@veap/auth 0.0.0-stage → 0.1.1

package/dist/passwords/password-reset.facade.js

@@ -0,0 +1,57 @@
+"use server";
+import { app } from "@veap/kernel";
+import { authContext, isAuthContextBound } from "../common/context.js";
+import { PasswordResetService } from "./password-reset.service.js";
+async function resolvePasswordResetService() {
+    const g = globalThis;
+    if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
+        try {
+            await g.__VEAP_BOOTSTRAPPING_PROMISE__;
+        }
+        catch { }
+    }
+    if (isAuthContextBound()) {
+        return authContext().passwordReset;
+    }
+    return await app(PasswordResetService);
+}
+export async function createPasswordResetSession(token, userId, email) {
+    const service = await resolvePasswordResetService();
+    return service.createPasswordResetSession(token, userId, email);
+}
+export async function validatePasswordResetSessionToken(token) {
+    const service = await resolvePasswordResetService();
+    return service.validatePasswordResetSessionToken(token);
+}
+export async function setPasswordResetSessionAsEmailVerified(sessionId) {
+    const service = await resolvePasswordResetService();
+    return service.setPasswordResetSessionAsEmailVerified(sessionId);
+}
+export async function invalidateUserPasswordResetSessions(userId) {
+    const service = await resolvePasswordResetService();
+    return service.invalidateUserPasswordResetSessions(userId);
+}
+export async function getCurrentPasswordResetSession() {
+    const service = await resolvePasswordResetService();
+    return service.getCurrentPasswordResetSession();
+}
+export async function setPasswordResetSessionTokenCookie(token, expiresAt) {
+    const service = await resolvePasswordResetService();
+    return service.setPasswordResetSessionTokenCookie(token, expiresAt);
+}
+export async function deletePasswordResetSessionTokenCookie() {
+    const service = await resolvePasswordResetService();
+    return service.deletePasswordResetSessionTokenCookie();
+}
+export async function sendPasswordResetEmail(email, code) {
+    const service = await resolvePasswordResetService();
+    return service.sendPasswordResetEmail(email, code);
+}
+export async function createDummyPasswordResetSession(token, email) {
+    const service = await resolvePasswordResetService();
+    return service.createDummyPasswordResetSession(token, email);
+}
+export async function verifyResetCode(sessionId, code) {
+    const service = await resolvePasswordResetService();
+    return service.verifyResetCode(sessionId, code);
+}

package/dist/passwords/password-reset.repository.d.ts

@@ -0,0 +1,10 @@
+import type { PasswordResetSession as PasswordResetSessionEntity } from "../common/index.js";
+import type { CreatePasswordResetRecord, IPasswordResetRepository, PasswordResetWithUser } from "./contracts.js";
+/** `IPasswordResetRepository` adapter backed by `PasswordResetSession`. */
+export declare class ActiveRecordPasswordResetRepository implements IPasswordResetRepository {
+    create(record: CreatePasswordResetRecord): Promise<PasswordResetSessionEntity>;
+    findWithUser(id: string): Promise<PasswordResetWithUser | null>;
+    setEmailVerified(id: string): Promise<void>;
+    remove(id: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
+}

package/dist/passwords/password-reset.repository.js

@@ -0,0 +1,39 @@
+import { PasswordResetSession } from "../models/PasswordResetSession.js";
+/** `IPasswordResetRepository` adapter backed by `PasswordResetSession`. */
+export class ActiveRecordPasswordResetRepository {
+    async create(record) {
+        const session = await PasswordResetSession.create({
+            id: record.id,
+            email: record.email,
+            code: record.code,
+            expiresAt: record.expiresAt,
+            userId: record.userId,
+        });
+        return session.toJSON();
+    }
+    async findWithUser(id) {
+        const session = await PasswordResetSession.query().with("user").find(id);
+        if (!session)
+            return null;
+        const user = session.getRelation("user");
+        if (!user)
+            return null;
+        return {
+            session: session.toJSON(),
+            user: (typeof user.toJSON === "function"
+                ? user.toJSON()
+                : user),
+        };
+    }
+    async setEmailVerified(id) {
+        await PasswordResetSession.where("id", id).update({
+            emailVerified: true,
+        });
+    }
+    async remove(id) {
+        await PasswordResetSession.destroy(id);
+    }
+    async removeByUserId(userId) {
+        await PasswordResetSession.where("user_id", userId).delete();
+    }
+}

package/dist/passwords/password-reset.service.d.ts

@@ -0,0 +1,38 @@
+import { type ICacheProvider, type ICookieStore } from "@veap/kernel";
+import type { PasswordResetAuthSession, PasswordResetSession as PasswordResetSessionType } from "../common/index.js";
+import { type ITokenGenerator } from "../crypto/contracts.js";
+import { type IPasswordResetRepository } from "./contracts.js";
+export declare class PasswordResetService {
+    private readonly sessions;
+    private readonly tokens;
+    private readonly cookieStore;
+    private readonly cache?;
+    private inMemoryAttempts;
+    constructor(sessions: IPasswordResetRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, cache?: ICacheProvider | undefined);
+    createPasswordResetSession(token: string, userId: string, email: string): Promise<PasswordResetSessionType>;
+    /**
+     * Creates an ephemeral dummy reset session for an unregistered email.
+     * This prevents user enumeration while providing an identical UX.
+     */
+    createDummyPasswordResetSession(token: string, email: string): Promise<PasswordResetSessionType>;
+    validatePasswordResetSessionToken(token: string): Promise<PasswordResetAuthSession>;
+    /**
+     * Verifies the OTP code for a password reset session.
+     * Enforces a maximum of 5 failed attempts before terminating the session.
+     */
+    verifyResetCode(sessionId: string, code: string): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    setPasswordResetSessionAsEmailVerified(sessionId: string): Promise<void>;
+    invalidateUserPasswordResetSessions(userId: string): Promise<void>;
+    getCurrentPasswordResetSession(): Promise<PasswordResetAuthSession>;
+    setPasswordResetSessionTokenCookie(token: string, expiresAt: Date): Promise<void>;
+    deletePasswordResetSessionTokenCookie(): Promise<void>;
+    validatePasswordResetSession(token: string): Promise<{
+        session: PasswordResetSessionType;
+        user: any;
+    }>;
+    verifyPasswordResetSessionCode(token: string, code: string): Promise<boolean>;
+    sendPasswordResetEmail(email: string, code: string): Promise<void>;
+}

package/dist/passwords/password-reset.service.js

@@ -0,0 +1,242 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { CACHE_PROVIDER, COOKIE_STORE, Inject, Injectable, } from "@veap/kernel";
+import { sendResetPassword } from "@veap/mail";
+import { addMinutes } from "date-fns";
+import { augmentPasswordResetSession } from "../common/augment.js";
+import { performFullUserAugmentation } from "../common/logic.js";
+import { TOKEN_GENERATOR } from "../crypto/contracts.js";
+import { PASSWORD_RESET_REPOSITORY, } from "./contracts.js";
+const dummySessions = new Map();
+let PasswordResetService = class PasswordResetService {
+    sessions;
+    tokens;
+    cookieStore;
+    cache;
+    inMemoryAttempts = new Map();
+    constructor(sessions, tokens, cookieStore, cache) {
+        this.sessions = sessions;
+        this.tokens = tokens;
+        this.cookieStore = cookieStore;
+        this.cache = cache;
+    }
+    async createPasswordResetSession(token, userId, email) {
+        const sessionId = this.tokens.hashToken(token);
+        return await this.sessions.create({
+            id: sessionId,
+            email,
+            code: this.tokens.generateOtp(),
+            expiresAt: new Date(addMinutes(new Date(), 15)),
+            userId,
+        });
+    }
+    /**
+     * Creates an ephemeral dummy reset session for an unregistered email.
+     * This prevents user enumeration while providing an identical UX.
+     */
+    async createDummyPasswordResetSession(token, email) {
+        const sessionId = this.tokens.hashToken(token);
+        const expiresAt = new Date(addMinutes(new Date(), 15));
+        const session = {
+            id: sessionId,
+            email,
+            code: "------",
+            expiresAt,
+            userId: "dummy",
+        };
+        dummySessions.set(sessionId, {
+            id: sessionId,
+            email,
+            expiresAt,
+            attempts: 0,
+        });
+        return session;
+    }
+    async validatePasswordResetSessionToken(token) {
+        const sessionId = this.tokens.hashToken(token);
+        const record = await this.sessions.findWithUser(sessionId);
+        if (!record) {
+            // Check for dummy session to prevent timing and existence leakage
+            const dummy = dummySessions.get(sessionId);
+            if (dummy && new Date() <= new Date(dummy.expiresAt)) {
+                return {
+                    session: {
+                        id: dummy.id,
+                        email: dummy.email,
+                        code: "------",
+                        expiresAt: dummy.expiresAt,
+                        userId: "dummy",
+                    },
+                    user: {
+                        id: "dummy",
+                        email: dummy.email,
+                        name: "User",
+                        roles: [],
+                        permissions: [],
+                        emailVerifiedAt: null,
+                        createdAt: new Date(),
+                        updatedAt: null,
+                        recovery_code: null,
+                        image: null,
+                        password: null,
+                    },
+                };
+            }
+            return { session: null, user: null };
+        }
+        const baseSession = record.session;
+        const baseUser = record.user;
+        if (new Date() > new Date(baseSession.expiresAt)) {
+            await this.sessions.remove(sessionId);
+            return { session: null, user: null };
+        }
+        const { password, recovery_code, ...safeUser } = baseUser;
+        const user = await performFullUserAugmentation(safeUser);
+        const session = await augmentPasswordResetSession(baseSession);
+        return { session, user };
+    }
+    /**
+     * Verifies the OTP code for a password reset session.
+     * Enforces a maximum of 5 failed attempts before terminating the session.
+     */
+    async verifyResetCode(sessionId, code) {
+        // Handle dummy session
+        const dummy = dummySessions.get(sessionId);
+        if (dummy) {
+            dummy.attempts += 1;
+            if (dummy.attempts >= 5 || new Date() > new Date(dummy.expiresAt)) {
+                dummySessions.delete(sessionId);
+                await this.deletePasswordResetSessionTokenCookie();
+                return {
+                    valid: false,
+                    error: "Too many failed attempts. Password reset request has been cancelled.",
+                };
+            }
+            return { valid: false, error: "Incorrect code" };
+        }
+        const record = await this.sessions.findWithUser(sessionId);
+        if (!record) {
+            return { valid: false, error: "Invalid or expired session" };
+        }
+        if (new Date() > new Date(record.session.expiresAt)) {
+            await this.sessions.remove(sessionId);
+            await this.deletePasswordResetSessionTokenCookie();
+            return { valid: false, error: "Password reset code has expired" };
+        }
+        // Check attempts limit
+        const attemptKey = `pw_reset_attempts:${sessionId}`;
+        let attempts = 0;
+        if (this.cache) {
+            attempts = ((await this.cache.get(attemptKey)) || 0) + 1;
+            await this.cache.set(attemptKey, attempts, 15 * 60);
+        }
+        else {
+            const rec = this.inMemoryAttempts.get(sessionId);
+            attempts = (rec && Date.now() <= rec.expiresAt ? rec.count : 0) + 1;
+            this.inMemoryAttempts.set(sessionId, {
+                count: attempts,
+                expiresAt: Date.now() + 15 * 60 * 1000,
+            });
+        }
+        if (attempts >= 5) {
+            await this.sessions.remove(sessionId);
+            await this.deletePasswordResetSessionTokenCookie();
+            if (this.cache)
+                await this.cache.delete(attemptKey);
+            this.inMemoryAttempts.delete(sessionId);
+            return {
+                valid: false,
+                error: "Too many failed attempts. Password reset request has been cancelled.",
+            };
+        }
+        if (record.session.code !== code) {
+            return { valid: false, error: "Incorrect code" };
+        }
+        if (this.cache)
+            await this.cache.delete(attemptKey);
+        this.inMemoryAttempts.delete(sessionId);
+        await this.sessions.setEmailVerified(sessionId);
+        return { valid: true };
+    }
+    async setPasswordResetSessionAsEmailVerified(sessionId) {
+        await this.sessions.setEmailVerified(sessionId);
+    }
+    async invalidateUserPasswordResetSessions(userId) {
+        await this.sessions.removeByUserId(userId);
+    }
+    async getCurrentPasswordResetSession() {
+        const token = await this.cookieStore.get("password_reset_session");
+        if (token === null) {
+            return { session: null, user: null };
+        }
+        const result = await this.validatePasswordResetSessionToken(token);
+        if (result.session === null) {
+            await this.deletePasswordResetSessionTokenCookie();
+        }
+        return result;
+    }
+    async setPasswordResetSessionTokenCookie(token, expiresAt) {
+        await this.cookieStore.set("password_reset_session", token, {
+            expires: expiresAt,
+            sameSite: "lax",
+            httpOnly: true,
+            path: "/",
+            secure: process.env.NODE_ENV === "production",
+        });
+    }
+    async deletePasswordResetSessionTokenCookie() {
+        await this.cookieStore.delete("password_reset_session");
+    }
+    async validatePasswordResetSession(token) {
+        const sessionId = this.tokens.hashToken(token);
+        const record = await this.sessions.findWithUser(sessionId);
+        if (!record) {
+            throw new Error("Invalid or expired password reset session");
+        }
+        if (new Date() > new Date(record.session.expiresAt)) {
+            await this.sessions.remove(sessionId);
+            throw new Error("Invalid or expired password reset session");
+        }
+        if (!record.session.emailVerified) {
+            throw new Error("Invalid or expired password reset session");
+        }
+        return { session: record.session, user: record.user };
+    }
+    async verifyPasswordResetSessionCode(token, code) {
+        const sessionId = this.tokens.hashToken(token);
+        const record = await this.sessions.findWithUser(sessionId);
+        if (!record)
+            return false;
+        if (new Date() > new Date(record.session.expiresAt)) {
+            await this.sessions.remove(sessionId);
+            return false;
+        }
+        if (record.session.code !== code) {
+            return false;
+        }
+        await this.sessions.setEmailVerified(sessionId);
+        return true;
+    }
+    async sendPasswordResetEmail(email, code) {
+        await sendResetPassword(email, code);
+    }
+};
+PasswordResetService = __decorate([
+    Injectable(),
+    __param(0, Inject(PASSWORD_RESET_REPOSITORY)),
+    __param(1, Inject(TOKEN_GENERATOR)),
+    __param(2, Inject(COOKIE_STORE)),
+    __param(3, Inject(CACHE_PROVIDER)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object])
+], PasswordResetService);
+export { PasswordResetService };

package/dist/providers/auth.provider.d.ts

@@ -0,0 +1,9 @@
+import { Container, ServiceProvider } from "@veap/kernel";
+import { type AuthConfig } from "../common/routes.js";
+export declare class AuthServiceProvider extends ServiceProvider {
+    private config?;
+    constructor(container?: Container, config?: AuthConfig);
+    private resolveRoutes;
+    register(): void;
+    boot(): Promise<void>;
+}

package/dist/providers/auth.provider.js

@@ -0,0 +1,199 @@
+import { isDatabaseInitialized } from "@veap/database";
+import { ConfigService, Container, container as defaultContainer, logger, ServiceProvider, } from "@veap/kernel";
+import { bindAuthContext } from "../common/context.js";
+import { AUTH_ROUTES, DEFAULT_AUTH_ROUTES, ROUTER_SERVICE, } from "../common/routes.js";
+import { AesSecretCipher } from "../crypto/aes-cipher.js";
+import { BcryptPasswordHasher } from "../crypto/bcrypt-hasher.js";
+import { PASSWORD_HASHER, SECRET_CIPHER, TOKEN_GENERATOR, } from "../crypto/contracts.js";
+import { OsloTokenGenerator } from "../crypto/token-generator.js";
+import { runAuthMigrations } from "../migrations/index.js";
+import { PASSWORD_RESET_REPOSITORY } from "../passwords/contracts.js";
+import { ActiveRecordPasswordResetRepository } from "../passwords/password-reset.repository.js";
+import { PasswordResetService } from "../passwords/password-reset.service.js";
+import { PERMISSION_REPOSITORY, ROLE_REPOSITORY } from "../rbac/contracts.js";
+import { ActiveRecordPermissionRepository, ActiveRecordRoleRepository, } from "../rbac/rbac.repository.js";
+import { RbacService } from "../rbac/rbac.service.js";
+import { AuthService } from "../session/auth.service.js";
+import { SESSION_REPOSITORY } from "../session/contracts.js";
+import { ActiveRecordSessionRepository } from "../session/session.repository.js";
+import { SessionService } from "../session/session.service.js";
+import { USER_REPOSITORY } from "../users/contracts.js";
+import { ActiveRecordUserRepository } from "../users/user.repository.js";
+import { UserService } from "../users/user.service.js";
+import { EMAIL_VERIFICATION_REPOSITORY } from "../verification/contracts.js";
+import { ActiveRecordEmailVerificationRepository } from "../verification/verification.repository.js";
+import { EmailVerificationService } from "../verification/verification.service.js";
+import { isSystemInstalled } from "./setup.js";
+export class AuthServiceProvider extends ServiceProvider {
+    config;
+    constructor(container, config) {
+        super(container ?? defaultContainer);
+        this.config = config;
+    }
+    resolveRoutes() {
+        return {
+            ...DEFAULT_AUTH_ROUTES,
+            ...this.config?.routes,
+        };
+    }
+    register() {
+        const routes = this.resolveRoutes();
+        this.container.register({
+            token: AUTH_ROUTES,
+            useValue: routes,
+        });
+        // Cryptographic ports -> concrete adapters
+        this.container.register({
+            token: PASSWORD_HASHER,
+            useFactory: async (c) => {
+                let config;
+                try {
+                    if (c && typeof c.resolve === "function" && c.has(ConfigService)) {
+                        config = await c.resolve(ConfigService);
+                    }
+                }
+                catch { }
+                const roundsRaw = config?.get("AUTH_BCRYPT_ROUNDS");
+                const minLengthRaw = config?.get("AUTH_PASSWORD_MIN_LENGTH");
+                const rounds = roundsRaw ? parseInt(roundsRaw, 10) : undefined;
+                const minLength = minLengthRaw ? parseInt(minLengthRaw, 10) : undefined;
+                return new BcryptPasswordHasher(rounds, minLength);
+            },
+            inject: [Container],
+            singleton: true,
+        });
+        this.container.register({
+            token: TOKEN_GENERATOR,
+            useClass: OsloTokenGenerator,
+            singleton: true,
+        });
+        this.container.register({
+            token: SECRET_CIPHER,
+            useClass: AesSecretCipher,
+            singleton: true,
+        });
+        // Repositories
+        this.container.register({
+            token: USER_REPOSITORY,
+            useClass: ActiveRecordUserRepository,
+            singleton: true,
+        });
+        this.container.register({
+            token: SESSION_REPOSITORY,
+            useClass: ActiveRecordSessionRepository,
+            singleton: true,
+        });
+        this.container.register({
+            token: ROLE_REPOSITORY,
+            useClass: ActiveRecordRoleRepository,
+            singleton: true,
+        });
+        this.container.register({
+            token: PERMISSION_REPOSITORY,
+            useClass: ActiveRecordPermissionRepository,
+            singleton: true,
+        });
+        this.container.register({
+            token: PASSWORD_RESET_REPOSITORY,
+            useClass: ActiveRecordPasswordResetRepository,
+            singleton: true,
+        });
+        this.container.register({
+            token: EMAIL_VERIFICATION_REPOSITORY,
+            useClass: ActiveRecordEmailVerificationRepository,
+            singleton: true,
+        });
+        // Services
+        this.container.register({
+            token: UserService,
+            useClass: UserService,
+            singleton: true,
+        });
+        this.container.register({
+            token: SessionService,
+            useClass: SessionService,
+            singleton: true,
+        });
+        this.container.register({
+            token: RbacService,
+            useClass: RbacService,
+            singleton: true,
+        });
+        this.container.register({
+            token: PasswordResetService,
+            useClass: PasswordResetService,
+            singleton: true,
+        });
+        this.container.register({
+            token: EmailVerificationService,
+            useClass: EmailVerificationService,
+            singleton: true,
+        });
+        this.container.register({
+            token: AuthService,
+            useClass: AuthService,
+            singleton: true,
+        });
+    }
+    async boot() {
+        // 0. Auto-bootstrap setup state
+        try {
+            isSystemInstalled();
+        }
+        catch { }
+        // 1. Resolve domain services and bind singleton auth context
+        const user = await this.container.resolve(UserService);
+        const session = await this.container.resolve(SessionService);
+        const rbac = await this.container.resolve(RbacService);
+        const passwordReset = await this.container.resolve(PasswordResetService);
+        const emailVerification = await this.container.resolve(EmailVerificationService);
+        const auth = await this.container.resolve(AuthService);
+        bindAuthContext({
+            user,
+            session,
+            rbac,
+            passwordReset,
+            emailVerification,
+            auth,
+            routes: this.resolveRoutes(),
+        });
+        // 2. Register route rewrites if RouterService is available
+        if (this.container.has(ROUTER_SERVICE)) {
+            const router = await this.container.resolve(ROUTER_SERVICE);
+            const routes = this.resolveRoutes();
+            const addRewrite = (from, to) => {
+                if (typeof router.addRewrite === "function") {
+                    router.addRewrite(from, to);
+                }
+                else if (typeof router.registerRewrite === "function") {
+                    router.registerRewrite(from, to);
+                }
+            };
+            if (routes.signIn !== DEFAULT_AUTH_ROUTES.signIn) {
+                addRewrite(routes.signIn, DEFAULT_AUTH_ROUTES.signIn);
+            }
+            if (routes.signUp !== DEFAULT_AUTH_ROUTES.signUp) {
+                addRewrite(routes.signUp, DEFAULT_AUTH_ROUTES.signUp);
+            }
+            if (routes.forgotPassword !== DEFAULT_AUTH_ROUTES.forgotPassword) {
+                addRewrite(routes.forgotPassword, DEFAULT_AUTH_ROUTES.forgotPassword);
+            }
+            if (routes.resetPassword !== DEFAULT_AUTH_ROUTES.resetPassword) {
+                addRewrite(routes.resetPassword, DEFAULT_AUTH_ROUTES.resetPassword);
+            }
+            if (routes.verifyEmail !== DEFAULT_AUTH_ROUTES.verifyEmail) {
+                addRewrite(routes.verifyEmail, DEFAULT_AUTH_ROUTES.verifyEmail);
+            }
+        }
+        // 3. Database migrations (when enabled and database is connected)
+        const shouldMigrate = this.config?.autoMigrate ?? true;
+        if (shouldMigrate && isDatabaseInitialized()) {
+            try {
+                await runAuthMigrations();
+            }
+            catch (error) {
+                logger.error("veap:auth", "Failed to run auth database migrations during boot:", error.message);
+            }
+        }
+    }
+}

package/dist/providers/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./auth.provider.js";
+export * from "./setup.js";

package/dist/providers/index.js

@@ -0,0 +1,2 @@
+export * from "./auth.provider.js";
+export * from "./setup.js";

package/dist/providers/setup.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Checks if the system is installed.
+ * A system is considered installed if at least one user exists in the database.
+ * This function also has a side-effect: it publishes the 'system:not-installed' event
+ * if it detects the system is not installed.
+ */
+export declare function isSystemInstalled(): Promise<boolean>;

package/dist/providers/setup.js

@@ -0,0 +1,29 @@
+import { eventBus, logger } from "@veap/kernel";
+import { User } from "../models/User.js";
+/**
+ * Checks if the system is installed.
+ * A system is considered installed if at least one user exists in the database.
+ * This function also has a side-effect: it publishes the 'system:not-installed' event
+ * if it detects the system is not installed.
+ */
+export async function isSystemInstalled() {
+    try {
+        const count = await User.query().count();
+        if (count === 0) {
+            logger.debug("veap:setup", "System not installed. Publishing event.");
+            await eventBus.publish("system:not-installed", { timestamp: Date.now() });
+        }
+        return count > 0;
+    }
+    catch (error) {
+        if (error?.digest?.startsWith("NEXT_REDIRECT")) {
+            // Re-throw redirect errors to let Next.js handle them
+            throw error;
+        }
+        // This typically happens on the very first run when the users table doesn't exist yet.
+        logger.debug("veap:setup", "isSystemInstalled check failed (most likely table does not exist)", error.message);
+        // If an error occurs (e.g., table not found), assume not installed and publish the event.
+        await eventBus.publish("system:not-installed", { timestamp: Date.now() });
+        return false;
+    }
+}