1.0");
+    url.searchParams.set("body_md5", bodyMd5);
+    url.searchParams.set(
+      "auth_signature",
+      createHmac("sha256", connection.secret).update(
+        [
+          "POST",
+          url.pathname,
+          [...url.searchParams.entries()].filter(([key]) => key !== "auth_signature").sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&")
+        ].join("\n")
+      ).digest("hex")
+    );
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), BROADCAST_PUBLISH_TIMEOUT_MS);
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json"
+        },
+        body,
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new Error(`[@holo-js/core] Broadcast publish request timed out after ${BROADCAST_PUBLISH_TIMEOUT_MS}ms.`);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!response.ok) {
+      throw new Error(`[@holo-js/core] Broadcast publish request failed with status ${response.status}.`);
+    }
+    const result = await response.json();
+    return {
+      connection: input.connection,
+      driver: connection.driver,
+      queued: context.queued,
+      publishedChannels: Array.isArray(result.deliveredChannels) ? Object.freeze(result.deliveredChannels.map((value) => String(value))) : Object.freeze([...input.channels])
+    };
+  };
+  Object.defineProperty(publish, CORE_BROADCAST_PUBLISHER_MARKER, {
+    value: true
+  });
+  return publish;
+}
+function isCoreBroadcastPublisher(value) {
+  return typeof value === "function" && CORE_BROADCAST_PUBLISHER_MARKER in value;
+}
+function createNotificationMailText(message) {
+  const parts = [
+    typeof message.greeting === "string" ? message.greeting.trim() : void 0,
+    ...(message.lines ?? []).map((line) => line.trim()).filter(Boolean),
+    message.action ? `${message.action.label}: ${message.action.url}` : void 0
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  return parts.length > 0 ? parts.join("\n\n") : void 0;
+}
+function createCoreNotificationMailSender(mailModule) {
+  return Object.freeze({
+    async send(message, context) {
+      const route = context.route;
+      if (!route) {
+        throw new Error("[@holo-js/core] Email notifications require a resolved email route before bridging into mail.");
+      }
+      const fallbackText = createNotificationMailText(message);
+      await mailModule.sendMail({
+        to: route,
+        subject: message.subject,
+        ...typeof message.html === "string" ? { html: message.html } : {},
+        ...typeof (message.text ?? fallbackText) === "string" ? { text: message.text ?? fallbackText } : {},
+        ...typeof message.html !== "string" && typeof (message.text ?? fallbackText) === "string" ? { text: message.text ?? fallbackText } : {},
+        ...message.metadata ? { metadata: message.metadata } : {}
+      });
+    }
+  });
+}
+function createAuthMailDeliveryHook(mailModule) {
+  return Object.freeze({
+    async sendEmailVerification(input) {
+      const recipientName = typeof input.user?.name === "string" ? input.user.name?.trim() : void 0;
+      await mailModule.sendMail({
+        to: {
+          email: input.email,
+          ...recipientName ? { name: recipientName } : {}
+        },
+        subject: "Verify your email address",
+        text: [
+          recipientName ? `Hello ${recipientName},` : void 0,
+          "Use this token to verify your email address:",
+          input.token.plainTextToken,
+          `Provider: ${input.provider}`,
+          `Expires at: ${input.token.expiresAt.toISOString()}`
+        ].filter((value) => typeof value === "string").join("\n\n"),
+        metadata: {
+          provider: input.provider,
+          tokenId: input.token.id
+        }
+      });
+    },
+    async sendPasswordReset(input) {
+      await mailModule.sendMail({
+        to: input.email,
+        subject: "Reset your password",
+        text: [
+          "Use this token to reset your password:",
+          input.token.plainTextToken,
+          `Provider: ${input.provider}`,
+          `Expires at: ${input.token.expiresAt.toISOString()}`
+        ].join("\n\n"),
+        metadata: {
+          provider: input.provider,
+          tokenId: input.token.id
+        }
+      });
+    }
+  });
+}
+async function loadConfiguredSocialProviders(projectRootOrLoadedConfig, maybeLoadedConfig) {
+  const projectRoot = typeof projectRootOrLoadedConfig === "string" ? projectRootOrLoadedConfig : process.cwd();
+  const loadedConfig = typeof projectRootOrLoadedConfig === "string" ? maybeLoadedConfig : projectRootOrLoadedConfig;
+  const socialConfig = loadedConfig?.auth?.social ?? {};
+  const providers = {};
+  for (const providerName of Object.keys(socialConfig)) {
+    const configuredRuntime = socialConfig[providerName]?.runtime?.trim();
+    const packageName = configuredRuntime || `@holo-js/auth-social-${providerName}`;
+    const moduleValue = await portableRuntimeModuleInternals.importOptionalModule(packageName, {
+      projectRoot
+    });
+    if (!moduleValue) {
+      throw new Error(`[@holo-js/core] Social provider "${providerName}" requires ${packageName} to be installed.`);
+    }
+    const runtime = moduleValue.default ?? moduleValue[`${providerName}SocialProvider`] ?? moduleValue.socialProvider;
+    if (!runtime) {
+      throw new Error(`[@holo-js/core] Social provider package "${packageName}" did not export a runtime.`);
+    }
+    providers[providerName] = runtime;
+  }
+  return Object.freeze(providers);
+}
+function normalizeDateValue(value) {
+  return value instanceof Date ? value : new Date(String(value));
+}
+function normalizeJsonValue(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function normalizeStoredUserId(value) {
+  return typeof value === "number" ? value : String(value);
+}
+function normalizeAccessTokenRecord(row) {
+  const abilities = normalizeJsonValue(row.abilities);
+  return Object.freeze({
+    id: String(row.id),
+    provider: String(row.provider),
+    userId: normalizeStoredUserId(row.user_id),
+    name: String(row.name),
+    abilities: Array.isArray(abilities) ? Object.freeze([...abilities]) : Object.freeze([]),
+    tokenHash: String(row.token_hash),
+    createdAt: normalizeDateValue(row.created_at),
+    lastUsedAt: row.last_used_at ? normalizeDateValue(row.last_used_at) : void 0,
+    expiresAt: row.expires_at ? normalizeDateValue(row.expires_at) : null
+  });
+}
+function serializeAccessTokenRecord(record) {
+  return {
+    id: record.id,
+    provider: record.provider,
+    user_id: String(record.userId),
+    name: record.name,
+    abilities: JSON.stringify(record.abilities),
+    token_hash: record.tokenHash,
+    created_at: record.createdAt.toISOString(),
+    last_used_at: record.lastUsedAt?.toISOString() ?? null,
+    expires_at: record.expiresAt?.toISOString() ?? null,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function normalizeEmailVerificationTokenRecord(row) {
+  return Object.freeze({
+    id: String(row.id),
+    provider: String(row.provider),
+    userId: normalizeStoredUserId(row.user_id),
+    email: String(row.email),
+    tokenHash: String(row.token_hash),
+    createdAt: normalizeDateValue(row.created_at),
+    expiresAt: normalizeDateValue(row.expires_at)
+  });
+}
+function serializeEmailVerificationTokenRecord(record) {
+  return {
+    id: record.id,
+    provider: record.provider,
+    user_id: String(record.userId),
+    email: record.email,
+    token_hash: record.tokenHash,
+    created_at: record.createdAt.toISOString(),
+    expires_at: record.expiresAt.toISOString(),
+    used_at: null,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function normalizePasswordResetTokenRecord(row) {
+  return Object.freeze({
+    id: String(row.id),
+    provider: typeof row.provider === "string" ? row.provider : "users",
+    email: String(row.email),
+    table: typeof row.__holo_table === "string" ? row.__holo_table : void 0,
+    tokenHash: String(row.token_hash),
+    createdAt: normalizeDateValue(row.created_at),
+    expiresAt: normalizeDateValue(row.expires_at)
+  });
+}
+function serializePasswordResetTokenRecord(record) {
+  return {
+    id: record.id,
+    provider: record.provider,
+    email: record.email,
+    token_hash: record.tokenHash,
+    created_at: record.createdAt.toISOString(),
+    expires_at: record.expiresAt.toISOString(),
+    used_at: null,
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function createCoreSocialBindings(projectRootOrLoadedConfig, loadedConfigOrSessionModule, maybeSessionModule) {
+  const projectRoot = typeof projectRootOrLoadedConfig === "string" ? projectRootOrLoadedConfig : process.cwd();
+  const loadedConfig = typeof projectRootOrLoadedConfig === "string" ? loadedConfigOrSessionModule : projectRootOrLoadedConfig;
+  const sessionModule = typeof projectRootOrLoadedConfig === "string" ? maybeSessionModule : loadedConfigOrSessionModule;
+  const providers = await loadConfiguredSocialProviders(projectRoot, loadedConfig);
+  const sessionRuntime = sessionModule.getSessionRuntime();
+  const stateStore = Object.freeze({
+    async create(record) {
+      await sessionRuntime.create({
+        id: `oauth:${record.provider}:${record.state}`,
+        data: {
+          provider: record.provider,
+          state: record.state,
+          codeVerifier: record.codeVerifier,
+          guard: record.guard,
+          createdAt: record.createdAt.toISOString()
+        }
+      });
+    },
+    async read(provider, state) {
+      const record = await sessionRuntime.read(`oauth:${provider}:${state}`);
+      if (!record || typeof record !== "object" || !("data" in record)) {
+        return null;
+      }
+      const data = record.data;
+      if (!data || typeof data.codeVerifier !== "string" || typeof data.guard !== "string") {
+        return null;
+      }
+      return {
+        provider,
+        state,
+        codeVerifier: data.codeVerifier,
+        guard: data.guard,
+        createdAt: normalizeDateValue(data.createdAt ?? /* @__PURE__ */ new Date())
+      };
+    },
+    async delete(provider, state) {
+      await sessionRuntime.invalidate(`oauth:${provider}:${state}`);
+    }
+  });
+  const identityStore = Object.freeze({
+    async findByProviderUserId(provider, providerUserId) {
+      const row = await DB.table("auth_identities").where("provider", provider).where("provider_user_id", providerUserId).first();
+      if (!row) {
+        return null;
+      }
+      return {
+        provider: String(row.provider ?? provider),
+        providerUserId: String(row.provider_user_id ?? providerUserId),
+        guard: String(row.guard ?? loadedConfig.auth.defaults.guard),
+        authProvider: String(
+          row.auth_provider ?? loadedConfig.auth.guards[String(row.guard ?? loadedConfig.auth.defaults.guard)]?.provider ?? loadedConfig.auth.guards[loadedConfig.auth.defaults.guard]?.provider ?? "users"
+        ),
+        userId: normalizeStoredUserId(row.user_id),
+        email: typeof row.email === "string" ? row.email : void 0,
+        emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
+        profile: typeof normalizeJsonValue(row.profile) === "object" && normalizeJsonValue(row.profile) ? normalizeJsonValue(row.profile) : {},
+        tokens: normalizeJsonValue(row.tokens),
+        linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
+        updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
+      };
+    },
+    async save(record) {
+      const value = record;
+      const existing = await DB.table("auth_identities").where("provider", value.provider).where("provider_user_id", value.providerUserId).first();
+      const payload = {
+        user_id: String(value.userId),
+        provider: value.provider,
+        provider_user_id: value.providerUserId,
+        guard: value.guard,
+        auth_provider: value.authProvider,
+        email: value.email ?? null,
+        email_verified: value.emailVerified ? 1 : 0,
+        profile: JSON.stringify(value.profile),
+        tokens: JSON.stringify(value.tokens ?? {}),
+        created_at: value.linkedAt.toISOString(),
+        updated_at: value.updatedAt.toISOString()
+      };
+      if (existing && typeof existing.id !== "undefined") {
+        await DB.table("auth_identities").where("id", existing.id).update(payload);
+        return;
+      }
+      await DB.table("auth_identities").insert(payload);
+    }
+  });
+  return Object.freeze({
+    providers,
+    stateStore,
+    identityStore
+  });
+}
+function toHostedIdentityProviderValue(namespace, provider) {
+  return `${namespace}:${provider}`;
+}
+function fromHostedIdentityProviderValue(namespace, provider) {
+  const prefix = `${namespace}:`;
+  return provider.startsWith(prefix) ? provider.slice(prefix.length) : provider;
+}
+function createCoreHostedIdentityStore(namespace) {
+  return Object.freeze({
+    async findByProviderUserId(provider, providerUserId) {
+      const providerValue = toHostedIdentityProviderValue(namespace, provider);
+      const row = await DB.table("auth_identities").where("provider", providerValue).where("provider_user_id", providerUserId).first();
+      if (!row) {
+        return null;
+      }
+      return {
+        provider: fromHostedIdentityProviderValue(namespace, String(row.provider ?? provider)),
+        providerUserId: String(row.provider_user_id ?? providerUserId),
+        guard: String(row.guard ?? "web"),
+        authProvider: String(row.auth_provider ?? "users"),
+        userId: normalizeStoredUserId(row.user_id),
+        email: typeof row.email === "string" ? row.email : void 0,
+        emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
+        profile: typeof normalizeJsonValue(row.profile) === "object" && normalizeJsonValue(row.profile) ? normalizeJsonValue(row.profile) : {},
+        linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
+        updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
+      };
+    },
+    async findByUserId(provider, authProvider, userId) {
+      const providerValue = toHostedIdentityProviderValue(namespace, provider);
+      const row = await DB.table("auth_identities").where("provider", providerValue).where("auth_provider", authProvider).where("user_id", String(userId)).first();
+      if (!row) {
+        return null;
+      }
+      return {
+        provider: fromHostedIdentityProviderValue(namespace, String(row.provider ?? provider)),
+        providerUserId: String(row.provider_user_id),
+        guard: String(row.guard ?? "web"),
+        authProvider: String(row.auth_provider ?? authProvider),
+        userId: normalizeStoredUserId(row.user_id),
+        email: typeof row.email === "string" ? row.email : void 0,
+        emailVerified: row.email_verified === true || row.email_verified === 1 || row.email_verified === "1",
+        profile: typeof normalizeJsonValue(row.profile) === "object" && normalizeJsonValue(row.profile) ? normalizeJsonValue(row.profile) : {},
+        linkedAt: normalizeDateValue(row.created_at ?? /* @__PURE__ */ new Date()),
+        updatedAt: normalizeDateValue(row.updated_at ?? /* @__PURE__ */ new Date())
+      };
+    },
+    async save(record) {
+      const value = record;
+      const providerValue = toHostedIdentityProviderValue(namespace, value.provider);
+      const existing = await DB.table("auth_identities").where("provider", providerValue).where("provider_user_id", value.providerUserId).first();
+      const payload = {
+        user_id: String(value.userId),
+        provider: providerValue,
+        provider_user_id: value.providerUserId,
+        guard: value.guard,
+        auth_provider: value.authProvider,
+        email: value.email ?? null,
+        email_verified: value.emailVerified ? 1 : 0,
+        profile: JSON.stringify(value.profile),
+        created_at: value.linkedAt.toISOString(),
+        updated_at: value.updatedAt.toISOString()
+      };
+      if (existing && typeof existing.id !== "undefined") {
+        await DB.table("auth_identities").where("id", existing.id).update(payload);
+        return;
+      }
+      await DB.table("auth_identities").insert(payload);
+    }
+  });
+}
+function createCoreAuthStores(loadedConfig) {
+  return Object.freeze({
+    tokens: Object.freeze({
+      async create(record) {
+        await DB.table("personal_access_tokens").insert(serializeAccessTokenRecord(record));
+      },
+      async findById(id) {
+        const row = await DB.table("personal_access_tokens").find(id);
+        return row ? normalizeAccessTokenRecord(row) : null;
+      },
+      async listByUserId(provider, userId) {
+        const rows = await DB.table("personal_access_tokens").where("provider", provider).where("user_id", String(userId)).get();
+        return Object.freeze(rows.map((row) => normalizeAccessTokenRecord(row)));
+      },
+      async update(record) {
+        const payload = serializeAccessTokenRecord(record);
+        await DB.table("personal_access_tokens").where("id", String(payload.id)).update(payload);
+      },
+      async delete(id) {
+        await DB.table("personal_access_tokens").where("id", id).delete();
+      },
+      async deleteByUserId(provider, userId) {
+        const result = await DB.table("personal_access_tokens").where("provider", provider).where("user_id", String(userId)).delete();
+        return result.affectedRows ?? 0;
+      }
+    }),
+    emailVerificationTokens: Object.freeze({
+      async create(record) {
+        await DB.table("email_verification_tokens").insert(serializeEmailVerificationTokenRecord(record));
+      },
+      async findById(id) {
+        const row = await DB.table("email_verification_tokens").where("id", id).whereNull("used_at").first();
+        return row ? normalizeEmailVerificationTokenRecord(row) : null;
+      },
+      async delete(id) {
+        await DB.table("email_verification_tokens").where("id", id).delete();
+      },
+      async deleteByUserId(provider, userId) {
+        const result = await DB.table("email_verification_tokens").where("provider", provider).where("user_id", String(userId)).delete();
+        return result.affectedRows ?? 0;
+      }
+    }),
+    passwordResetTokens: Object.freeze({
+      async create(record) {
+        const value = record;
+        await DB.table(value.table ?? "password_reset_tokens").insert(serializePasswordResetTokenRecord(value));
+      },
+      async findById(id) {
+        const tables = Array.from(new Set(
+          Object.values(loadedConfig.auth.passwords).map((config) => config.table)
+        ));
+        for (const table of tables) {
+          const row = await DB.table(table).where("id", id).whereNull("used_at").first();
+          if (row) {
+            return normalizePasswordResetTokenRecord({
+              ...row,
+              __holo_table: table
+            });
+          }
+        }
+        return null;
+      },
+      async findLatestByEmail(provider, email, options) {
+        const table = options?.table ?? "password_reset_tokens";
+        const row = await DB.table(table).where("provider", provider).where("email", email).latest("created_at").first();
+        if (!row) {
+          return null;
+        }
+        return normalizePasswordResetTokenRecord({
+          ...row,
+          __holo_table: table
+        });
+      },
+      async delete(id, options) {
+        const table = options?.table ?? "password_reset_tokens";
+        await DB.table(table).where("id", id).delete();
+      },
+      async deleteByEmail(provider, email, options) {
+        const table = options?.table ?? "password_reset_tokens";
+        const result = await DB.table(table).where("provider", provider).where("email", email).delete();
+        return result.affectedRows ?? 0;
+      }
+    })
+  });
+}
+async function resolveAuthProviderRuntime(projectRoot, loadedConfig, modelName) {
+  const modelsRoot = resolve3(projectRoot, loadedConfig.app.paths.models);
+  for (const extension of [".ts", ".mts", ".js", ".mjs", ".cts", ".cjs"]) {
+    const candidate = resolve3(modelsRoot, `${modelName}${extension}`);
+    try {
+      const moduleValue = await importRuntimeModule(projectRoot, candidate);
+      if ("default" in moduleValue) {
+        return moduleValue;
+      }
+    } catch (error) {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+        continue;
+      }
+      if (error instanceof Error && /Could not resolve|Cannot find module|ENOENT/.test(error.message)) {
+        const normalizedCandidate = candidate.replaceAll("\\", "/");
+        const normalizedMessage = error.message.replaceAll("\\", "/");
+        const escapedCandidate = normalizedCandidate.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const missingModulePattern = new RegExp(`(?:Cannot find module|Could not resolve|Failed to load url)\\s+['"]${escapedCandidate}['"]`);
+        const enotentPathMatch = normalizedMessage.match(/ENOENT.*?(?:open|scandir|stat).*?['"]([^'"]+)['"]/);
+        if (missingModulePattern.test(normalizedMessage) || enotentPathMatch?.[1]?.endsWith(normalizedCandidate)) {
+          continue;
+        }
+      }
+      throw error;
+    }
+  }
+  throw new Error(`[@holo-js/core] Auth provider model "${modelName}" could not be resolved from ${modelsRoot}.`);
+}
+async function createCoreAuthProviders(projectRoot, loadedConfig) {
+  const providers = Object.entries(loadedConfig.auth.providers);
+  return Object.freeze(Object.fromEntries(await Promise.all(providers.map(async ([providerName, providerConfig]) => {
+    const resolvedModule = await resolveAuthProviderRuntime(projectRoot, loadedConfig, providerConfig.model);
+    const model = resolvedModule.default;
+    const throwPendingSchema = () => {
+      throw new Error(
+        `[@holo-js/core] Auth provider model "${providerConfig.model}" is pending generated schema output. Run the schema generator before using auth.`
+      );
+    };
+    if (typeof model === "undefined" && resolvedModule.holoModelPendingSchema === true) {
+      const pendingAdapter = {
+        async findById() {
+          throwPendingSchema();
+        },
+        async findByCredentials() {
+          throwPendingSchema();
+        },
+        async create() {
+          throwPendingSchema();
+        },
+        async update() {
+          throwPendingSchema();
+        },
+        matchesUser() {
+          return false;
+        },
+        getId() {
+          throwPendingSchema();
+        },
+        getPasswordHash() {
+          throwPendingSchema();
+        },
+        getEmailVerifiedAt() {
+          throwPendingSchema();
+        },
+        serialize() {
+          throwPendingSchema();
+        }
+      };
+      return [providerName, pendingAdapter];
+    }
+    const sanitizeAuthWriteInput = (input, options = {}) => {
+      const definition = model.definition;
+      const knownColumns = new Set(Object.keys(definition?.table?.columns ?? {}));
+      const fillable = new Set(definition?.fillable ?? []);
+      const guarded = new Set(definition?.guarded ?? []);
+      const hasKnownColumns = knownColumns.size > 0;
+      const enforceFillable = options.enforceFillable !== false;
+      const output = {};
+      for (const [column, value] of Object.entries(input)) {
+        if (hasKnownColumns && !knownColumns.has(column)) {
+          continue;
+        }
+        if (guarded.has("*")) {
+          continue;
+        }
+        const writable = !enforceFillable ? !guarded.has(column) : fillable.has("*") ? !guarded.has(column) : definition?.hasExplicitFillable === true || fillable.size > 0 ? fillable.has(column) && !guarded.has(column) : !guarded.has(column);
+        if (writable) {
+          output[column] = value;
+        }
+      }
+      return output;
+    };
+    const prepareAuthCreateInput = async (input) => {
+      const sanitizedInput = sanitizeAuthWriteInput(input);
+      if (typeof resolvedModule.prepareAuthCreateInput !== "function") {
+        return sanitizedInput;
+      }
+      return sanitizeAuthWriteInput(await resolvedModule.prepareAuthCreateInput(sanitizedInput), {
+        enforceFillable: false
+      });
+    };
+    const prepareAuthUpdateInput = async (user, input) => {
+      const sanitizedInput = sanitizeAuthWriteInput(input);
+      if (typeof resolvedModule.prepareAuthUpdateInput !== "function") {
+        return sanitizedInput;
+      }
+      return sanitizeAuthWriteInput(await resolvedModule.prepareAuthUpdateInput(user, sanitizedInput), {
+        enforceFillable: false
+      });
+    };
+    const adapter = {
+      async findById(id) {
+        const resolved = await model.find(id);
+        return resolved ? markProviderUser(resolved, providerName) : null;
+      },
+      async findByCredentials(credentials) {
+        const entries = Object.entries(credentials);
+        if (entries.length === 0) {
+          return null;
+        }
+        if (typeof model.query === "function") {
+          let query2 = model.query();
+          for (const [column, value] of entries) {
+            query2 = query2.where(column, value);
+          }
+          const resolved2 = await query2.first();
+          return resolved2 ? markProviderUser(resolved2, providerName) : null;
+        }
+        let query = model.where(entries[0][0], entries[0][1]);
+        for (const [column, value] of entries.slice(1)) {
+          if (typeof query.where !== "function") {
+            break;
+          }
+          query = query.where(column, value);
+        }
+        const resolved = await query.first();
+        return resolved ? markProviderUser(resolved, providerName) : null;
+      },
+      async create(input) {
+        return markProviderUser(await model.create(await prepareAuthCreateInput(input)), providerName);
+      },
+      /* v8 ignore start -- adapter shape mirrors the auth package contract; core tests cover the wired runtime behavior */
+      async update(user, input) {
+        return markProviderUser(
+          await model.update(getEntityAttributes(user).id, await prepareAuthUpdateInput(user, input)),
+          providerName
+        );
+      },
+      matchesUser(user) {
+        if (typeof model === "function" && user instanceof model) {
+          return true;
+        }
+        if (user && typeof user === "object" && user[HOLO_AUTH_PROVIDER_MARKER] === providerName) {
+          return true;
+        }
+        return getEntityAttributes(user)[HOLO_AUTH_PROVIDER_MARKER] === providerName;
+      },
+      getId(user) {
+        return getEntityAttributes(user).id;
+      },
+      getPasswordHash(user) {
+        const value = getEntityAttributes(user).password;
+        return typeof value === "string" ? value : null;
+      },
+      getEmailVerifiedAt(user) {
+        const value = getEntityAttributes(user).email_verified_at;
+        return value instanceof Date || typeof value === "string" ? value : null;
+      },
+      serialize(user) {
+        const serialized = user && typeof user === "object" && typeof user.toJSON === "function" ? user.toJSON() : { ...getEntityAttributes(user) };
+        Object.defineProperty(serialized, HOLO_AUTH_PROVIDER_MARKER, {
+          value: providerName,
+          enumerable: false,
+          configurable: true
+        });
+        return serialized;
+      }
+      /* v8 ignore stop */
+    };
+    return [providerName, adapter];
+  }))));
+}
+async function importRuntimeModule(projectRoot, filePath) {
+  return importBundledRuntimeModule(projectRoot, filePath);
+}
+async function registerProjectQueueJobs(projectRoot, registry, queueModule) {
+  if (!registry || registry.jobs.length === 0) {
+    return Object.freeze([]);
+  }
+  const registeredJobNames = [];
+  try {
+    for (const entry of registry.jobs) {
+      const existing = queueModule.getRegisteredQueueJob(entry.name);
+      if (existing && !existing.sourcePath) {
+        continue;
+      }
+      const moduleValue = await importRuntimeModule(projectRoot, resolve3(projectRoot, entry.sourcePath));
+      const job = resolveQueueJobExport(queueModule, moduleValue);
+      if (!job) {
+        throw new Error(`Discovered job "${entry.sourcePath}" does not export a Holo job.`);
+      }
+      queueModule.registerQueueJob(queueModule.normalizeQueueJobDefinition(job), {
+        name: entry.name,
+        sourcePath: entry.sourcePath,
+        replaceExisting: !!existing?.sourcePath
+      });
+      registeredJobNames.push(entry.name);
+    }
+  } catch (error) {
+    unregisterProjectQueueJobs(queueModule, registeredJobNames);
+    throw error;
+  }
+  return Object.freeze(registeredJobNames);
+}
+function unregisterProjectQueueJobs(queueModule, jobNames) {
+  if (!queueModule) {
+    return;
+  }
+  for (const jobName of jobNames) {
+    queueModule.unregisterQueueJob(jobName);
+  }
+}
+function withCanonicalAuthorizationDefinitionName(definition, name) {
+  if (definition.name === name) {
+    return definition;
+  }
+  return {
+    ...definition,
+    name
+  };
+}
+function withCanonicalAuthorizationAbilityName(definition, name) {
+  if (definition.name === name) {
+    return definition;
+  }
+  return {
+    ...definition,
+    name
+  };
+}
+async function registerProjectAuthorizationDefinitions(projectRoot, registry, authorizationModule) {
+  if (!registry || !registry.authorizationPolicies.length && !registry.authorizationAbilities.length) {
+    return Object.freeze({
+      policyNames: Object.freeze([]),
+      abilityNames: Object.freeze([])
+    });
+  }
+  if (!authorizationModule) {
+    throw new Error("[@holo-js/core] Authorization support requires @holo-js/authorization to be installed.");
+  }
+  const registeredPolicyNames = [];
+  const registeredAbilityNames = [];
+  const previousPolicies = /* @__PURE__ */ new Map();
+  const previousAbilities = /* @__PURE__ */ new Map();
+  try {
+    for (const entry of registry.authorizationPolicies) {
+      const existing = authorizationModule.authorizationInternals.getAuthorizationRuntimeState().policiesByName.get(entry.name);
+      if (existing) {
+        previousPolicies.set(entry.name, existing);
+        authorizationModule.authorizationInternals.unregisterPolicyDefinition(entry.name);
+      }
+      const moduleValue = await importRuntimeModule(projectRoot, resolve3(projectRoot, entry.sourcePath));
+      const policy = resolveAuthorizationDefinitionExport(
+        moduleValue,
+        entry.exportName,
+        (value) => authorizationModule.isAuthorizationPolicyDefinition(value)
+      );
+      if (!policy) {
+        throw new Error(`Discovered policy "${entry.sourcePath}" does not export a Holo policy.`);
+      }
+      const canonicalPolicy = withCanonicalAuthorizationDefinitionName(
+        policy,
+        entry.name
+      );
+      const resolvedPolicyName = policy.name;
+      if (resolvedPolicyName !== entry.name) {
+        authorizationModule.authorizationInternals.unregisterPolicyDefinition(resolvedPolicyName);
+      }
+      if (typeof authorizationModule.authorizationInternals.registerPolicyDefinition === "function" && !authorizationModule.authorizationInternals.getAuthorizationRuntimeState().policiesByName.has(entry.name)) {
+        authorizationModule.authorizationInternals.registerPolicyDefinition(canonicalPolicy);
+      }
+      registeredPolicyNames.push(entry.name);
+    }
+    for (const entry of registry.authorizationAbilities) {
+      const existing = authorizationModule.authorizationInternals.getAuthorizationRuntimeState().abilitiesByName.get(entry.name);
+      if (existing) {
+        previousAbilities.set(entry.name, existing);
+        authorizationModule.authorizationInternals.unregisterAbilityDefinition(entry.name);
+      }
+      const moduleValue = await importRuntimeModule(projectRoot, resolve3(projectRoot, entry.sourcePath));
+      const ability = resolveAuthorizationDefinitionExport(
+        moduleValue,
+        entry.exportName,
+        (value) => authorizationModule.isAuthorizationAbilityDefinition(value)
+      );
+      if (!ability) {
+        throw new Error(`Discovered ability "${entry.sourcePath}" does not export a Holo ability.`);
+      }
+      const canonicalAbility = withCanonicalAuthorizationAbilityName(
+        ability,
+        entry.name
+      );
+      const resolvedAbilityName = ability.name;
+      if (resolvedAbilityName !== entry.name) {
+        authorizationModule.authorizationInternals.unregisterAbilityDefinition(resolvedAbilityName);
+      }
+      if (typeof authorizationModule.authorizationInternals.registerAbilityDefinition === "function" && !authorizationModule.authorizationInternals.getAuthorizationRuntimeState().abilitiesByName.has(entry.name)) {
+        authorizationModule.authorizationInternals.registerAbilityDefinition(canonicalAbility);
+      }
+      registeredAbilityNames.push(entry.name);
+    }
+  } catch (error) {
+    unregisterProjectAuthorizationDefinitions(authorizationModule, registeredPolicyNames, registeredAbilityNames);
+    if (typeof authorizationModule.authorizationInternals.registerPolicyDefinition === "function") {
+      for (const definition of previousPolicies.values()) {
+        authorizationModule.authorizationInternals.registerPolicyDefinition(definition);
+      }
+    }
+    if (typeof authorizationModule.authorizationInternals.registerAbilityDefinition === "function") {
+      for (const definition of previousAbilities.values()) {
+        authorizationModule.authorizationInternals.registerAbilityDefinition(definition);
+      }
+    }
+    throw error;
+  }
+  return Object.freeze({
+    policyNames: Object.freeze(registeredPolicyNames),
+    abilityNames: Object.freeze(registeredAbilityNames)
+  });
+}
+function unregisterProjectAuthorizationDefinitions(authorizationModule, policyNames, abilityNames) {
+  if (!authorizationModule) {
+    return;
+  }
+  for (const policyName of policyNames) {
+    authorizationModule.authorizationInternals.unregisterPolicyDefinition(policyName);
+  }
+  for (const abilityName of abilityNames) {
+    authorizationModule.authorizationInternals.unregisterAbilityDefinition(abilityName);
+  }
+}
+async function registerProjectEventsAndListeners(projectRoot, registry, eventsModule, queueModule) {
+  if (!registry || registry.events.length === 0 && registry.listeners.length === 0) {
+    return Object.freeze({
+      eventNames: Object.freeze([]),
+      listenerIds: Object.freeze([])
+    });
+  }
+  const registeredEventNames = [];
+  const registeredListenerIds = [];
+  let requiresQueuedListeners = false;
+  try {
+    for (const entry of registry.events) {
+      const existing = eventsModule.getRegisteredEvent(entry.name);
+      if (existing && !existing.sourcePath) {
+        continue;
+      }
+      const moduleValue = await importRuntimeModule(projectRoot, resolve3(projectRoot, entry.sourcePath));
+      const event = resolveEventExport(moduleValue);
+      if (!event || !eventsModule.isEventDefinition(event)) {
+        throw new Error(`Discovered event "${entry.sourcePath}" does not export a Holo event.`);
+      }
+      eventsModule.registerEvent(event, {
+        name: entry.name,
+        sourcePath: entry.sourcePath,
+        replaceExisting: !!existing?.sourcePath
+      });
+      registeredEventNames.push(entry.name);
+    }
+    for (const entry of registry.listeners) {
+      const existing = eventsModule.getRegisteredListener(entry.id);
+      if (existing && !existing.sourcePath) {
+        continue;
+      }
+      const moduleValue = await importRuntimeModule(projectRoot, resolve3(projectRoot, entry.sourcePath));
+      const listener = resolveListenerExport(eventsModule, moduleValue);
+      if (!listener) {
+        throw new Error(`Discovered listener "${entry.sourcePath}" does not export a Holo listener.`);
+      }
+      const normalizedListener = eventsModule.normalizeListenerDefinition(listener);
+      if (normalizedListener.queue === true) {
+        requiresQueuedListeners = true;
+        if (!queueModule) {
+          throw new Error("[@holo-js/core] Queued listeners require @holo-js/queue to be installed.");
+        }
+      }
+      eventsModule.registerListener({
+        ...normalizedListener,
+        listensTo: entry.eventNames
+      }, {
+        id: entry.id,
+        sourcePath: entry.sourcePath,
+        replaceExisting: !!existing?.sourcePath
+      });
+      registeredListenerIds.push(entry.id);
+    }
+    if (requiresQueuedListeners) {
+      await eventsModule.ensureEventsQueueJobRegisteredAsync?.();
+    }
+  } catch (error) {
+    unregisterProjectEventsAndListeners(eventsModule, registeredEventNames, registeredListenerIds);
+    throw error;
+  }
+  return Object.freeze({
+    eventNames: Object.freeze(registeredEventNames),
+    listenerIds: Object.freeze(registeredListenerIds)
+  });
+}
+function unregisterProjectEventsAndListeners(eventsModule, eventNames, listenerIds) {
+  if (!eventsModule) {
+    return;
+  }
+  for (const listenerId of listenerIds) {
+    eventsModule.unregisterListener(listenerId);
+  }
+  for (const eventName of eventNames) {
+    eventsModule.unregisterEvent(eventName);
+  }
+}
+async function reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, options = {}) {
+  const cacheConfigured = hasLoadedConfigFile(loadedConfig, "cache");
+  const cacheModule = await loadCacheModule(cacheConfigured, projectRoot);
+  if (cacheModule) {
+    cacheModule.configureCacheRuntime({
+      config: loadedConfig.cache,
+      databaseConfig: loadedConfig.database,
+      redisConfig: loadedConfig.redis
+    });
+  }
+  const queueConfigured = hasLoadedConfigFile(loadedConfig, "queue");
+  const queueModule = await loadQueueModule(queueConfigured);
+  if (queueModule) {
+    const queueUsesExplicitDatabaseFeatures = queueConfigured && (queueConfigUsesDatabaseDriver(loadedConfig) || queueConfigUsesDatabaseBackedFailedStore(loadedConfig));
+    const queueUsesImplicitDefaultFailedStore = !queueConfigured && queueConfigUsesDatabaseBackedFailedStore(loadedConfig);
+    const queueDbModule = queueUsesExplicitDatabaseFeatures || queueUsesImplicitDefaultFailedStore ? await loadQueueDbModule() : void 0;
+    if (queueUsesExplicitDatabaseFeatures && !queueDbModule) {
+      throw new Error("[@holo-js/core] Database-backed queue features require @holo-js/queue-db to be installed.");
+    }
+    queueModule.configureQueueRuntime({
+      config: loadedConfig.queue,
+      redisConfig: loadedConfig.redis,
+      ...queueDbModule?.createQueueDbRuntimeOptions() ?? {}
+    });
+  }
+  const storageConfigured = hasLoadedConfigFile(loadedConfig, "storage");
+  const storageInstalled = !!await portableRuntimeModuleInternals.importOptionalModule("@holo-js/storage");
+  if (!storageInstalled && storageConfigured) {
+    throw new Error("[@holo-js/core] Storage support requires @holo-js/storage to be installed.");
+  }
+  if (storageInstalled) {
+    await configurePlainNodeStorageRuntime(projectRoot, loadedConfig);
+  }
+  const mailConfigured = hasLoadedConfigFile(loadedConfig, "mail");
+  const mailModule = mailConfigured ? await loadMailModule(true) : void 0;
+  if (mailModule) {
+    const existingMailBindings = mailModule.getMailRuntimeBindings();
+    mailModule.configureMailRuntime({
+      ...existingMailBindings,
+      config: loadedConfig.mail,
+      ...options.renderView ?? getRuntimeState().renderView ? { renderView: options.renderView ?? getRuntimeState().renderView } : {}
+    });
+  }
+  const broadcastConfigured = hasLoadedConfigFile(loadedConfig, "broadcast");
+  const broadcastModule = broadcastConfigured ? await loadBroadcastModule(true, projectRoot) : void 0;
+  if (broadcastModule) {
+    const existingBroadcastBindings = broadcastModule.getBroadcastRuntimeBindings();
+    broadcastModule.configureBroadcastRuntime({
+      ...existingBroadcastBindings,
+      config: loadedConfig.broadcast,
+      ...!existingBroadcastBindings.publish || isCoreBroadcastPublisher(existingBroadcastBindings.publish) ? {
+        publish: createCoreBroadcastPublisher(loadedConfig.broadcast)
+      } : {}
+    });
+  }
+  const notificationsConfigured = hasLoadedConfigFile(loadedConfig, "notifications");
+  const notificationsModule = notificationsConfigured ? await loadNotificationsModule(true) : void 0;
+  if (notificationsModule) {
+    const existingNotificationsBindings = notificationsModule.getNotificationsRuntimeBindings();
+    notificationsModule.configureNotificationsRuntime({
+      ...existingNotificationsBindings,
+      config: loadedConfig.notifications,
+      store: existingNotificationsBindings.store ?? createCoreNotificationStore(loadedConfig),
+      ...!existingNotificationsBindings.mailer && mailModule ? { mailer: createCoreNotificationMailSender(mailModule) } : {},
+      ...!existingNotificationsBindings.broadcaster && broadcastModule ? { broadcaster: createCoreNotificationBroadcaster(broadcastModule) } : {}
+    });
+  }
+  const notificationsRuntimeBindings = notificationsModule?.getNotificationsRuntimeBindings();
+  const sessionConfigured = hasLoadedConfigFile(loadedConfig, "session") || hasLoadedConfigFile(loadedConfig, "auth");
+  const authConfigured = hasLoadedConfigFile(loadedConfig, "auth");
+  const securityConfigured = hasLoadedConfigFile(loadedConfig, "security");
+  const securityModule = securityConfigured ? await loadSecurityModule(true) : void 0;
+  const existingManagedSecurityRedisAdapter = getRuntimeState().securityRedisAdapter;
+  if (securityModule) {
+    const existingSecurityBindings = securityModule.getSecurityRuntimeBindings();
+    const shouldReuseExistingSecurityStore = !!existingSecurityBindings?.rateLimitStore && !existingManagedSecurityRedisAdapter && getRuntimeState().securityRateLimitStoreManaged !== true;
+    const shouldCloseExistingManagedSecurityStore = !shouldReuseExistingSecurityStore && !!existingSecurityBindings?.rateLimitStore && (!!existingManagedSecurityRedisAdapter || getRuntimeState().securityRateLimitStoreManaged === true);
+    let nextManagedSecurityRedisAdapter;
+    let rateLimitStore;
+    let configuredSecurityRuntime = false;
+    try {
+      if (!shouldReuseExistingSecurityStore && loadedConfig.security.rateLimit.driver === "redis") {
+        const securityRedisAdapterModule = await loadSecurityRedisAdapterModule(true);
+        nextManagedSecurityRedisAdapter = securityRedisAdapterModule.createSecurityRedisAdapter(
+          loadedConfig.security.rateLimit.redis
+        );
+      }
+      rateLimitStore = shouldReuseExistingSecurityStore ? existingSecurityBindings.rateLimitStore : securityModule.createRateLimitStoreFromConfig(loadedConfig.security, {
+        projectRoot,
+        ...nextManagedSecurityRedisAdapter ? { redisAdapter: nextManagedSecurityRedisAdapter } : {}
+      });
+      if (shouldCloseExistingManagedSecurityStore && existingSecurityBindings?.rateLimitStore && existingSecurityBindings.rateLimitStore !== rateLimitStore) {
+        await existingSecurityBindings.rateLimitStore.close?.();
+      }
+      if (existingManagedSecurityRedisAdapter && existingManagedSecurityRedisAdapter !== nextManagedSecurityRedisAdapter) {
+        await existingManagedSecurityRedisAdapter.close?.();
+      }
+      getRuntimeState().securityRedisAdapter = nextManagedSecurityRedisAdapter;
+      getRuntimeState().securityRateLimitStoreManaged = !shouldReuseExistingSecurityStore;
+      securityModule.configureSecurityRuntime({
+        config: loadedConfig.security,
+        rateLimitStore,
+        csrfSigningKey: loadedConfig.app.key,
+        defaultKeyResolver: async () => {
+          const authModule2 = await loadAuthModule();
+          if (!authModule2) {
+            return void 0;
+          }
+          try {
+            const authId = await authModule2.getAuthRuntime().id();
+            if (authId !== null && typeof authId !== "undefined") {
+              return `user:${String(authId)}`;
+            }
+          } catch {
+            return void 0;
+          }
+          return void 0;
+        }
+      });
+      configuredSecurityRuntime = true;
+    } catch (error) {
+      if (!configuredSecurityRuntime && rateLimitStore && rateLimitStore !== existingSecurityBindings?.rateLimitStore) {
+        await rateLimitStore.close?.();
+      }
+      if (nextManagedSecurityRedisAdapter && nextManagedSecurityRedisAdapter !== existingManagedSecurityRedisAdapter) {
+        await nextManagedSecurityRedisAdapter.close?.();
+      }
+      throw error;
+    }
+  } else if (existingManagedSecurityRedisAdapter || getRuntimeState().securityRateLimitStoreManaged === true) {
+    const existingSecurityModule = await loadSecurityModule();
+    const existingSecurityBindings = existingSecurityModule?.getSecurityRuntimeBindings();
+    if (getRuntimeState().securityRateLimitStoreManaged === true) {
+      await existingSecurityBindings?.rateLimitStore?.close?.();
+    }
+    await existingManagedSecurityRedisAdapter?.close?.();
+    getRuntimeState().securityRedisAdapter = void 0;
+    getRuntimeState().securityRateLimitStoreManaged = void 0;
+    existingSecurityModule?.resetSecurityRuntime();
+  } else {
+    getRuntimeState().securityRateLimitStoreManaged = void 0;
+  }
+  const sessionModule = sessionConfigured || authConfigured ? await loadSessionModule(true) : void 0;
+  const existingManagedSessionRedisAdapters = getRuntimeState().sessionRedisAdapters;
+  if (authConfigured && !sessionModule) {
+    throw new Error("[@holo-js/core] Auth support requires @holo-js/session to be installed.");
+  }
+  const authModule = await loadAuthModule(authConfigured);
+  const authorizationModule = await loadAuthorizationModule();
+  let authContext;
+  const workosModule = authConfigUsesWorkosProviders(loadedConfig) ? await loadWorkosModule(true) : void 0;
+  const clerkModule = authConfigUsesClerkProviders(loadedConfig) ? await loadClerkModule(true) : void 0;
+  if (sessionModule) {
+    let managedSessionStores;
+    try {
+      managedSessionStores = await createCoreManagedSessionStores(projectRoot, loadedConfig, sessionModule);
+      sessionModule.configureSessionRuntime({
+        config: loadedConfig.session,
+        stores: managedSessionStores.stores
+      });
+      getRuntimeState().sessionRedisAdapters = managedSessionStores.redisAdapters.length > 0 ? managedSessionStores.redisAdapters : void 0;
+      if (existingManagedSessionRedisAdapters) {
+        await Promise.all(existingManagedSessionRedisAdapters.map((adapter) => adapter.close?.()));
+      }
+    } catch (error) {
+      if (managedSessionStores) {
+        await Promise.all(managedSessionStores.redisAdapters.map((adapter) => adapter.close?.()));
+      }
+      throw error;
+    }
+  } else if (existingManagedSessionRedisAdapters) {
+    await Promise.all(existingManagedSessionRedisAdapters.map((adapter) => adapter.close?.()));
+    getRuntimeState().sessionRedisAdapters = void 0;
+  }
+  if (authConfigured) {
+    if (!authModule) {
+      throw new Error("[@holo-js/core] Auth support requires @holo-js/auth to be installed.");
+    }
+    if (!sessionModule) {
+      throw new Error("[@holo-js/core] Auth support requires @holo-js/session to be installed.");
+    }
+    const socialModule = authConfigUsesSocialProviders(loadedConfig) ? await loadSocialModule(true) : void 0;
+    const authStores = createCoreAuthStores(loadedConfig);
+    authContext = authModule.createAsyncAuthContext();
+    authModule.configureAuthRuntime({
+      config: loadedConfig.auth,
+      session: sessionModule.getSessionRuntime(),
+      providers: await createCoreAuthProviders(projectRoot, loadedConfig),
+      tokens: authStores.tokens,
+      emailVerificationTokens: authStores.emailVerificationTokens,
+      passwordResetTokens: authStores.passwordResetTokens,
+      ...notificationsModule && (mailModule || notificationsRuntimeBindings?.mailer) ? { delivery: createAuthNotificationsDeliveryHook(notificationsModule) } : mailModule ? { delivery: createAuthMailDeliveryHook(mailModule) } : {},
+      context: authContext
+    });
+    const boundAuthRuntime = bindAuthRuntimeToContext(authModule.getAuthRuntime(), authContext);
+    if (authorizationModule) {
+      authorizationModule.authorizationInternals.configureAuthorizationAuthIntegration({
+        hasGuard(guardName) {
+          return guardName in loadedConfig.auth.guards;
+        },
+        resolveDefaultActor: async () => boundAuthRuntime.user(),
+        resolveGuardActor: async (guardName) => boundAuthRuntime.guard(guardName).user()
+      });
+    }
+    if (socialModule) {
+      socialModule.configureSocialAuthRuntime({
+        ...await createCoreSocialBindings(projectRoot, loadedConfig, sessionModule),
+        encryptionKey: loadedConfig.auth.socialEncryptionKey
+      });
+    }
+    if (workosModule) {
+      workosModule.configureWorkosAuthRuntime({
+        identityStore: createCoreHostedIdentityStore("workos")
+      });
+    }
+    if (clerkModule) {
+      clerkModule.configureClerkAuthRuntime({
+        identityStore: createCoreHostedIdentityStore("clerk")
+      });
+    }
+  } else if (authorizationModule) {
+    authorizationModule.authorizationInternals.resetAuthorizationAuthIntegration();
+  }
+  return Object.freeze({
+    /* v8 ignore next -- only toggles shape when queue support is absent */
+    ...queueModule ? { queueModule } : {},
+    ...sessionModule ? { session: sessionModule.getSessionRuntime() } : {},
+    ...authModule && authConfigured ? { auth: authModule.getAuthRuntime() } : {},
+    ...authModule && authConfigured ? { authContext } : {}
+  });
+}
+async function resetOptionalHoloSubsystems() {
+  const projectRoot = getRuntimeState().current?.projectRoot ?? getRuntimeState().pendingProjectRoot;
+  await resetOptionalStorageRuntime();
+  const cacheModule = await loadCacheModule(false, projectRoot);
+  if (cacheModule) {
+    cacheModule.resetCacheRuntime();
+  } else {
+    resetCacheRuntimeGlobalsFallback();
+  }
+  const queueModule = await loadQueueModule();
+  await queueModule?.shutdownQueueRuntime();
+  const mailModule = await loadMailModule();
+  mailModule?.resetMailRuntime();
+  const notificationsModule = await loadNotificationsModule();
+  notificationsModule?.resetNotificationsRuntime();
+  const broadcastModule = await loadBroadcastModule(false, projectRoot);
+  broadcastModule?.resetBroadcastRuntime();
+  const authModule = await loadAuthModule();
+  authModule?.resetAuthRuntime();
+  const authorizationModule = await loadAuthorizationModule();
+  authorizationModule?.authorizationInternals.resetAuthorizationAuthIntegration();
+  const socialModule = await loadSocialModule();
+  socialModule?.resetSocialAuthRuntime();
+  const workosModule = await loadWorkosModule();
+  workosModule?.resetWorkosAuthRuntime();
+  const clerkModule = await loadClerkModule();
+  clerkModule?.resetClerkAuthRuntime();
+  const sessionModule = await loadSessionModule();
+  sessionModule?.resetSessionRuntime();
+  const managedSessionRedisAdapters = getRuntimeState().sessionRedisAdapters;
+  if (managedSessionRedisAdapters) {
+    await Promise.all(managedSessionRedisAdapters.map((adapter) => adapter.close?.()));
+    getRuntimeState().sessionRedisAdapters = void 0;
+  }
+  const securityModule = await loadSecurityModule();
+  const securityBindings = securityModule?.getSecurityRuntimeBindings();
+  const state = getRuntimeState();
+  const managedSecurityRedisAdapter = state.securityRateLimitStoreManaged === true ? state.securityRedisAdapter : void 0;
+  const managedSecurityRateLimitStore = state.securityRateLimitStoreManaged === true ? securityBindings?.rateLimitStore : void 0;
+  if (managedSecurityRedisAdapter) {
+    await managedSecurityRedisAdapter.close?.();
+    state.securityRedisAdapter = void 0;
+  }
+  if (managedSecurityRateLimitStore) {
+    await managedSecurityRateLimitStore.close?.();
+  }
+  state.securityRateLimitStoreManaged = void 0;
+  securityModule?.resetSecurityRuntime();
+}
+async function createHolo(projectRoot, options = {}) {
+  const loadedConfig = await loadConfigDirectory(projectRoot, {
+    envName: options.envName,
+    preferCache: options.preferCache,
+    processEnv: options.processEnv
+  });
+  const runtimeConfig = {
+    db: loadedConfig.database,
+    queue: loadedConfig.queue
+  };
+  const manager = resolveRuntimeConnectionManagerOptions(runtimeConfig);
+  const registry = await loadGeneratedProjectRegistry(projectRoot);
+  const accessors = createConfigAccessors(loadedConfig.all);
+  const runtimeOwnedQueueJobNames = [];
+  const runtimeOwnedEventNames = [];
+  const runtimeOwnedListenerIds = [];
+  const runtimeOwnedAuthorizationPolicyNames = [];
+  const runtimeOwnedAuthorizationAbilityNames = [];
+  let activeQueueModule;
+  let activeEventsModule;
+  let activeAuthorizationModule;
+  let activeSessionRuntime;
+  let activeAuthRuntime;
+  let activeAuthContext;
+  let previousOptionalSubsystemBindings;
+  const previousRenderView = options.renderView ? getRuntimeState().renderView : void 0;
+  const fallbackQueueRuntime = Object.freeze({
+    config: loadedConfig.queue,
+    drivers: /* @__PURE__ */ new Map()
+  });
+  const runtime = {
+    projectRoot,
+    loadedConfig,
+    registry,
+    manager,
+    runtimeConfig,
+    get queue() {
+      return activeQueueModule?.getQueueRuntime() ?? fallbackQueueRuntime;
+    },
+    get session() {
+      return activeSessionRuntime;
+    },
+    get auth() {
+      return activeAuthRuntime && activeAuthContext ? bindAuthRuntimeToContext(activeAuthRuntime, activeAuthContext) : activeAuthRuntime;
+    },
+    initialized: false,
+    useConfig: accessors.useConfig,
+    config: accessors.config,
+    async initialize() {
+      if (runtime.initialized) {
+        throw new Error("Holo runtime is already initialized.");
+      }
+      if (getRuntimeState().current) {
+        throw new Error("A Holo runtime is already initialized for this process.");
+      }
+      configureConfigRuntime(loadedConfig.all);
+      configureDB(manager);
+      previousOptionalSubsystemBindings = snapshotOptionalSubsystemRuntimeBindings();
+      if (options.renderView) {
+        configureHoloRenderingRuntime({
+          renderView: options.renderView
+        });
+      }
+      try {
+        await manager.initializeAll();
+        const optionalSubsystems = await reconfigureOptionalHoloSubsystems(projectRoot, loadedConfig, {
+          renderView: options.renderView
+        });
+        activeQueueModule = optionalSubsystems.queueModule;
+        activeSessionRuntime = optionalSubsystems.session;
+        activeAuthRuntime = optionalSubsystems.auth;
+        activeAuthContext = optionalSubsystems.authContext;
+        const optionalEventsModule = activeQueueModule ? await loadEventsModule() : void 0;
+        if (activeQueueModule && optionalEventsModule) {
+          await optionalEventsModule.ensureEventsQueueJobRegisteredAsync?.();
+        }
+        if (registryHasEvents(registry)) {
+          const eventsModule = await loadEventsModule(true);
+          if (!eventsModule) {
+            throw new Error("[@holo-js/core] Events support requires @holo-js/events to be installed.");
+          }
+          activeEventsModule = eventsModule;
+          const eventRegistration = await registerProjectEventsAndListeners(
+            projectRoot,
+            registry,
+            eventsModule,
+            activeQueueModule
+          );
+          runtimeOwnedEventNames.splice(0, runtimeOwnedEventNames.length, ...eventRegistration.eventNames);
+          runtimeOwnedListenerIds.splice(0, runtimeOwnedListenerIds.length, ...eventRegistration.listenerIds);
+        }
+        activeAuthorizationModule = await loadAuthorizationModule();
+        const authorizationRegistration = await registerProjectAuthorizationDefinitions(
+          projectRoot,
+          registry,
+          activeAuthorizationModule
+        );
+        runtimeOwnedAuthorizationPolicyNames.splice(0, runtimeOwnedAuthorizationPolicyNames.length, ...authorizationRegistration.policyNames);
+        runtimeOwnedAuthorizationAbilityNames.splice(0, runtimeOwnedAuthorizationAbilityNames.length, ...authorizationRegistration.abilityNames);
+        if (options.registerProjectQueueJobs === true && registryHasJobs(registry)) {
+          if (!activeQueueModule) {
+            throw new Error("[@holo-js/core] Project jobs require @holo-js/queue to be installed.");
+          }
+          runtimeOwnedQueueJobNames.splice(0, runtimeOwnedQueueJobNames.length);
+          runtimeOwnedQueueJobNames.push(...await registerProjectQueueJobs(projectRoot, registry, activeQueueModule));
+        }
+        runtime.initialized = true;
+        getRuntimeState().current = runtime;
+      } catch (error) {
+        unregisterProjectEventsAndListeners(activeEventsModule, runtimeOwnedEventNames, runtimeOwnedListenerIds);
+        runtimeOwnedEventNames.splice(0, runtimeOwnedEventNames.length);
+        runtimeOwnedListenerIds.splice(0, runtimeOwnedListenerIds.length);
+        unregisterProjectAuthorizationDefinitions(activeAuthorizationModule, runtimeOwnedAuthorizationPolicyNames, runtimeOwnedAuthorizationAbilityNames);
+        runtimeOwnedAuthorizationPolicyNames.splice(0, runtimeOwnedAuthorizationPolicyNames.length);
+        runtimeOwnedAuthorizationAbilityNames.splice(0, runtimeOwnedAuthorizationAbilityNames.length);
+        unregisterProjectQueueJobs(activeQueueModule, runtimeOwnedQueueJobNames);
+        runtimeOwnedQueueJobNames.splice(0, runtimeOwnedQueueJobNames.length);
+        activeAuthorizationModule = void 0;
+        activeEventsModule = void 0;
+        activeQueueModule = void 0;
+        activeSessionRuntime = void 0;
+        activeAuthRuntime = void 0;
+        activeAuthContext = void 0;
+        await manager.disconnectAll().catch(() => {
+        });
+        resetDB();
+        await resetOptionalHoloSubsystems();
+        if (previousOptionalSubsystemBindings) {
+          restoreOptionalSubsystemRuntimeBindings(previousOptionalSubsystemBindings);
+        }
+        if (options.renderView) {
+          restoreHoloRenderingRuntime(previousRenderView);
+        }
+        resetConfigRuntime();
+        getRuntimeState().current = void 0;
+        throw error;
+      }
+    },
+    async shutdown() {
+      try {
+        if (runtime.initialized) {
+          await manager.disconnectAll();
+        }
+      } finally {
+        runtime.initialized = false;
+        if (getRuntimeState().current === runtime) {
+          getRuntimeState().current = void 0;
+        }
+        unregisterProjectEventsAndListeners(activeEventsModule, runtimeOwnedEventNames, runtimeOwnedListenerIds);
+        runtimeOwnedEventNames.splice(0, runtimeOwnedEventNames.length);
+        runtimeOwnedListenerIds.splice(0, runtimeOwnedListenerIds.length);
+        unregisterProjectAuthorizationDefinitions(activeAuthorizationModule, runtimeOwnedAuthorizationPolicyNames, runtimeOwnedAuthorizationAbilityNames);
+        runtimeOwnedAuthorizationPolicyNames.splice(0, runtimeOwnedAuthorizationPolicyNames.length);
+        runtimeOwnedAuthorizationAbilityNames.splice(0, runtimeOwnedAuthorizationAbilityNames.length);
+        unregisterProjectQueueJobs(activeQueueModule, runtimeOwnedQueueJobNames);
+        runtimeOwnedQueueJobNames.splice(0, runtimeOwnedQueueJobNames.length);
+        activeAuthorizationModule = void 0;
+        activeEventsModule = void 0;
+        activeQueueModule = void 0;
+        activeSessionRuntime = void 0;
+        activeAuthRuntime = void 0;
+        activeAuthContext = void 0;
+        resetDB();
+        await resetOptionalHoloSubsystems();
+        if (previousOptionalSubsystemBindings) {
+          restoreOptionalSubsystemRuntimeBindings(previousOptionalSubsystemBindings);
+        }
+        if (options.renderView) {
+          restoreHoloRenderingRuntime(previousRenderView);
+        }
+        resetConfigRuntime();
+      }
+    }
+  };
+  return runtime;
+}
+async function initializeHolo(projectRoot, options = {}) {
+  const state = getRuntimeState();
+  const resolvedProjectRoot = resolve3(projectRoot);
+  const current = state.current;
+  if (current) {
+    if (resolve3(current.projectRoot) !== resolvedProjectRoot) {
+      throw new Error(`A Holo runtime is already initialized for "${current.projectRoot}".`);
+    }
+    return current;
+  }
+  if (state.pending) {
+    if (state.pendingProjectRoot && resolve3(state.pendingProjectRoot) !== resolvedProjectRoot) {
+      throw new Error(`A Holo runtime is already initializing for "${state.pendingProjectRoot}".`);
+    }
+    return state.pending;
+  }
+  const pending = (async () => {
+    const runtime = await createHolo(projectRoot, options);
+    await runtime.initialize();
+    return runtime;
+  })();
+  state.pending = pending;
+  state.pendingProjectRoot = resolvedProjectRoot;
+  try {
+    return await pending;
+  } finally {
+    if (state.pending === pending) {
+      state.pending = void 0;
+      state.pendingProjectRoot = void 0;
+    }
+  }
+}
+function peekHolo() {
+  return getRuntimeState().current;
+}
+async function ensureHolo(projectRoot, options = {}) {
+  const current = peekHolo();
+  if (!current) {
+    return initializeHolo(projectRoot, options);
+  }
+  if (resolve3(current.projectRoot) !== resolve3(projectRoot)) {
+    throw new Error(`A Holo runtime is already initialized for "${current.projectRoot}".`);
+  }
+  return current;
+}
+function getHolo() {
+  const current = getRuntimeState().current;
+  if (!current) {
+    throw new Error("Holo runtime is not initialized.");
+  }
+  return current;
+}
+async function resetHoloRuntime() {
+  const current = getRuntimeState().current;
+  const projectRoot = current?.projectRoot ?? getRuntimeState().pendingProjectRoot;
+  getRuntimeState().pending = void 0;
+  getRuntimeState().pendingProjectRoot = void 0;
+  if (!current) {
+    resetDB();
+    await resetOptionalHoloSubsystems();
+    resetHoloRenderingRuntime();
+    resetConfigRuntime();
+    return;
+  }
+  await current.shutdown();
+  const mailModule = await loadMailModule();
+  mailModule?.resetMailRuntime();
+  const notificationsModule = await loadNotificationsModule();
+  notificationsModule?.resetNotificationsRuntime();
+  const securityModule = await loadSecurityModule();
+  securityModule?.resetSecurityRuntime();
+  const broadcastModule = await loadBroadcastModule(false, projectRoot);
+  broadcastModule?.resetBroadcastRuntime();
+  resetHoloRenderingRuntime();
+}
+function getConfigValue(path) {
+  return globalConfig(path);
+}
+function getConfigSection(key) {
+  return globalUseConfig(key);
+}
+var holoRuntimeInternals = {
+  createAuthMailDeliveryHook,
+  createAuthNotificationsDeliveryHook,
+  createCoreNotificationBroadcaster,
+  createCoreNotificationMailSender,
+  bindAuthRuntimeToContext,
+  createCoreAuthProviders,
+  createCoreAuthStores,
+  createCoreHostedIdentityStore,
+  createCoreNotificationStore,
+  createNotificationMailText,
+  createCoreSessionStores,
+  registerProjectAuthorizationDefinitions,
+  unregisterProjectAuthorizationDefinitions,
+  resolveAuthorizationDefinitionExport,
+  fromHostedIdentityProviderValue,
+  getConfigSection,
+  getConfigValue,
+  createCoreSocialBindings,
+  normalizeNotificationRecordFromRow,
+  loadConfiguredSocialProviders,
+  loadAuthorizationModule,
+  markProviderUser,
+  normalizeDateValue,
+  normalizeEmailVerificationTokenRecord,
+  normalizeJsonValue,
+  normalizePasswordResetTokenRecord,
+  serializeNotificationRecordForRow,
+  moduleInternals: portableRuntimeModuleInternals
+};
+
+export {
+  createAdapter,
+  createDialect,
+  createRuntimeConnectionOptions,
+  createRuntimeLogger,
+  isSupportedDatabaseDriver,
+  parseDatabaseDriver,
+  resolveRuntimeConnectionManagerOptions,
+  resolveGeneratedProjectRegistryPath,
+  loadGeneratedProjectRegistry,
+  createGeneratedBroadcastManifest,
+  loadGeneratedBroadcastManifest,
+  registryInternals,
+  resolveStorageKeyPath,
+  configureHoloRenderingRuntime,
+  resetHoloRenderingRuntime,
+  reconfigureOptionalHoloSubsystems,
+  resetOptionalHoloSubsystems,
+  createHolo,
+  initializeHolo,
+  peekHolo,
+  ensureHolo,
+  getHolo,
+  resetHoloRuntime,
+  holoRuntimeInternals
+};