@maudecode/kanvil 0.0.0-stage → 0.1.0

package/apps/server/dist/index.mjs

@@ -0,0 +1,1754 @@
+import { a as photoInputSchema, c as searchAuthentication, d as account, f as apikey, h as user, i as instanceUpdateSchema, l as searchSettingsSchema, m as session, n as adminInstanceSchema, o as photoResultSchema, r as brokerSettingsSchema, s as s3SettingsSchema, t as readConfig, u as createDatabase } from "./config-Qxr_7oqZ.mjs";
+import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
+import { A as storageBackends, B as notificationPreferencesInput, C as members, D as projects, E as profilePhotos, F as ApiError, G as roles, H as okSchema, I as errorSchema, K as scopes, L as hasAdminRole, M as tickets, N as workspaceMembers, O as pushDeliveries, P as workspaces, R as isOperation, S as instanceSettings, T as notifications, U as operations, V as notificationPreferencesSchema, W as pushDeviceInput, _ as attachments, a as json, b as eventClock, c as projectRoleSQL, d as createBlobStorage, f as decodeImage, g as attachmentContent, h as createPollingJob, i as fail, j as subscriptions, k as pushDevices, l as createTicketSearch, m as createObjectStore, n as assertVersion, o as one, p as imageResponse, r as createDomain, s as requireRow, t as createAuth, u as createTicketIndex, v as blobObjects, w as notificationPreferences, x as events, y as deliveryCheckpoints, z as memberSchema } from "./auth-BscXb1NQ.mjs";
+import { serve } from "@hono/node-server";
+import pg from "pg";
+import { and, asc, count, desc, eq, gt, ilike, inArray, isNull, lte, or, sql } from "drizzle-orm";
+import { z } from "zod";
+import { fileURLToPath } from "node:url";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { EventEmitter } from "node:events";
+import { connect } from "amqplib";
+import { OpenAPIHono, createRoute, z as z$1 } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+import { bodyLimit } from "hono/body-limit";
+import { secureHeaders } from "hono/secure-headers";
+import { streamSSE } from "hono/streaming";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { APIError } from "better-auth/api";
+import { requireMcpAuth } from "@better-auth/mcp";
+import { Expo } from "expo-server-sdk";
+import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
+//#region ../../packages/contracts/src/users.ts
+const accountSchema = memberSchema.pick({
+	name: true,
+	email: true,
+	image: true
+}).extend({
+	id: z.string(),
+	role: z.string().nullable(),
+	banned: z.boolean(),
+	createdAt: z.iso.datetime()
+});
+const accountQuerySchema = z.object({
+	q: z.string().trim().max(200).default(""),
+	role: z.enum([
+		"all",
+		"user",
+		"admin"
+	]).default("all"),
+	status: z.enum([
+		"all",
+		"active",
+		"disabled"
+	]).default("all"),
+	limit: z.coerce.number().int().min(1).max(100).default(25),
+	offset: z.coerce.number().int().min(0).default(0)
+});
+const accountsSchema = z.object({
+	users: z.array(accountSchema),
+	total: z.number().int().nonnegative()
+});
+const accountDetailsSchema = accountSchema.extend({
+	workspaces: z.array(z.object({
+		id: z.uuid(),
+		name: z.string(),
+		role: z.enum(roles)
+	})),
+	projects: z.array(z.object({
+		id: z.uuid(),
+		name: z.string(),
+		role: z.enum(roles)
+	})),
+	providers: z.array(z.string()),
+	sessionCount: z.number().int().nonnegative()
+});
+const localPasswordSchema = z.object({ password: z.string().min(12).max(128) }).strict();
+//#endregion
+//#region src/account-administration.ts
+const person = {
+	id: user.id,
+	name: user.name,
+	email: user.email,
+	image: user.image,
+	role: user.role,
+	banned: sql`coalesce(${user.banned}, false)`,
+	createdAt: user.createdAt
+};
+const mutationBody = z.object({
+	userId: z.string().optional(),
+	role: z.union([z.string(), z.array(z.string())]).optional(),
+	data: z.record(z.string(), z.unknown()).optional()
+}).passthrough();
+function authPath(request) {
+	try {
+		return decodeURIComponent(new URL(request.url).pathname).replace(/\/+/g, "/").replace(/\/$/, "");
+	} catch {
+		return fail(400, "invalid_path", "The authentication path is invalid");
+	}
+}
+function createAccountAdministration(database, auth) {
+	async function revokeAfterPasswordChange(headers, userId) {
+		try {
+			await auth.api.revokeUserSessions({
+				headers,
+				body: { userId }
+			});
+		} catch {
+			fail(503, "session_revocation_failed", "The password changed, but existing sessions could not be revoked. Revoke this user’s sessions before continuing.");
+		}
+	}
+	async function mutate(request, run) {
+		const login = await auth.api.getSession({ headers: request.headers });
+		if (!login) fail(401, "unauthorized", "Sign in to continue");
+		if (!hasAdminRole(login.user.role) || login.user.banned) fail(403, "forbidden", "Instance administrator access is required");
+		const lock = await database.pool.connect();
+		let locked = false;
+		try {
+			await lock.query("SELECT pg_advisory_lock(7361083)");
+			locked = true;
+			const path = authPath(request);
+			let passwordUserId;
+			if (path.endsWith("/admin/set-user-password")) passwordUserId = mutationBody.parse(await request.clone().json()).userId;
+			if ([
+				"set-role",
+				"update-user",
+				"ban-user",
+				"remove-user"
+			].some((name) => path.endsWith(`/admin/${name}`))) {
+				const body = mutationBody.parse(await request.clone().json());
+				if (body.userId) {
+					const current = one((await lock.query(`SELECT id, role, coalesce(banned,false) AS banned FROM "user" WHERE id = $1`, [body.userId])).rows);
+					const role = body.role ?? body.data?.role ?? current.role;
+					const candidate = z.union([z.string(), z.array(z.string())]).nullable().safeParse(role);
+					const nextRole = candidate.success ? Array.isArray(candidate.data) ? candidate.data.join(",") : candidate.data : current.role;
+					if (body.data && Object.hasOwn(body.data, "banned")) z.boolean().parse(body.data.banned);
+					const banned = path.endsWith("/ban-user") || body.data?.banned === true || body.data?.banned === void 0 && current.banned;
+					if (hasAdminRole(current.role) && !current.banned && (!hasAdminRole(nextRole) || banned || path.endsWith("/remove-user"))) {
+						if (!(await lock.query(`SELECT id FROM "user" WHERE id <> $1 AND NOT coalesce(banned,false) AND 'admin' = ANY(string_to_array(role, ',')) LIMIT 1`, [current.id])).rowCount) fail(409, "last_administrator", "Keep at least one active instance administrator");
+					}
+				}
+			}
+			const response = await run();
+			if (response.ok && passwordUserId) await revokeAfterPasswordChange(request.headers, passwordUserId);
+			return response;
+		} finally {
+			try {
+				if (locked) await lock.query("SELECT pg_advisory_unlock(7361083)");
+			} finally {
+				lock.release();
+			}
+		}
+	}
+	return {
+		handleAuth(request) {
+			const path = authPath(request);
+			const guarded = [
+				"set-role",
+				"update-user",
+				"ban-user",
+				"unban-user",
+				"remove-user",
+				"set-user-password"
+			].some((name) => path === `/api/auth/admin/${name}`);
+			return request.method === "POST" && guarded ? mutate(request, () => auth.handler(request)) : auth.handler(request);
+		},
+		register(app) {
+			app.openAPIRegistry.registerPath({
+				method: "get",
+				path: "/api/v1/admin/users",
+				security: [{ sessionCookie: [] }],
+				request: { query: accountQuerySchema },
+				responses: { 200: {
+					description: "Accounts without credentials or session tokens",
+					content: { "application/json": { schema: accountsSchema } }
+				} }
+			});
+			app.openAPIRegistry.registerPath({
+				method: "get",
+				path: "/api/v1/admin/users/{id}",
+				security: [{ sessionCookie: [] }],
+				request: { params: z.object({ id: z.string() }) },
+				responses: { 200: {
+					description: "Account access and sign-in summary",
+					content: { "application/json": { schema: accountDetailsSchema } }
+				} }
+			});
+			app.openAPIRegistry.registerPath({
+				method: "post",
+				path: "/api/v1/admin/users/{id}/password",
+				security: [{ sessionCookie: [] }],
+				request: {
+					params: z.object({ id: z.string() }),
+					body: {
+						required: true,
+						content: { "application/json": { schema: localPasswordSchema } }
+					}
+				},
+				responses: { 200: {
+					description: "Local password changed and sessions revoked",
+					content: { "application/json": { schema: okSchema } }
+				} }
+			});
+			app.get("/api/v1/admin/users", async (c) => {
+				const input = accountQuerySchema.parse(c.req.query()), needle = `%${input.q.replace(/[\\%_]/g, "\\$&")}%`;
+				const administrator = sql`'admin' = ANY(string_to_array(${user.role}, ','))`;
+				const filter = and(input.q ? or(ilike(user.name, needle), ilike(user.email, needle)) : void 0, input.role === "admin" ? administrator : input.role === "user" ? sql`NOT coalesce(${administrator},false)` : void 0, input.status === "all" ? void 0 : input.status === "disabled" ? eq(user.banned, true) : sql`NOT coalesce(${user.banned},false)`);
+				const [users, total] = await Promise.all([database.db.select(person).from(user).where(filter).orderBy(asc(user.name), asc(user.id)).limit(input.limit).offset(input.offset), database.db.select({ value: count() }).from(user).where(filter)]);
+				return Response.json(json({
+					users,
+					total: total[0]?.value ?? 0
+				}));
+			});
+			app.get("/api/v1/admin/users/:id", async (c) => {
+				const id = c.req.param("id"), row = one(await database.db.select(person).from(user).where(eq(user.id, id)));
+				const [spaces, direct, providers, sessions] = await Promise.all([
+					database.db.select({
+						id: workspaces.id,
+						name: workspaces.name,
+						role: workspaceMembers.role
+					}).from(workspaceMembers).innerJoin(workspaces, eq(workspaces.id, workspaceMembers.workspaceId)).where(eq(workspaceMembers.userId, id)).orderBy(workspaces.name),
+					database.db.select({
+						id: projects.id,
+						name: projects.name,
+						role: members.role
+					}).from(members).innerJoin(projects, eq(projects.id, members.projectId)).where(eq(members.userId, id)).orderBy(projects.name),
+					database.db.select({ provider: account.providerId }).from(account).where(eq(account.userId, id)),
+					database.db.select({ value: count() }).from(session).where(and(eq(session.userId, id), gt(session.expiresAt, /* @__PURE__ */ new Date())))
+				]);
+				return Response.json(json({
+					...row,
+					workspaces: spaces,
+					projects: direct,
+					providers: [...new Set(providers.map((provider) => provider.provider))],
+					sessionCount: sessions[0]?.value ?? 0
+				}));
+			});
+			app.post("/api/v1/admin/users/:id/password", async (c) => mutate(c.req.raw, async () => {
+				const input = localPasswordSchema.parse(await c.req.json()), userId = c.req.param("id");
+				await auth.api.setUserPassword({
+					headers: c.req.raw.headers,
+					body: {
+						userId,
+						newPassword: input.password
+					}
+				});
+				await revokeAfterPasswordChange(c.req.raw.headers, userId);
+				return Response.json({ ok: true });
+			}));
+		}
+	};
+}
+//#endregion
+//#region src/instance.ts
+function storageIdentity(settings) {
+	return createHash("sha256").update(JSON.stringify([
+		settings.endpoint,
+		settings.region,
+		settings.bucket,
+		settings.prefix,
+		settings.forcePathStyle
+	])).digest("hex");
+}
+function createInstance(database, config) {
+	const key = createHash("sha256").update("kanvil:instance-config:v1:").update(config.BETTER_AUTH_SECRET).digest();
+	function seal(value) {
+		const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", key, iv);
+		const bytes = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+		return Buffer.concat([
+			iv,
+			cipher.getAuthTag(),
+			bytes
+		]).toString("base64");
+	}
+	function unseal(value) {
+		try {
+			const bytes = Buffer.from(value, "base64"), decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
+			decipher.setAuthTag(bytes.subarray(12, 28));
+			return JSON.parse(Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString());
+		} catch {
+			return fail(503, "configuration_key_changed", "Saved integration credentials cannot be decrypted. Restore the instance secret from your backup.");
+		}
+	}
+	async function read(db = database.db) {
+		await db.insert(instanceSettings).values({ id: 1 }).onConflictDoNothing();
+		return one(await db.select().from(instanceSettings).where(eq(instanceSettings.id, 1)));
+	}
+	async function backend(id, db = database.db) {
+		const row = one(await db.select().from(storageBackends).where(eq(storageBackends.id, id)));
+		const settings = s3SettingsSchema.parse(unseal(row.config));
+		return {
+			...row,
+			settings,
+			spec: {
+				provider: "s3",
+				config: settings
+			}
+		};
+	}
+	async function resolveS3(settings, db = database.db) {
+		settings = s3SettingsSchema.strip().parse(settings);
+		const identity = storageIdentity(settings);
+		const previous = (await db.select().from(storageBackends).where(eq(storageBackends.identity, identity)))[0];
+		const old = previous ? s3SettingsSchema.parse(unseal(previous.config)) : void 0;
+		const { secretAccessKey: suppliedSecret, ...publicSettings } = settings, secret = suppliedSecret || (old?.accessKeyId === settings.accessKeyId ? old.secretAccessKey : void 0);
+		if (settings.accessKeyId && !secret) fail(400, "missing_secret", "Provide the S3 secret access key");
+		return {
+			...publicSettings,
+			...secret ? { secretAccessKey: secret } : {}
+		};
+	}
+	async function resolveSearch(settings, db = database.db) {
+		settings = searchSettingsSchema.strip().parse(settings);
+		const row = await read(db), old = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null, same = old?.url === settings.url && old.index === settings.index;
+		const { apiKey: suppliedKey, password: suppliedPassword, auth: requestedAuth, ...publicSettings } = settings, auth = requestedAuth ?? (suppliedKey ? "apiKey" : suppliedPassword && settings.username ? "basic" : same && old ? searchAuthentication(old) : searchAuthentication(settings)), apiKey = suppliedKey || (same ? old?.apiKey : void 0), password = suppliedPassword || (same && old?.username === settings.username ? old?.password : void 0);
+		if (auth === "apiKey" && !apiKey) fail(400, "missing_secret", "Provide the search API key");
+		if (auth === "basic" && (!settings.username || !password)) fail(400, "missing_secret", "Provide the search username and password");
+		return {
+			...publicSettings,
+			auth,
+			...auth === "apiKey" && apiKey ? { apiKey } : {},
+			...auth === "basic" && password ? { password } : {}
+		};
+	}
+	async function saveBackend(settings, db = database.db) {
+		const complete = await resolveS3(settings, db), identity = storageIdentity(settings);
+		return one(await db.insert(storageBackends).values({
+			identity,
+			config: seal(complete)
+		}).onConflictDoUpdate({
+			target: storageBackends.identity,
+			set: { config: seal(complete) }
+		}).returning());
+	}
+	async function storage() {
+		if (config.KANVIL_STORAGE_PROVIDER === "local") return null;
+		if (config.KANVIL_STORAGE_PROVIDER === "s3") return saveBackend(s3SettingsSchema.parse({
+			endpoint: config.S3_ENDPOINT ?? "",
+			region: config.S3_REGION,
+			bucket: config.S3_BUCKET,
+			prefix: config.S3_PREFIX,
+			forcePathStyle: config.S3_FORCE_PATH_STYLE,
+			accessKeyId: config.S3_ACCESS_KEY_ID ?? "",
+			secretAccessKey: config.S3_SECRET_ACCESS_KEY
+		}));
+		const row = await read();
+		return row.storageBackendId ? backend(row.storageBackendId) : null;
+	}
+	async function search() {
+		const row = await read();
+		if (config.KANVIL_SEARCH_PROVIDER === "postgres") return null;
+		if (config.KANVIL_SEARCH_PROVIDER === "elasticsearch") {
+			const settings = searchSettingsSchema.parse({
+				url: config.ELASTICSEARCH_URL,
+				index: config.ELASTICSEARCH_INDEX ?? `kanvil-${row.identity}`,
+				auth: config.ELASTICSEARCH_AUTH,
+				apiKey: config.ELASTICSEARCH_API_KEY,
+				username: config.ELASTICSEARCH_USERNAME,
+				password: config.ELASTICSEARCH_PASSWORD
+			});
+			return {
+				...settings,
+				auth: searchAuthentication(settings)
+			};
+		}
+		const settings = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null;
+		return settings ? {
+			...settings,
+			auth: searchAuthentication(settings)
+		} : null;
+	}
+	async function broker() {
+		if (config.KANVIL_BROKER_PROVIDER === "postgres") return null;
+		if (config.KANVIL_BROKER_PROVIDER === "rabbitmq") return brokerSettingsSchema.parse({
+			url: config.RABBITMQ_URL,
+			exchange: config.RABBITMQ_EXCHANGE
+		});
+		const row = await read();
+		return row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
+	}
+	async function resolveBroker(settings, db = database.db) {
+		settings = brokerSettingsSchema.strip().parse(settings);
+		const row = await read(db), old = row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
+		const url = settings.url || old?.url;
+		if (!url) return fail(400, "missing_secret", "Provide the RabbitMQ connection URL");
+		return {
+			...settings,
+			url
+		};
+	}
+	async function update(value) {
+		const input = instanceUpdateSchema.parse(value);
+		return database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
+			const current = await read(tx);
+			assertVersion(current, input.expectedVersion, "instance settings", "saving");
+			let storageId = current.storageBackendId, searchConfig = current.searchConfig, brokerConfig = current.brokerConfig;
+			if (!config.KANVIL_STORAGE_PROVIDER) storageId = input.storage.provider === "s3" ? (await saveBackend(input.storage, tx)).id : null;
+			if (!config.KANVIL_SEARCH_PROVIDER) {
+				if (input.search.provider === "postgres") searchConfig = null;
+				else searchConfig = seal(await resolveSearch(input.search, tx));
+			}
+			if (!config.KANVIL_BROKER_PROVIDER && input.broker) brokerConfig = input.broker.provider === "postgres" ? null : seal(await resolveBroker(input.broker, tx));
+			await tx.update(instanceSettings).set({
+				name: input.name,
+				description: input.description,
+				storageBackendId: storageId,
+				searchConfig,
+				brokerConfig,
+				version: current.version + 1
+			}).where(eq(instanceSettings.id, 1));
+		});
+	}
+	return {
+		read,
+		storage,
+		search,
+		backend,
+		saveBackend,
+		resolveS3,
+		resolveSearch,
+		broker,
+		resolveBroker,
+		update,
+		config
+	};
+}
+//#endregion
+//#region src/access.ts
+const credentialPermissions = z.object({ kanvil: z.array(z.enum(scopes)) });
+const credentialMetadata = z.object({ projectIds: z.array(z.uuid()).max(1e3) });
+function createWriteLimiter(max, windowMs = 6e4) {
+	const recent = /* @__PURE__ */ new Map();
+	return { consume(key, now = Date.now()) {
+		const hits = (recent.get(key) ?? []).filter((at) => at > now - windowMs);
+		if (hits.length >= max) {
+			const retryAfterSeconds = Math.max(1, Math.ceil(((hits[0] ?? now) + windowMs - now) / 1e3));
+			fail(429, "rate_limited", "Too many changes in a short time; wait and retry", { retryAfterSeconds });
+		}
+		hits.push(now);
+		recent.set(key, hits);
+		if (recent.size > 1e4) {
+			for (const [id, stamps] of recent) if (!stamps.some((at) => at > now - windowMs)) recent.delete(id);
+		}
+	} };
+}
+function requireSession(actor) {
+	if (actor.machine) fail(403, "session_required", "Use a signed-in account for this action");
+	return actor;
+}
+function requireInstanceAdmin(actor) {
+	requireSession(actor);
+	if (!actor.admin) fail(403, "forbidden", "Instance administrator access is required");
+	return actor;
+}
+function storedJson(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+function createAccess(auth, domain, config, database) {
+	async function credentialActor(key) {
+		const permissions = credentialPermissions.safeParse(storedJson(key.permissions));
+		const metadata = credentialMetadata.safeParse(storedJson(key.metadata));
+		if (!permissions.success || !metadata.success) fail(403, "invalid_credential_scope", "This credential has no valid project permissions");
+		return domain.actor(key.referenceId, {
+			ownerId: key.id,
+			scopes: permissions.data.kanvil,
+			projectIds: metadata.data.projectIds
+		});
+	}
+	async function authenticate(request) {
+		const token = request.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
+		if (token) {
+			if (!token.startsWith("kv_")) fail(401, "unauthorized", "Use a Kanvil API credential");
+			const result = await auth.api.verifyApiKey({ body: { key: token } });
+			if (!result.valid || !result.key) fail(401, "unauthorized", "The API credential is invalid or expired");
+			return credentialActor(result.key);
+		}
+		const session = await auth.api.getSession({ headers: request.headers });
+		if (!session) fail(401, "unauthorized", "Sign in to continue");
+		return domain.actor(session.user.id);
+	}
+	async function revalidate(request, identity) {
+		if (!identity.machine) return authenticate(request);
+		const key = (await database.db.select().from(apikey).where(eq(apikey.id, identity.ownerId)))[0];
+		if (!key?.enabled || key.referenceId !== identity.id || key.expiresAt && key.expiresAt <= /* @__PURE__ */ new Date()) fail(401, "unauthorized", "The API credential is invalid or expired");
+		return credentialActor(key);
+	}
+	function checkOrigin(request) {
+		if ([
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(request.method)) return;
+		const origin = request.headers.get("origin");
+		if (origin && !config.trustedOrigins.includes(origin)) fail(403, "invalid_origin", "This origin is not allowed");
+		if (request.headers.get("sec-fetch-site") === "cross-site" && !origin) fail(403, "invalid_origin", "Cross-site writes are not allowed");
+	}
+	return {
+		authenticate,
+		revalidate,
+		checkOrigin
+	};
+}
+//#endregion
+//#region src/realtime.ts
+async function createRealtime(config) {
+	const emitter = new EventEmitter();
+	emitter.setMaxListeners(0);
+	let client, closed = false, retry;
+	async function connect() {
+		if (closed) return;
+		const connection = new pg.Client({ connectionString: config.DATABASE_URL });
+		client = connection;
+		const disconnected = () => {
+			if (client !== connection || closed) return;
+			client = void 0;
+			connection.end().catch(() => {});
+			clearTimeout(retry);
+			retry = setTimeout(() => {
+				connect();
+			}, 1e3);
+		};
+		connection.on("error", disconnected);
+		connection.on("end", disconnected);
+		connection.on("notification", () => emitter.emit("change"));
+		try {
+			await connection.connect();
+			await connection.query("LISTEN kanvil_events");
+			emitter.emit("change");
+		} catch {
+			disconnected();
+		}
+	}
+	await connect();
+	return {
+		subscribe(listener) {
+			emitter.on("change", listener);
+			return () => {
+				emitter.off("change", listener);
+			};
+		},
+		async close() {
+			closed = true;
+			clearTimeout(retry);
+			emitter.emit("close");
+			emitter.removeAllListeners();
+			await client?.end();
+		},
+		onClose(listener) {
+			emitter.on("close", listener);
+			return () => {
+				emitter.off("close", listener);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/adapters/rabbitmq.ts
+async function bounded(operation, milliseconds = 5e3) {
+	let timer;
+	try {
+		return await Promise.race([operation, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Broker operation timed out")), milliseconds);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+const createRabbitMqBus = async (configuration, receive, changed) => {
+	const settings = brokerSettingsSchema.parse(configuration.config);
+	if (!settings.url) throw new Error("RabbitMQ connection URL is required");
+	const url = new URL(settings.url);
+	if (!url.searchParams.has("heartbeat")) url.searchParams.set("heartbeat", "10");
+	let channel, available = false;
+	const connection = await connect(url.toString(), {
+		timeout: 5e3,
+		keepAlive: true,
+		clientProperties: { connection_name: "Kanvil event delivery" },
+		recovery: {
+			waitForConnect: false,
+			initialDelay: 1e3,
+			maxDelay: 1e4,
+			async setup(model) {
+				available = false;
+				const next = await model.createConfirmChannel();
+				next.on("error", () => {});
+				next.on("close", () => {
+					if (channel === next) {
+						available = false;
+						changed();
+					}
+				});
+				await bounded((async () => {
+					await next.assertExchange(settings.exchange, "fanout", { durable: true });
+					const queue = await next.assertQueue("", {
+						exclusive: true,
+						autoDelete: true,
+						durable: false,
+						arguments: {
+							"x-max-length": 1e3,
+							"x-overflow": "drop-head"
+						}
+					});
+					await next.bindQueue(queue.queue, settings.exchange, "");
+					await next.prefetch(20);
+					await next.consume(queue.queue, (message) => {
+						if (!message) {
+							available = false;
+							changed();
+							return;
+						}
+						try {
+							if (message.content.length <= 2048) receive(message.content.toString());
+						} finally {
+							next.ack(message);
+						}
+					}, { noAck: false });
+				})());
+				channel = next;
+				available = true;
+				changed();
+			}
+		}
+	});
+	const unavailable = () => {
+		available = false;
+		changed();
+	};
+	connection.on("error", unavailable);
+	connection.on("disconnect", unavailable);
+	connection.on("connect-failed", unavailable);
+	connection.on("blocked", unavailable);
+	connection.on("unblocked", () => {
+		available = !!channel;
+		changed();
+	});
+	return {
+		ready: () => available,
+		async publish(message) {
+			const current = channel;
+			if (!current || !available) throw new Error("RabbitMQ is unavailable");
+			await bounded(new Promise((resolve, reject) => {
+				current.publish(settings.exchange, "", Buffer.from(message), {
+					persistent: true,
+					contentType: "application/json"
+				}, (error) => error ? reject(/* @__PURE__ */ new Error("RabbitMQ did not confirm publication")) : resolve());
+			}));
+		},
+		async close() {
+			available = false;
+			await bounded(connection.close());
+		}
+	};
+};
+//#endregion
+//#region src/adapters/wakeup-buses.ts
+const providers = { rabbitmq: createRabbitMqBus };
+const createWakeupBus = (configuration, receive, changed) => {
+	const factory = providers[configuration.provider];
+	if (!factory) throw new Error("Unsupported event delivery provider");
+	return factory(configuration, receive, changed);
+};
+//#endregion
+//#region src/event-delivery.ts
+const messageSchema = z.object({
+	instanceId: z.uuid(),
+	cursor: z.string().regex(/^\d+$/)
+});
+function brokerEndpoint(settings) {
+	if (!settings.url) return "";
+	const url = new URL(settings.url);
+	return `${url.protocol}//${url.host}${url.pathname}`;
+}
+async function createEventDelivery(config, instance, database, factory = createWakeupBus) {
+	const postgres = await createRealtime(config), emitter = new EventEmitter();
+	emitter.setMaxListeners(0);
+	const identity = (await instance.read()).identity;
+	let bus, fingerprint = "", destination = "", closed = false, pending, dirty = false, error = null;
+	const wake = () => emitter.emit("change");
+	function receive(message) {
+		try {
+			const parsed = messageSchema.safeParse(JSON.parse(message));
+			if (parsed.success && parsed.data.instanceId === identity) wake();
+		} catch {}
+	}
+	async function process() {
+		const settings = await instance.broker(), next = JSON.stringify(settings);
+		if (next !== fingerprint) {
+			const old = bus;
+			bus = void 0;
+			fingerprint = next;
+			await old?.close().catch(() => {});
+			if (settings) {
+				destination = createHash("sha256").update(JSON.stringify([
+					identity,
+					brokerEndpoint(settings),
+					settings.exchange
+				])).digest("hex");
+				bus = await factory({
+					provider: "rabbitmq",
+					config: settings
+				}, receive, () => {
+					if (!closed) {
+						wake();
+						trigger();
+					}
+				});
+			}
+			error = null;
+			wake();
+		}
+		if (!bus) return;
+		if (!bus.ready()) {
+			error = "RabbitMQ is unavailable. PostgreSQL is delivering event wakeups.";
+			return;
+		}
+		await database.db.transaction(async (tx) => {
+			if (!(await tx.execute(sql`SELECT pg_try_advisory_xact_lock(7361085) AS locked`)).rows[0]?.locked) return;
+			const clock = (await tx.select().from(eventClock).where(eq(eventClock.id, 1)))[0]?.value ?? 0n;
+			if (clock <= ((await tx.select().from(deliveryCheckpoints).where(eq(deliveryCheckpoints.destination, destination)))[0]?.cursor ?? 0n)) return;
+			await bus?.publish(JSON.stringify({
+				instanceId: identity,
+				cursor: clock.toString()
+			}));
+			await tx.insert(deliveryCheckpoints).values({
+				destination,
+				cursor: clock
+			}).onConflictDoUpdate({
+				target: deliveryCheckpoints.destination,
+				set: { cursor: clock }
+			});
+		});
+		error = null;
+	}
+	function trigger() {
+		if (closed) return;
+		dirty = true;
+		pending ??= (async () => {
+			while (dirty) {
+				dirty = false;
+				if (closed) break;
+				try {
+					await process();
+				} catch {
+					error = "RabbitMQ is unavailable. PostgreSQL is delivering event wakeups.";
+					if (!bus) fingerprint = "";
+					wake();
+				}
+			}
+		})().finally(() => {
+			pending = void 0;
+		});
+	}
+	const unsubscribe = postgres.subscribe(() => {
+		if (!bus?.ready() || error) wake();
+		trigger();
+	});
+	const timer = setInterval(() => {
+		if (error) wake();
+		trigger();
+	}, 1e3);
+	timer.unref();
+	trigger();
+	return {
+		subscribe(listener) {
+			emitter.on("change", listener);
+			return () => {
+				emitter.off("change", listener);
+			};
+		},
+		onClose(listener) {
+			emitter.on("close", listener);
+			return () => {
+				emitter.off("close", listener);
+			};
+		},
+		status() {
+			return {
+				status: !bus && fingerprint === "null" ? "builtin" : error ? "unavailable" : bus?.ready() ? "ready" : "connecting",
+				error
+			};
+		},
+		async test(settings) {
+			const token = crypto.randomUUID();
+			let received;
+			const readback = new Promise((resolve) => {
+				received = resolve;
+			});
+			const probe = await factory({
+				provider: "rabbitmq",
+				config: settings
+			}, (value) => {
+				if (value === token) received?.();
+			}, () => {});
+			try {
+				const deadline = Date.now() + 5e3;
+				while (!probe.ready()) {
+					if (Date.now() >= deadline) throw new Error("Broker connection timed out");
+					await new Promise((resolve) => setTimeout(resolve, 25));
+				}
+				await probe.publish(token);
+				await bounded(readback);
+			} catch {
+				fail(503, "broker_unavailable", "RabbitMQ connection could not be verified. Check its URL, exchange, and permissions.");
+			} finally {
+				await probe.close().catch(() => {});
+			}
+		},
+		async close() {
+			closed = true;
+			clearInterval(timer);
+			unsubscribe();
+			await pending;
+			await bus?.close().catch(() => {});
+			emitter.emit("close");
+			emitter.removeAllListeners();
+			await postgres.close();
+		}
+	};
+}
+//#endregion
+//#region src/instance-routes.ts
+function registerInstanceRoutes(app, database, instance, blobs, search, delivery) {
+	app.openAPIRegistry.registerComponent("securitySchemes", "sessionCookie", {
+		type: "apiKey",
+		in: "cookie",
+		name: "better-auth.session_token",
+		description: "Signed-in local or OIDC session. Instance administration additionally requires the admin role."
+	});
+	const endpoints = [
+		{
+			method: "get",
+			path: "/admin/instance",
+			output: adminInstanceSchema
+		},
+		{
+			method: "patch",
+			path: "/admin/instance",
+			input: instanceUpdateSchema,
+			output: okSchema
+		},
+		{
+			method: "post",
+			path: "/admin/storage/test",
+			input: s3SettingsSchema,
+			output: okSchema
+		},
+		{
+			method: "post",
+			path: "/admin/search/test",
+			input: searchSettingsSchema,
+			output: okSchema
+		},
+		{
+			method: "post",
+			path: "/admin/broker/test",
+			input: brokerSettingsSchema,
+			output: okSchema
+		},
+		{
+			method: "post",
+			path: "/admin/search/reindex",
+			output: okSchema,
+			status: 202
+		},
+		{
+			method: "post",
+			path: "/admin/storage/cleanup",
+			output: z.object({ removed: z.number() })
+		},
+		{
+			method: "post",
+			path: "/profile/photo",
+			input: photoInputSchema,
+			output: photoResultSchema
+		},
+		{
+			method: "delete",
+			path: "/profile/photo",
+			output: photoResultSchema
+		}
+	];
+	for (const endpoint of endpoints) app.openAPIRegistry.registerPath({
+		method: endpoint.method,
+		path: `/api/v1${endpoint.path}`,
+		security: [{ sessionCookie: [] }],
+		..."input" in endpoint ? { request: { body: {
+			content: { "application/json": { schema: endpoint.input } },
+			required: true
+		} } } : {},
+		responses: {
+			["status" in endpoint ? endpoint.status : 200]: {
+				description: "Success",
+				content: { "application/json": { schema: endpoint.output } }
+			},
+			401: { description: "Session required" },
+			403: { description: "Administrator access required" },
+			409: { description: "Settings version conflict" },
+			503: { description: "Integration unavailable" }
+		}
+	});
+	app.openAPIRegistry.registerPath({
+		method: "get",
+		path: "/api/v1/users/{id}/photo",
+		security: [{ sessionCookie: [] }],
+		request: { params: z.object({ id: z.string() }) },
+		responses: {
+			200: {
+				description: "Private profile image",
+				content: {
+					"image/png": { schema: z.string() },
+					"image/jpeg": { schema: z.string() },
+					"image/webp": { schema: z.string() }
+				}
+			},
+			401: { description: "Session required" },
+			404: { description: "No profile photo" }
+		}
+	});
+	app.get("/api/v1/admin/instance", async () => {
+		const row = await instance.read(), active = await instance.storage(), backend = active ? await instance.backend(active.id) : null, broker = await instance.broker(), external = await instance.search(), status = await search.status();
+		const locations = await database.db.select({
+			id: storageBackends.id,
+			config: storageBackends.config,
+			objects: count(blobObjects.id)
+		}).from(storageBackends).leftJoin(blobObjects, eq(blobObjects.backendId, storageBackends.id)).groupBy(storageBackends.id);
+		return Response.json({
+			id: row.identity,
+			version: row.version,
+			name: row.name,
+			description: row.description,
+			storage: {
+				provider: backend ? "s3" : "local",
+				source: instance.config.KANVIL_STORAGE_PROVIDER ? "deployment" : "admin",
+				settings: backend ? {
+					...backend.settings,
+					secretAccessKey: void 0
+				} : null,
+				secretConfigured: !!backend?.settings.secretAccessKey,
+				...await blobs.status()
+			},
+			search: {
+				provider: external ? "elasticsearch" : "postgres",
+				source: instance.config.KANVIL_SEARCH_PROVIDER ? "deployment" : "admin",
+				settings: external ? {
+					...external,
+					apiKey: void 0,
+					password: void 0
+				} : null,
+				secretConfigured: !!(external?.apiKey || external?.password),
+				...status
+			},
+			broker: {
+				provider: broker ? "rabbitmq" : "postgres",
+				source: instance.config.KANVIL_BROKER_PROVIDER ? "deployment" : "admin",
+				settings: broker ? {
+					endpoint: brokerEndpoint(broker),
+					exchange: broker.exchange
+				} : null,
+				secretConfigured: !!broker?.url,
+				...delivery.status()
+			},
+			deployment: {
+				url: instance.config.KANVIL_URL,
+				version: "0.1.0",
+				oidc: instance.config.OIDC_DISCOVERY_URL ? {
+					name: instance.config.OIDC_NAME,
+					discoveryUrl: instance.config.OIDC_DISCOVERY_URL,
+					clientId: instance.config.OIDC_CLIENT_ID
+				} : null,
+				push: instance.config.KANVIL_PUSH_ENABLED
+			},
+			locations: await Promise.all(locations.map(async (location) => {
+				const saved = await instance.backend(location.id);
+				return {
+					id: location.id,
+					bucket: saved.settings.bucket,
+					endpoint: saved.settings.endpoint,
+					prefix: saved.settings.prefix,
+					objects: location.objects
+				};
+			}))
+		});
+	});
+	app.patch("/api/v1/admin/instance", async (c) => {
+		const input = instanceUpdateSchema.parse(await c.req.json());
+		assertVersion(await instance.read(), input.expectedVersion, "instance settings", "saving");
+		if (!instance.config.KANVIL_STORAGE_PROVIDER && input.storage.provider === "s3") {
+			const candidate = await instance.resolveS3(input.storage), active = await instance.storage();
+			if (!isDeepStrictEqual(candidate, active ? (await instance.backend(active.id)).settings : null)) await blobs.test({
+				provider: "s3",
+				config: candidate
+			});
+		}
+		if (!instance.config.KANVIL_SEARCH_PROVIDER && input.search.provider === "elasticsearch") {
+			const candidate = await instance.resolveSearch(input.search);
+			if (!isDeepStrictEqual(candidate, await instance.search())) await search.test(candidate);
+		}
+		if (!instance.config.KANVIL_BROKER_PROVIDER && input.broker?.provider === "rabbitmq") {
+			const candidate = await instance.resolveBroker(input.broker);
+			if (!isDeepStrictEqual(candidate, await instance.broker())) await delivery.test(candidate);
+		}
+		await instance.update(input);
+		return Response.json({ ok: true });
+	});
+	app.post("/api/v1/admin/storage/test", async (c) => {
+		const active = instance.config.KANVIL_STORAGE_PROVIDER ? await instance.storage() : null;
+		await blobs.test({
+			provider: "s3",
+			config: active ? (await instance.backend(active.id)).settings : await instance.resolveS3(s3SettingsSchema.parse(await c.req.json()))
+		});
+		return Response.json({ ok: true });
+	});
+	app.post("/api/v1/admin/search/test", async (c) => {
+		const active = instance.config.KANVIL_SEARCH_PROVIDER ? await instance.search() : null;
+		await search.test(active ?? await instance.resolveSearch(searchSettingsSchema.parse(await c.req.json())));
+		return Response.json({ ok: true });
+	});
+	app.post("/api/v1/admin/broker/test", async (c) => {
+		const active = instance.config.KANVIL_BROKER_PROVIDER ? await instance.broker() : null;
+		await delivery.test(active ?? await instance.resolveBroker(brokerSettingsSchema.parse(await c.req.json())));
+		return Response.json({ ok: true });
+	});
+	app.post("/api/v1/admin/search/reindex", async () => {
+		await search.rebuild();
+		return Response.json({ ok: true }, { status: 202 });
+	});
+	app.post("/api/v1/admin/storage/cleanup", async () => Response.json({ removed: await blobs.collect() }));
+	app.post("/api/v1/profile/photo", async (c) => {
+		const actor = requireSession(c.get("actor")), input = photoInputSchema.parse(await c.req.json()), bytes = decodeImage(input);
+		const id = crypto.randomUUID(), image = `/api/v1/users/${actor.id}/photo?v=${id}`;
+		await database.db.transaction(async (tx) => {
+			await blobs.put(tx, id, bytes, input.contentType);
+			await tx.insert(profilePhotos).values({
+				userId: actor.id,
+				objectId: id
+			}).onConflictDoUpdate({
+				target: profilePhotos.userId,
+				set: { objectId: id }
+			});
+			await tx.update(user).set({
+				image,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(eq(user.id, actor.id));
+		});
+		blobs.sync().catch(() => {});
+		return Response.json({ image });
+	});
+	app.delete("/api/v1/profile/photo", async (c) => {
+		const actor = requireSession(c.get("actor"));
+		await database.db.transaction(async (tx) => {
+			await tx.delete(profilePhotos).where(eq(profilePhotos.userId, actor.id));
+			await tx.update(user).set({
+				image: null,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(eq(user.id, actor.id));
+		});
+		return Response.json({ image: null });
+	});
+	app.get("/api/v1/users/:id/photo", async (c) => {
+		requireSession(c.get("actor"));
+		const photo = one(await database.db.select().from(profilePhotos).where(eq(profilePhotos.userId, c.req.param("id"))));
+		const blob = await blobs.get(photo.objectId);
+		return imageResponse(blob);
+	});
+}
+//#endregion
+//#region src/push.ts
+const delay = (attempt) => Math.min(6e4 * 2 ** attempt, 36e5);
+async function deliverPushBatch(database, config, transport) {
+	const lock = await database.pool.connect();
+	let ownsLock = false;
+	try {
+		if (!(await lock.query("SELECT pg_try_advisory_lock(7361082) AS acquired")).rows[0]?.acquired) return;
+		ownsLock = true;
+		const jobs = await database.db.select({ id: pushDeliveries.id }).from(pushDeliveries).where(and(isNull(pushDeliveries.finishedAt), lte(pushDeliveries.availableAt, /* @__PURE__ */ new Date()))).orderBy(asc(pushDeliveries.availableAt)).limit(100);
+		for (const pending of jobs) {
+			const row = (await database.db.select({
+				job: pushDeliveries,
+				device: pushDevices,
+				notification: notifications,
+				event: events,
+				preference: notificationPreferences,
+				account: user,
+				session,
+				projectRole: projectRoleSQL(user.id, notifications.projectId),
+				subscription: subscriptions,
+				ticketId: tickets.id
+			}).from(pushDeliveries).innerJoin(pushDevices, eq(pushDevices.id, pushDeliveries.deviceId)).innerJoin(notifications, eq(notifications.id, pushDeliveries.notificationId)).innerJoin(events, eq(events.id, notifications.eventId)).leftJoin(tickets, eq(tickets.id, events.ticketId)).innerJoin(user, eq(user.id, pushDevices.userId)).innerJoin(session, eq(session.id, pushDevices.sessionId)).leftJoin(notificationPreferences, eq(notificationPreferences.userId, user.id)).leftJoin(subscriptions, and(eq(subscriptions.ticketId, events.ticketId), eq(subscriptions.userId, user.id))).where(and(eq(pushDeliveries.id, pending.id), isNull(pushDeliveries.finishedAt))))[0];
+			if (!row) continue;
+			const { job, device, event } = row;
+			const finish = async (error) => database.db.update(pushDeliveries).set({
+				finishedAt: /* @__PURE__ */ new Date(),
+				error
+			}).where(eq(pushDeliveries.id, job.id));
+			if (device.userId !== row.notification.userId || row.account.banned || row.session.expiresAt <= /* @__PURE__ */ new Date() || !row.preference?.push || !row.subscription && row.ticketId !== null || !row.projectRole && !hasAdminRole(row.account.role)) {
+				await finish("access_revoked");
+				continue;
+			}
+			if (row.notification.createdAt.getTime() < Date.now() - 864e5) {
+				await finish("expired");
+				continue;
+			}
+			try {
+				let result;
+				if (job.receiptId) result = (await transport.getPushNotificationReceiptsAsync([job.receiptId]))[job.receiptId];
+				else result = (await transport.sendPushNotificationsAsync([{
+					to: device.token,
+					title: "Kanvil",
+					body: "A subscribed ticket has an update.",
+					sound: "default",
+					channelId: "tickets",
+					ttl: 3600,
+					data: {
+						server: config.KANVIL_URL,
+						projectId: event.projectId,
+						ticketId: event.ticketId,
+						notificationId: row.notification.id
+					}
+				}]))[0];
+				if (result?.status === "ok") {
+					if (!job.receiptId && "id" in result) await database.db.update(pushDeliveries).set({
+						receiptId: result.id,
+						availableAt: new Date(Date.now() + 9e5),
+						attempts: 0,
+						error: null
+					}).where(eq(pushDeliveries.id, job.id));
+					else await finish(null);
+				} else if (result?.status === "error" && result.details?.error !== "MessageRateExceeded") {
+					if (result.details?.error === "DeviceNotRegistered") await database.db.delete(pushDevices).where(eq(pushDevices.id, device.id));
+					else await finish(result.details?.error ?? "delivery_rejected");
+				} else await retry(result ? "rate_limited" : "receipt_pending");
+			} catch {
+				await retry("transport_error");
+			}
+			async function retry(error) {
+				await database.db.update(pushDeliveries).set({
+					attempts: job.attempts + 1,
+					error,
+					availableAt: new Date(Date.now() + (job.receiptId ? 9e5 : delay(job.attempts))),
+					finishedAt: job.attempts >= 4 && error !== "receipt_pending" ? /* @__PURE__ */ new Date() : null
+				}).where(eq(pushDeliveries.id, job.id));
+			}
+		}
+	} finally {
+		try {
+			if (ownsLock) await lock.query("SELECT pg_advisory_unlock(7361082)");
+		} finally {
+			lock.release();
+		}
+	}
+}
+function createPushDelivery(database, config) {
+	let running;
+	const transport = new Expo(config.EXPO_ACCESS_TOKEN ? { accessToken: config.EXPO_ACCESS_TOKEN } : {});
+	const tick = () => {
+		if (!running) running = deliverPushBatch(database, config, transport).catch(() => {
+			console.error("Push delivery failed; queued notifications will be retried.");
+		}).finally(() => {
+			running = void 0;
+		});
+	};
+	const timer = config.KANVIL_PUSH_ENABLED ? setInterval(tick, 3e4) : void 0;
+	timer?.unref();
+	return { async close() {
+		clearInterval(timer);
+		await running;
+	} };
+}
+//#endregion
+//#region src/runtime-adapters.ts
+const defaultAdapters = {
+	auth: createAuth,
+	realtime: createEventDelivery,
+	push: createPushDelivery,
+	objectStore: createObjectStore,
+	ticketIndex: createTicketIndex,
+	jobs: createPollingJob
+};
+//#endregion
+//#region src/mcp.ts
+function createMcp(auth, domain, access, config, limitWrite) {
+	const serve = (request, identity, limited = false) => createMcpHandler(() => {
+		const server = new McpServer({
+			name: "Kanvil",
+			version: "0.1.0"
+		});
+		for (const name of Object.keys(operations).filter(isOperation)) {
+			const spec = operations[name];
+			const inputSchema = spec.input.shape;
+			server.registerTool(name, {
+				description: spec.description,
+				inputSchema,
+				outputSchema: { result: spec.output },
+				annotations: {
+					readOnlyHint: spec.method === "GET",
+					destructiveHint: /^(delete|remove|recover)_/.test(name),
+					idempotentHint: spec.method === "GET",
+					openWorldHint: false
+				}
+			}, async (input) => {
+				try {
+					if (limited && spec.method !== "GET") limitWrite(identity.ownerId);
+					const result = await domain.execute(name, input, identity);
+					return {
+						content: [{
+							type: "text",
+							text: `${name} completed.`
+						}],
+						structuredContent: { result }
+					};
+				} catch (error) {
+					if (!(error instanceof ApiError) && !(error instanceof z.ZodError)) throw error;
+					return {
+						isError: true,
+						content: [{
+							type: "text",
+							text: error instanceof ApiError ? `${error.code}: ${error.message}` : "validation_error: Invalid tool arguments"
+						}]
+					};
+				}
+			});
+		}
+		return server;
+	}, { legacy: "stateless" }).fetch(request);
+	const oauth = requireMcpAuth(auth, async (request, claims) => {
+		if (typeof claims.sub !== "string") throw new ApiError(401, "unauthorized", "A user subject is required");
+		const granted = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
+		const permissions = scopes.filter((scope) => granted.includes(`kanvil:${scope}`));
+		const clientId = typeof claims.client_id === "string" ? claims.client_id : "oauth";
+		return serve(request, await domain.actor(claims.sub, {
+			ownerId: `${claims.sub}:${clientId}`,
+			scopes: permissions
+		}), true);
+	}, {
+		resource: `${config.KANVIL_URL}/mcp`,
+		challengeScopes: ["kanvil:read"]
+	});
+	return async (request) => {
+		if (request.headers.get("authorization")?.match(/^Bearer\s+kv_/i)) return serve(request, await access.authenticate(request));
+		return oauth(request);
+	};
+}
+//#endregion
+//#region src/app.ts
+const setupInput = z$1.object({
+	token: z$1.string().max(200),
+	email: z$1.email(),
+	name: z$1.string().trim().min(1).max(120),
+	password: z$1.string().min(12).max(128)
+}).strict();
+const keyInput = z$1.object({
+	name: z$1.string().trim().min(1).max(100),
+	projectIds: z$1.array(z$1.uuid()).min(1).max(1e3),
+	scopes: z$1.array(z$1.enum(scopes)).min(1),
+	expiresIn: z$1.number().int().min(3600).max(31536e3).default(7776e3)
+}).strict();
+const digest = (value) => createHash("sha256").update(value).digest();
+async function createApplication(database, config, overrides = {}) {
+	const adapters = {
+		...defaultAdapters,
+		...overrides
+	};
+	const integrationDatabase = createDatabase(config.DATABASE_URL);
+	const instance = createInstance(integrationDatabase, config);
+	await instance.read();
+	const blobs = createBlobStorage(integrationDatabase, instance, adapters.objectStore, adapters.jobs), search = createTicketSearch(integrationDatabase, instance, adapters.ticketIndex, adapters.jobs);
+	const auth = adapters.auth(database, config), domain = createDomain(database, {
+		blobs,
+		search
+	}), access = createAccess(auth, domain, config, database), realtime = await adapters.realtime(config, instance, integrationDatabase);
+	const unsubscribeJobs = realtime.subscribe(() => {
+		blobs.sync().catch(() => {});
+		search.sync().catch(() => {});
+	});
+	const push = adapters.push(database, config);
+	const accounts = createAccountAdministration(integrationDatabase, auth);
+	const app = new OpenAPIHono({ defaultHook: (result) => {
+		if (!result.success) return Response.json({ error: {
+			code: "validation_error",
+			message: "Invalid request",
+			details: result.error.issues.map((issue) => ({
+				path: issue.path.join("."),
+				message: issue.message
+			}))
+		} }, { status: 400 });
+	} });
+	app.use("*", secureHeaders());
+	app.use("*", bodyLimit({
+		maxSize: 15e6,
+		onError: () => Response.json({ error: {
+			code: "payload_too_large",
+			message: "The request exceeds the upload limit"
+		} }, { status: 413 })
+	}));
+	app.onError((error) => {
+		if (error instanceof APIError && error.statusCode >= 400 && error.statusCode < 500) return Response.json({ error: {
+			code: typeof error.body?.code === "string" ? error.body.code : "authentication_error",
+			message: typeof error.body?.message === "string" ? error.body.message : "Authentication request failed"
+		} }, { status: error.statusCode });
+		if (error instanceof ApiError) {
+			const retry = error.status === 429 && error.details && typeof error.details === "object" && "retryAfterSeconds" in error.details ? String(error.details.retryAfterSeconds) : void 0;
+			return Response.json({ error: {
+				status: error.status,
+				code: error.code,
+				message: error.message,
+				details: error.details
+			} }, {
+				status: error.status,
+				headers: retry ? { "Retry-After": retry } : {}
+			});
+		}
+		if (error instanceof z$1.ZodError) return Response.json({ error: {
+			code: "validation_error",
+			message: "Invalid request",
+			details: error.issues.map((issue) => ({
+				path: issue.path.join("."),
+				message: issue.message
+			}))
+		} }, { status: 400 });
+		if (error instanceof SyntaxError || error instanceof HTTPException) return Response.json({ error: {
+			code: "invalid_request",
+			message: "The request could not be parsed"
+		} }, { status: error instanceof HTTPException ? error.status : 400 });
+		console.error("Kanvil request failed", { name: error.name });
+		return Response.json({ error: {
+			code: "internal_error",
+			message: "The request could not be completed"
+		} }, { status: 500 });
+	});
+	app.notFound(() => Response.json({ error: {
+		code: "not_found",
+		message: "The requested endpoint was not found"
+	} }, { status: 404 }));
+	app.get("/healthz", async () => {
+		await database.pool.query("SELECT 1");
+		return Response.json({ status: "ok" });
+	});
+	const setupRequired = async () => (await database.pool.query("SELECT count(*)::int AS count FROM \"user\"")).rows[0]?.count === 0;
+	app.get("/api/v1/info", async () => Response.json({
+		...await instance.read().then((row) => ({
+			name: row.name,
+			description: row.description
+		})),
+		version: "0.1.0",
+		setupRequired: await setupRequired(),
+		push: config.KANVIL_PUSH_ENABLED,
+		oidc: config.OIDC_DISCOVERY_URL ? {
+			id: "oidc",
+			name: config.OIDC_NAME
+		} : null
+	}));
+	app.post("/api/v1/setup", async (c) => {
+		access.checkOrigin(c.req.raw);
+		const input = setupInput.parse(await c.req.json());
+		if (!config.KANVIL_SETUP_TOKEN || !timingSafeEqual(digest(input.token), digest(config.KANVIL_SETUP_TOKEN))) fail(403, "invalid_setup_token", "The setup token is invalid");
+		await database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+			if (!await setupRequired()) fail(409, "setup_complete", "Initial setup is already complete");
+			const created = await auth.api.createUser({ body: {
+				email: input.email,
+				name: input.name,
+				password: input.password,
+				role: "admin"
+			} });
+			const workspace = one(await tx.select().from(workspaces).where(eq(workspaces.slug, "kanvil")));
+			await tx.insert(workspaceMembers).values({
+				workspaceId: workspace.id,
+				userId: created.user.id,
+				role: "admin"
+			});
+		});
+		return Response.json({ ok: true }, { status: 201 });
+	});
+	app.all("/api/auth/api-key/*", () => Response.json({ error: {
+		code: "not_found",
+		message: "Use the Kanvil credentials API"
+	} }, { status: 404 }));
+	app.on(["GET", "POST"], ["/api/auth/*", "/.well-known/*"], (c) => accounts.handleAuth(c.req.raw));
+	const writes = createWriteLimiter(config.KANVIL_SESSION_WRITE_LIMIT);
+	const mcpHandler = createMcp(auth, domain, access, config, (key) => writes.consume(key));
+	app.all("/mcp", (c) => mcpHandler(c.req.raw));
+	app.use("/api/v1/*", async (c, next) => {
+		access.checkOrigin(c.req.raw);
+		const actor = await access.authenticate(c.req.raw);
+		c.set("actor", actor);
+		if (!actor.machine && ![
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(c.req.method)) writes.consume(actor.id);
+		await next();
+	});
+	app.use("/api/v1/admin/*", async (c, next) => {
+		requireInstanceAdmin(c.get("actor"));
+		await next();
+	});
+	registerInstanceRoutes(app, database, instance, blobs, search, realtime);
+	accounts.register(app);
+	app.openAPIRegistry.registerPath({
+		method: "get",
+		path: "/api/v1/projects/{projectId}/icon",
+		security: [{ sessionCookie: [] }],
+		request: { params: z$1.object({ projectId: z$1.string() }) },
+		responses: {
+			200: {
+				description: "Private project icon",
+				content: {
+					"image/png": { schema: z$1.string() },
+					"image/jpeg": { schema: z$1.string() },
+					"image/webp": { schema: z$1.string() }
+				}
+			},
+			404: { description: "Project icon unavailable" }
+		}
+	});
+	app.get("/api/v1/projects/:projectId/icon", async (c) => {
+		const project = await domain.execute("get_project", { projectId: c.req.param("projectId") }, c.get("actor"));
+		const row = one(await database.db.select({ objectId: projects.iconObjectId }).from(projects).where(eq(projects.id, project.id)));
+		if (!row.objectId) fail(404, "not_found", "This project has no uploaded icon");
+		return imageResponse(await blobs.get(row.objectId));
+	});
+	app.get("/api/v1/credentials", async (c) => {
+		const identity = c.get("actor");
+		if (identity.machine) fail(403, "forbidden", "Use a signed-in account to manage credentials");
+		const rows = await database.db.select({
+			id: apikey.id,
+			name: apikey.name,
+			start: apikey.start,
+			enabled: apikey.enabled,
+			expiresAt: apikey.expiresAt,
+			createdAt: apikey.createdAt,
+			permissions: apikey.permissions,
+			metadata: apikey.metadata
+		}).from(apikey).where(eq(apikey.referenceId, identity.id)).orderBy(desc(apikey.createdAt));
+		return Response.json(json(rows));
+	});
+	app.post("/api/v1/credentials", async (c) => {
+		const identity = c.get("actor");
+		if (identity.machine) fail(403, "forbidden", "Use a signed-in account to manage credentials");
+		const input = keyInput.parse(await c.req.json()), allowed = await domain.accessibleProjects(identity);
+		if (input.projectIds.some((id) => !allowed.some((row) => row.id === id))) fail(403, "forbidden", "Choose projects you can access");
+		const key = await auth.api.createApiKey({ body: {
+			userId: identity.id,
+			name: input.name,
+			prefix: "kv_",
+			metadata: { projectIds: input.projectIds },
+			permissions: { kanvil: input.scopes },
+			expiresIn: input.expiresIn,
+			rateLimitEnabled: true,
+			rateLimitMax: 600,
+			rateLimitTimeWindow: 6e4
+		} });
+		return Response.json({
+			id: key.id,
+			key: key.key,
+			name: key.name,
+			expiresAt: key.expiresAt
+		}, { status: 201 });
+	});
+	app.delete("/api/v1/credentials/:id", async (c) => {
+		const identity = c.get("actor");
+		if (identity.machine) fail(403, "forbidden", "Use a signed-in account to manage credentials");
+		const id = c.req.param("id");
+		one(await database.db.select({ id: apikey.id }).from(apikey).where(and(eq(apikey.id, id), eq(apikey.referenceId, identity.id))));
+		await auth.api.deleteApiKey({
+			body: { keyId: id },
+			headers: c.req.raw.headers
+		});
+		return Response.json({ ok: true });
+	});
+	app.get("/api/v1/snapshot", async (c) => Response.json(await domain.snapshot(c.get("actor"), z$1.string().min(1).parse(c.req.query("projectId")))));
+	app.get("/api/v1/checkpoint", async () => {
+		const row = one(await database.db.select().from(eventClock).where(eq(eventClock.id, 1)));
+		return Response.json({ cursor: row.value.toString() });
+	});
+	app.get("/api/v1/projects/:projectId/attachments/:id/content", async (c) => {
+		const id = z$1.uuid().parse(c.req.param("id"));
+		const row = one(await database.db.select().from(attachments).where(eq(attachments.id, id)));
+		const authorized = await domain.execute("list_attachments", {
+			projectId: c.req.param("projectId"),
+			ticketId: row.ticketId
+		}, c.get("actor"));
+		requireRow(authorized.find((item) => item.id === id));
+		const bytes = row.objectId ? (await blobs.get(row.objectId)).data : one(await database.db.select({ data: attachmentContent.data }).from(attachmentContent).where(eq(attachmentContent.id, id))).data;
+		if (bytes.length !== row.size) fail(500, "attachment_corrupt", "Attachment integrity check failed");
+		return new Response(bytes, { headers: {
+			"Content-Type": row.contentType,
+			"Content-Length": String(row.size),
+			"Content-Disposition": `attachment; filename="download"; filename*=UTF-8''${encodeURIComponent(row.name)}`,
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": "sandbox"
+		} });
+	});
+	app.get("/api/v1/notifications/preferences", async (c) => {
+		const row = (await database.db.select().from(notificationPreferences).where(eq(notificationPreferences.userId, c.get("actor").id)))[0];
+		return Response.json(notificationPreferencesSchema.parse(row ? {
+			inApp: row.inApp,
+			push: row.push
+		} : {}));
+	});
+	app.put("/api/v1/notifications/preferences", async (c) => {
+		const identity = requireSession(c.get("actor"));
+		const input = notificationPreferencesInput.parse(await c.req.json());
+		const row = one(await database.db.insert(notificationPreferences).values({
+			userId: identity.id,
+			...input
+		}).onConflictDoUpdate({
+			target: notificationPreferences.userId,
+			set: input
+		}).returning({
+			inApp: notificationPreferences.inApp,
+			push: notificationPreferences.push
+		}));
+		return Response.json(notificationPreferencesSchema.parse(row));
+	});
+	app.post("/api/v1/notifications/device", async (c) => {
+		const identity = requireSession(c.get("actor"));
+		if (!config.KANVIL_PUSH_ENABLED) fail(503, "push_disabled", "Push notifications are disabled on this server");
+		const input = pushDeviceInput.parse(await c.req.json());
+		if (!Expo.isExpoPushToken(input.token)) fail(400, "invalid_push_token", "Use an Expo push token");
+		const current = requireRow((await auth.api.getSession({ headers: c.req.raw.headers }))?.session);
+		await database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+			const existing = (await tx.select().from(pushDevices).where(eq(pushDevices.token, input.token)))[0];
+			if (existing?.userId === identity.id && existing.sessionId === current.id) return;
+			if (existing) await tx.delete(pushDevices).where(eq(pushDevices.id, existing.id));
+			await tx.insert(pushDevices).values({
+				userId: identity.id,
+				sessionId: current.id,
+				token: input.token
+			});
+		});
+		return Response.json({ ok: true });
+	});
+	app.delete("/api/v1/notifications/device", async (c) => {
+		const identity = requireSession(c.get("actor")), input = pushDeviceInput.parse(await c.req.json());
+		await database.db.delete(pushDevices).where(and(eq(pushDevices.userId, identity.id), eq(pushDevices.token, input.token)));
+		return Response.json({ ok: true });
+	});
+	app.get("/api/v1/notifications", async (c) => {
+		const identity = c.get("actor"), allowed = await domain.accessibleProjects(identity);
+		if (!allowed.length) return Response.json([]);
+		return Response.json(json(await database.db.select({
+			id: notifications.id,
+			readAt: notifications.readAt,
+			event: events
+		}).from(notifications).innerJoin(events, eq(events.id, notifications.eventId)).where(and(eq(notifications.userId, identity.id), eq(notifications.inbox, true), inArray(notifications.projectId, allowed.map((row) => row.id)))).orderBy(desc(notifications.createdAt)).limit(100)));
+	});
+	app.post("/api/v1/notifications/read", async (c) => {
+		requireSession(c.get("actor"));
+		const input = z$1.object({ ids: z$1.array(z$1.uuid()).min(1).max(100) }).parse(await c.req.json());
+		await database.db.update(notifications).set({ readAt: /* @__PURE__ */ new Date() }).where(and(eq(notifications.userId, c.get("actor").id), inArray(notifications.id, input.ids)));
+		return Response.json({ ok: true });
+	});
+	app.get("/api/v1/events", async (c) => {
+		const projectId = c.req.query("projectId");
+		const raw = c.req.query("cursor") ?? c.req.header("last-event-id");
+		let cursor = raw === void 0 ? one(await database.db.select().from(eventClock).where(eq(eventClock.id, 1))).value : BigInt(z$1.string().regex(/^\d{1,19}$/).parse(raw));
+		await domain.readEvents(c.get("actor"), cursor, projectId);
+		c.header("X-Accel-Buffering", "no");
+		c.header("Cache-Control", "no-cache, no-transform");
+		return streamSSE(c, async (stream) => {
+			let active = true, busy = false, again = false;
+			let finish;
+			const done = new Promise((resolve) => {
+				finish = resolve;
+			});
+			const stop = () => {
+				if (!active) return;
+				active = false;
+				clearInterval(heartbeat);
+				unsubscribe();
+				unsubscribeClose();
+				finish();
+			};
+			const pump = async () => {
+				if (!active) return;
+				if (busy) {
+					again = true;
+					return;
+				}
+				busy = true;
+				try {
+					do {
+						if (!active) break;
+						again = false;
+						const identity = await access.revalidate(c.req.raw, c.get("actor"));
+						const batch = await domain.readEvents(identity, cursor, projectId);
+						for (const event of batch.items) {
+							if (!active) break;
+							await stream.writeSSE({
+								event: "change",
+								id: event.id.toString(),
+								data: JSON.stringify(json(event))
+							});
+						}
+						cursor = batch.cursor;
+						if (active) await stream.writeSSE({
+							event: "checkpoint",
+							id: cursor.toString(),
+							data: JSON.stringify({ cursor: cursor.toString() })
+						});
+						if (batch.items.length === 200) again = true;
+					} while (again);
+				} catch (error) {
+					if (active && error instanceof ApiError) await stream.writeSSE({
+						event: "error",
+						data: JSON.stringify({
+							status: error.status,
+							code: error.code,
+							message: error.message
+						})
+					}).catch(() => {});
+					stop();
+				} finally {
+					busy = false;
+				}
+			};
+			const schedule = () => {
+				pump();
+			};
+			const unsubscribe = realtime.subscribe(schedule), unsubscribeClose = realtime.onClose(stop);
+			const heartbeat = setInterval(schedule, 15e3);
+			stream.onAbort(stop);
+			await pump();
+			await done;
+		});
+	});
+	for (const name of Object.keys(operations).filter(isOperation)) {
+		const spec = operations[name], params = {}, rest = {};
+		const keys = [...spec.path.matchAll(/\{(\w+)\}/g)].map((match) => match[1]);
+		for (const [key, value] of Object.entries(spec.input.shape)) if (keys.includes(key)) params[key] = value;
+		else rest[key] = value;
+		const method = spec.method === "GET" ? "get" : spec.method === "POST" ? "post" : spec.method === "PATCH" ? "patch" : "delete";
+		const route = createRoute({
+			method,
+			path: `/api/v1${spec.path}`,
+			operationId: name,
+			description: spec.description,
+			security: [{ bearerAuth: [] }],
+			request: {
+				params: z$1.object(params),
+				...method === "get" ? { query: z$1.object(rest).strict() } : { body: {
+					content: { "application/json": { schema: z$1.object(rest).strict() } },
+					required: true
+				} }
+			},
+			responses: {
+				200: {
+					description: "Success",
+					content: { "application/json": { schema: spec.output } }
+				},
+				400: {
+					description: "Invalid input",
+					content: { "application/json": { schema: errorSchema } }
+				},
+				401: { description: "Authentication required" },
+				403: { description: "Insufficient permissions" },
+				404: { description: "Not found" },
+				409: { description: "Version, ownership, or dependency conflict" },
+				429: { description: "Too many writes from this session; see Retry-After" }
+			}
+		});
+		app.openapi(route, async (c) => {
+			const values = spec.method === "GET" ? c.req.query() : z$1.record(z$1.string(), z$1.unknown()).parse(await c.req.json());
+			return Response.json(await domain.execute(name, {
+				...values,
+				...c.req.param()
+			}, c.get("actor")));
+		});
+	}
+	app.openAPIRegistry.registerComponent("securitySchemes", "bearerAuth", {
+		type: "http",
+		scheme: "bearer",
+		description: "Kanvil API credential. Signed-in browser/mobile sessions are also accepted."
+	});
+	app.doc31("/api/openapi.json", {
+		openapi: "3.1.0",
+		info: {
+			title: "Kanvil API",
+			version: "0.1.0"
+		},
+		servers: [{ url: config.KANVIL_URL }]
+	});
+	const webRoot = fileURLToPath(new URL("../../web/dist", import.meta.url));
+	app.use("*", async (c, next) => {
+		await next();
+		if (!c.res.headers.get("Content-Type")?.startsWith("text/html")) return;
+		c.header("Content-Length", void 0);
+		const imageUrl = new URL("/brand/social.png", config.KANVIL_URL).href;
+		const html = (await c.res.text()).replaceAll("content=\"/brand/social.png\"", `content="${imageUrl}"`);
+		c.res = new Response(html, {
+			status: c.res.status,
+			headers: c.res.headers
+		});
+	});
+	app.on("GET", "*", serveStatic({
+		root: webRoot,
+		onFound: (path, c) => {
+			c.header("Cache-Control", path.endsWith("/index.html") ? "no-store" : c.req.path.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "public, max-age=3600");
+		}
+	}));
+	app.get("*", async (c, next) => {
+		if (c.req.path.startsWith("/api/") || c.req.path.startsWith("/.well-known/") || c.req.path === "/mcp" || c.req.path.includes(".")) return next();
+		c.header("Cache-Control", "no-store");
+		return serveStatic({
+			root: webRoot,
+			path: "index.html"
+		})(c, next);
+	});
+	return {
+		app,
+		auth,
+		domain,
+		instance,
+		blobs,
+		search,
+		realtime,
+		close: async () => {
+			unsubscribeJobs();
+			await realtime.close();
+			await search.close();
+			await blobs.close();
+			await integrationDatabase.pool.end();
+			await push.close();
+		}
+	};
+}
+//#endregion
+//#region src/index.ts
+const config = readConfig();
+const database = createDatabase(config.DATABASE_URL);
+await migrateDatabase(database);
+const application = await createApplication(database, config);
+const server = serve({
+	fetch: application.app.fetch,
+	hostname: config.HOST,
+	port: config.PORT
+}, () => {
+	console.info(`Kanvil is listening on ${config.HOST}:${config.PORT}`);
+});
+let stopping = false;
+async function shutdown() {
+	if (stopping) return;
+	stopping = true;
+	await application.close();
+	server.close(async () => {
+		await database.pool.end();
+	});
+}
+process.on("SIGINT", () => {
+	shutdown();
+});
+process.on("SIGTERM", () => {
+	shutdown();
+});
+//#endregion
+export {};