@getstrata/bootstrap 0.1.0

package/dist/index.js

@@ -0,0 +1,1751 @@
+// @bun
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var DEFAULT_APP_PORT = 3000;
+
+// ../../src/bootstrap/contracts.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
+  }
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
+    }
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
+    }
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
+    }
+    throw new Error(`Service "${key}" is not registered.`);
+  }
+  resolve(key) {
+    return this.get(key);
+  }
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  }
+}
+
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
+  }
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
+  }
+}
+var requiredDependencyKeys = [
+  "container",
+  "cache"
+];
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
+}
+function assertAppDependenciesComplete(dependencies) {
+  for (const key of requiredDependencyKeys) {
+    getRequiredDependency(dependencies, key);
+  }
+}
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function setActiveApplicationContext(context) {
+  activeContext = context;
+}
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return activeContext;
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var activeConnection = new AsyncLocalStorage;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var authContext = new AsyncLocalStorage2;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/accessControl.ts
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage3;
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+
+// ../../src/core/auth/membershipContextMiddleware.ts
+function createMembershipContextMiddleware() {
+  return async (_request, next) => {
+    return await runWithMembershipContext(async () => await next());
+  };
+}
+
+// ../../src/core/auth/membershipMiddleware.ts
+function createMembershipMiddleware() {
+  return createMembershipContextMiddleware();
+}
+
+// ../../src/core/http/authMiddleware.ts
+function createAuthMiddleware(auth) {
+  return async (request, next) => {
+    const user = await auth.resolve(request);
+    return await runWithAuthUser(user, async () => {
+      const response = await next();
+      if (user) {
+        const headers = new Headers(response.headers);
+        headers.set("x-authenticated-user-id", String(user.id));
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      }
+      return response;
+    });
+  };
+}
+
+// ../../src/core/http/authorizeMiddleware.ts
+function createAuthorizeMiddleware(gate, auth, resource, action) {
+  return async (request, next) => {
+    const user = await auth.resolve(request);
+    if (!gate.allows(resource, action, user)) {
+      const error = new ForbiddenError;
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/http/bodySizeLimitMiddleware.ts
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+function resolveMaxBodyBytes() {
+  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_BODY_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_BODY_BYTES;
+  }
+  return parsed;
+}
+function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
+  return async (request, next) => {
+    const contentLength = request.headers.get("content-length");
+    if (contentLength) {
+      const bytes = Number.parseInt(contentLength, 10);
+      if (Number.isInteger(bytes) && bytes > maxBytes) {
+        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+    }
+    return await next();
+  };
+}
+
+// ../../src/config/cors.ts
+var corsConfig = {
+  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+  allowedHeaders: [
+    "Authorization",
+    "Content-Type",
+    "X-Request-Id",
+    "X-Tenant-Id",
+    "X-Authenticated-User-Id",
+    "X-Authenticated-User-Role",
+    "If-Match",
+    "If-None-Match"
+  ],
+  maxAgeSeconds: 86400
+};
+
+// ../../src/core/http/corsMiddleware.ts
+function createCorsMiddleware() {
+  return async (request, next) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request)
+      });
+    }
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request)) {
+      headers.set(key, value);
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+function buildCorsHeaders(request) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const allowedOrigins = corsConfig.allowedOrigins;
+  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  headers.set("Vary", "Origin");
+  return headers;
+}
+
+// ../../src/core/http/csrfToken.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage4;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function signCsrfToken(token, issuedAt) {
+  const payload = `${token}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCsrfCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === CSRF_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseSignedCsrfValue(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [token, issuedAtRaw, cookieSignature] = parts;
+  if (!token || !issuedAtRaw || !cookieSignature) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > CSRF_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return { token, issuedAt };
+}
+function createCsrfTokenCookie() {
+  const token = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  const value = signCsrfToken(token, issuedAt);
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readCsrfCookie(request);
+  if (cookieValue) {
+    const parsed = parseSignedCsrfValue(cookieValue);
+    if (parsed) {
+      return { token: parsed.token };
+    }
+  }
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+  }
+  return null;
+}
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readCsrfCookie(request);
+  if (!cookieValue) {
+    return false;
+  }
+  const parsed = parseSignedCsrfValue(cookieValue);
+  if (!parsed) {
+    return false;
+  }
+  const submittedBuffer = Buffer.from(submittedToken);
+  const expectedBuffer = Buffer.from(parsed.token);
+  if (submittedBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(submittedBuffer, expectedBuffer);
+}
+
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function appendSetCookie(response, cookie) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", cookie);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function createCsrfMiddleware() {
+  return async (request, next) => {
+    const method = request.method.toUpperCase();
+    if (!MUTATING_METHODS.has(method)) {
+      const csrf = resolveCsrfToken(request);
+      const meta = currentRequestMeta();
+      meta.csrfToken = csrf.token;
+      const response = await next();
+      if (!csrf.cookie) {
+        return response;
+      }
+      return appendSetCookie(response, csrf.cookie);
+    }
+    const submitted = await readSubmittedCsrfTokenFromBody(request);
+    if (!verifyCsrfToken(request, submitted)) {
+      throw new ForbiddenError("Invalid or missing CSRF token.");
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/http/flashSession.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac2("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/flashMiddleware.ts
+function createFlashMiddleware() {
+  return async (request, next) => {
+    const flash = pullFlash(request);
+    const meta = currentRequestMeta();
+    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
+      const response = await next();
+      if (flash) {
+        return withFlashClear(response);
+      }
+      return response;
+    });
+  };
+}
+
+// ../../src/core/http/loginThrottleMiddleware.ts
+var {RedisClient } = globalThis.Bun;
+function resolveLoginIdentity(request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+async function resolveLoginEmail(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  try {
+    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await request.clone().formData();
+      const email = formData.get("email");
+      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
+    }
+    const payload = await request.clone().json();
+    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function createLoginThrottleMiddleware(options) {
+  const client = new RedisClient(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    if (attempts > options.maxAttempts) {
+      return Response.json({ error: "Too many login attempts. Try again later." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/http/memoryThrottleMiddleware.ts
+var buckets = new Map;
+function createMemoryThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  return async (request, next) => {
+    const path = new URL(request.url).pathname;
+    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
+    const key = `${prefix}${identity}:${path}`;
+    const now = Date.now();
+    const existing = buckets.get(key);
+    if (!existing || existing.resetAt <= now) {
+      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
+      return await next();
+    }
+    existing.count += 1;
+    if (existing.count > options.maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/metrics/prometheus.ts
+class PrometheusRegistry {
+  httpRequestsTotal = new Map;
+  httpRequestDurationMs = new Map;
+  incrementHttpRequest(labels) {
+    const key = this.metricKey(labels);
+    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
+  }
+  observeHttpDuration(labels, durationMs) {
+    const key = this.metricKey(labels);
+    const samples = this.httpRequestDurationMs.get(key) ?? [];
+    samples.push(durationMs);
+    this.httpRequestDurationMs.set(key, samples);
+  }
+  renderMetrics() {
+    const lines = [
+      "# HELP http_requests_total Total HTTP requests processed.",
+      "# TYPE http_requests_total counter"
+    ];
+    for (const [key, value] of this.httpRequestsTotal) {
+      lines.push(`http_requests_total{${key}} ${value}`);
+    }
+    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
+    for (const [key, samples] of this.httpRequestDurationMs) {
+      const sum = samples.reduce((total, sample) => total + sample, 0);
+      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    }
+    return `${lines.join(`
+`)}
+`;
+  }
+  resetForTests() {
+    this.httpRequestsTotal.clear();
+    this.httpRequestDurationMs.clear();
+  }
+  getHttpRequestSummary() {
+    const byStatus = {};
+    const pathCounts = new Map;
+    let totalRequests = 0;
+    for (const [key, count] of this.httpRequestsTotal) {
+      totalRequests += count;
+      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
+      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
+      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      byStatus[status] = (byStatus[status] ?? 0) + count;
+      const pathKey = `${method} ${path}`;
+      const existing = pathCounts.get(pathKey);
+      if (existing) {
+        existing.count += count;
+      } else {
+        pathCounts.set(pathKey, { method, path, count });
+      }
+    }
+    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
+    return {
+      totalRequests,
+      byStatus,
+      topPaths
+    };
+  }
+  metricKey(labels) {
+    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+  }
+}
+var prometheusRegistry = new PrometheusRegistry;
+
+// ../../src/core/http/metricsMiddleware.ts
+function normalizeMetricPath(pathname) {
+  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
+}
+function createMetricsMiddleware() {
+  return async (request, next) => {
+    const startedAt = performance.now();
+    const response = await next();
+    const durationMs = performance.now() - startedAt;
+    const path = normalizeMetricPath(new URL(request.url).pathname);
+    const labels = {
+      method: request.method,
+      path,
+      status: String(response.status)
+    };
+    prometheusRegistry.incrementHttpRequest(labels);
+    prometheusRegistry.observeHttpDuration(labels, durationMs);
+    return response;
+  };
+}
+
+// ../../src/core/http/middleware.ts
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+async function requestIdMiddleware(request, next) {
+  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+  const response = await next();
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/requireAbilityMiddleware.ts
+function createRequireAbilityMiddleware(tokenService) {
+  return (ability) => {
+    return async (_request, next) => {
+      const user = currentAuthUser();
+      try {
+        tokenService.requireAbility(user, ability);
+      } catch (error) {
+        if (error instanceof ForbiddenError) {
+          return Response.json({ error: error.message }, { status: error.status });
+        }
+        throw error;
+      }
+      return await next();
+    };
+  };
+}
+
+// ../../src/core/http/requireAuthMiddleware.ts
+function createRequireAuthMiddleware(auth) {
+  return async (request, next) => {
+    if (!await auth.check(request)) {
+      const error = new UnauthorizedError;
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/http/requireGlobalAdminMiddleware.ts
+function createRequireGlobalAdminMiddleware() {
+  return async (_request, next) => {
+    const user = currentAuthUser();
+    if (!isGlobalAdmin(user)) {
+      logSecurityEvent("privilege_escalation_blocked", {
+        required_role: "platform_admin",
+        path: new URL(_request.url).pathname
+      });
+      const error = new ForbiddenError("Platform admin access required.");
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
+}
+
+// ../../src/core/http/requireWebAuthMiddleware.ts
+function createRequireWebAuthMiddleware(auth) {
+  return async (request, next) => {
+    const user = await auth.resolve(request);
+    if (user) {
+      return await next();
+    }
+    if (requestPrefersJson(request)) {
+      throw new UnauthorizedError;
+    }
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+  };
+}
+
+// ../../src/core/http/routeMiddleware.ts
+function withMiddleware(...middleware) {
+  const wrap = composeMiddleware(...middleware);
+  return (handler) => {
+    return wrap(handler);
+  };
+}
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/contentSecurityPolicy.ts
+function strictApiContentSecurityPolicy() {
+  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
+}
+function serverHtmxContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' https://unpkg.com",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function spaContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function resolveContentSecurityPolicy(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
+  }
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return serverHtmxContentSecurityPolicy();
+  }
+  if (frontendMode === "spa-react") {
+    return spaContentSecurityPolicy();
+  }
+  return strictApiContentSecurityPolicy();
+}
+
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware() {
+  return async (_request, next) => {
+    const response = await next();
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-XSS-Protection", "0");
+    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
+    if (appConfig.env === "production") {
+      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+
+// ../../src/core/http/throttleMiddleware.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage5;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
+// ../../src/core/http/throttleMiddleware.ts
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function createThrottleMiddleware(options) {
+  const client = new RedisClient2(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  return async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    const path = new URL(request.url).pathname;
+    const throttleKey = `${prefix}${identity}:${path}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
+}
+
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
+}
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await connection_default`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  return await getDatabase().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await connection_default`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+
+// ../../src/core/tracing/otel.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function randomHex(bytes) {
+  return randomBytes2(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/tracing/traceContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
+var traceContextStorage = new AsyncLocalStorage6;
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const tokenService = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(tokenService);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const tokenService = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(tokenService);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    const middleware = [];
+    const loginRateLimit = resolveLoginRateLimit();
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        middleware.push(createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: loginRateLimit.maxAttempts,
+          decaySeconds: loginRateLimit.decaySeconds
+        }));
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: loginRateLimit.maxAttempts,
+          decaySeconds: loginRateLimit.decaySeconds,
+          keyPrefix: "workhub:login-throttle:"
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: loginRateLimit.maxAttempts,
+        decaySeconds: loginRateLimit.decaySeconds,
+        keyPrefix: "workhub:login-throttle:"
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+// ../../src/bootstrap/prefixRouteMap.ts
+function prefixRouteMap(prefix, routes) {
+  const normalizedPrefix = prefix.replace(/\/$/, "");
+  const prefixed = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
+  }
+  return prefixed;
+}
+// ../../src/bootstrap/web/forms.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  const fields = {};
+  const files = {};
+  if (contentType.includes("application/x-www-form-urlencoded")) {
+    const text = await request.text();
+    for (const pair of text.split("&")) {
+      const idx = pair.indexOf("=");
+      if (idx === -1)
+        continue;
+      const key = decodeURIComponent(pair.slice(0, idx).replace(/\+/g, " "));
+      const value = decodeURIComponent(pair.slice(idx + 1).replace(/\+/g, " "));
+      fields[key] = value;
+    }
+    return { fields, files };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const form = await request.formData();
+    for (const [key, value] of form.entries()) {
+      if (value instanceof File) {
+        files[key] = value;
+      } else {
+        fields[key] = String(value);
+      }
+    }
+  }
+  return { fields, files };
+}
+function createCsrfProtection(secret) {
+  const tokenCache = new Map;
+  function generate(sessionKey) {
+    const token = `${sessionKey}.${Date.now().toString(36)}.${Math.random().toString(36).slice(2)}`;
+    tokenCache.set(token, Date.now());
+    return token;
+  }
+  function verify(token, maxAgeMs = 60 * 60 * 1000) {
+    if (!token || !tokenCache.has(token))
+      return false;
+    const created = tokenCache.get(token) ?? 0;
+    if (Date.now() - created > maxAgeMs) {
+      tokenCache.delete(token);
+      return false;
+    }
+    return true;
+  }
+  return { generate, verify, secret };
+}
+// ../../src/bootstrap/web/server.ts
+function createWebServer(options) {
+  const publicDir = options.publicDir ?? "./public";
+  return Bun.serve({
+    port: options.port,
+    async fetch(request) {
+      await options.onRequest?.(request);
+      const url = new URL(request.url);
+      if (url.pathname.startsWith("/assets/")) {
+        const file = Bun.file(`${publicDir}${url.pathname}`);
+        if (await file.exists()) {
+          return new Response(file);
+        }
+      }
+      const response = await options.handle(request);
+      return response ?? new Response("Not Found", { status: 404 });
+    }
+  });
+}
+// ../../src/bootstrap/web/session.ts
+import { createHash, randomBytes as randomBytes3 } from "crypto";
+
+class CookieSessionStore {
+  sql;
+  secret;
+  cookieName;
+  maxAgeSeconds;
+  constructor(sql, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
+    this.sql = sql;
+    this.secret = secret;
+    this.cookieName = cookieName;
+    this.maxAgeSeconds = maxAgeSeconds;
+  }
+  cookieHeader(_user, sessionId) {
+    const payload = `${sessionId}.${this.sign(sessionId)}`;
+    return `${this.cookieName}=${payload}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${this.maxAgeSeconds}`;
+  }
+  clearCookieHeader() {
+    return `${this.cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  }
+  async create(user) {
+    const id = randomBytes3(32).toString("hex");
+    const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
+    await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
+      id,
+      user.id,
+      expires
+    ]);
+    return id;
+  }
+  async destroy(sessionId) {
+    await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
+  }
+  async read(request) {
+    const cookie = this.parseCookie(request.headers.get("cookie") ?? "");
+    const raw = cookie[this.cookieName];
+    if (!raw)
+      return null;
+    const [sessionId, signature] = raw.split(".");
+    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+      return null;
+    }
+    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email
+       FROM sessions s
+       INNER JOIN users u ON u.id = s.user_id
+       WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+    const row = rows[0];
+    if (!row)
+      return null;
+    return { id: row.user_id, name: row.name, email: row.email };
+  }
+  sign(value) {
+    return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
+  }
+  parseCookie(header) {
+    const out = {};
+    for (const part of header.split(";")) {
+      const idx = part.indexOf("=");
+      if (idx === -1)
+        continue;
+      out[part.slice(0, idx).trim()] = decodeURIComponent(part.slice(idx + 1).trim());
+    }
+    return out;
+  }
+}
+// ../../src/bootstrap/web/slug.ts
+function slugify(value) {
+  return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+}
+export {
+  slugify,
+  setActiveApplicationContext,
+  resolveService,
+  resolveApplicationQueue,
+  prefixRouteMap,
+  parseFormBody,
+  getRequiredDependency,
+  createWebServer,
+  createHttpKernel,
+  createCsrfProtection,
+  assertAppDependenciesComplete,
+  ServiceContainer,
+  REDIS_URL_CONFIG_KEY,
+  DEFAULT_APP_PORT,
+  DATABASE_URL_CONFIG_KEY,
+  CookieSessionStore,
+  CORE_TOKEN_SERVICE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_AUTH_TOKEN,
+  APP_PORT_CONFIG_KEY
+};