@getstrata/bootstrap 0.1.1 → 0.2.0

package/dist/index.js

@@ -1,4 +1,407 @@
 // @bun
+// ../../src/core/scheduler/schedule.ts
+class Schedule {
+  tasks = [];
+  command(expression, name, run) {
+    this.tasks.push({ expression, name, run });
+    return this;
+  }
+  dueTasks(now = new Date) {
+    const minute = now.getMinutes();
+    return this.tasks.filter((task) => {
+      if (task.expression === "* * * * *") {
+        return true;
+      }
+      if (task.expression.startsWith("*/")) {
+        const interval = Number.parseInt(task.expression.slice(2), 10);
+        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
+      }
+      return false;
+    });
+  }
+  tasksList() {
+    return [...this.tasks];
+  }
+}
+var appSchedule = new Schedule;
+async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
+  const due = schedule.dueTasks(now);
+  for (const task of due) {
+    await task.run();
+  }
+  return due.length;
+}
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var activeConnection = new AsyncLocalStorage;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = input;
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = new URL(location, currentUrl).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+// ../../src/core/security/safeUrl.ts
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/audit/siemFormatter.ts
+function formatSiemAuditEvent(input) {
+  return {
+    timestamp: input.created_at.toISOString(),
+    event_type: "workhub.audit",
+    actor_user_id: input.user_id,
+    tenant_id: input.tenant_id ?? null,
+    trace_id: input.trace_id ?? null,
+    action: input.action,
+    subject_type: input.subject_type,
+    subject_id: input.subject_id,
+    ip_address: input.ip_address ?? null,
+    user_agent: input.user_agent ?? null,
+    checksum: input.checksum ?? null,
+    payload: input.payload ?? {}
+  };
+}
+function formatCefLine(event) {
+  const extension = [
+    `rt=${event.timestamp}`,
+    `suid=${event.actor_user_id ?? "unknown"}`,
+    `cs1=${event.action}`,
+    `cs1Label=Action`,
+    `cs2=${event.subject_type}`,
+    `cs2Label=SubjectType`,
+    `cs3=${event.subject_id ?? ""}`,
+    `cs3Label=SubjectId`,
+    `src=${event.ip_address ?? ""}`,
+    `request=${event.trace_id ?? ""}`
+  ].join(" ");
+  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+}
+
+// ../../src/core/audit/exportAuditLogs.ts
+function resolveAuditExportConfig() {
+  const endpoint = process.env.SIEM_EXPORT_URL?.trim();
+  if (!endpoint) {
+    return null;
+  }
+  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
+  return {
+    endpoint,
+    format: process.env.SIEM_EXPORT_FORMAT === "cef" ? "cef" : "json",
+    batchSize: Number.isFinite(batchSize) ? batchSize : 100
+  };
+}
+async function exportPendingAuditLogs() {
+  const config = resolveAuditExportConfig();
+  if (!config) {
+    return 0;
+  }
+  return await runWithMigrationBypass(async () => {
+    const rows = await connection_default`
+      SELECT
+        id,
+        user_id,
+        action,
+        subject_type,
+        subject_id,
+        payload,
+        ip_address,
+        user_agent,
+        checksum,
+        tenant_id,
+        trace_id,
+        created_at
+      FROM audit_log
+      WHERE exported_at IS NULL
+      ORDER BY id
+      LIMIT ${config.batchSize}
+    `;
+    if (rows.length === 0) {
+      return 0;
+    }
+    const events = rows.map((row) => formatSiemAuditEvent({
+      action: row.action,
+      subject_type: row.subject_type,
+      subject_id: row.subject_id,
+      user_id: row.user_id,
+      tenant_id: row.tenant_id,
+      trace_id: row.trace_id,
+      ip_address: row.ip_address,
+      user_agent: row.user_agent,
+      checksum: row.checksum,
+      payload: row.payload,
+      created_at: row.created_at
+    }));
+    const body = config.format === "cef" ? events.map((event) => formatCefLine(event)).join(`
+`) : JSON.stringify({ events });
+    const response = await safeFetch(config.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": config.format === "cef" ? "text/plain" : "application/json",
+        ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
+      },
+      body
+    });
+    if (!response.ok) {
+      throw new Error(`SIEM export failed with status ${response.status}.`);
+    }
+    const ids = rows.map((row) => row.id);
+    for (const id of ids) {
+      await connection_default`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+    }
+    return rows.length;
+  });
+}
+
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -35,8 +438,41 @@ class Logger {
 }
 var appLogger = new Logger("app");
 
+// ../../src/bootstrap/schedule.ts
+appSchedule.command("* * * * *", "heartbeat", () => {
+  appLogger.debug("Scheduler heartbeat");
+});
+appSchedule.command("* * * * *", "audit-export", async () => {
+  if (!isFeatureEnabled("siemExport")) {
+    return;
+  }
+  try {
+    const exported = await exportPendingAuditLogs();
+    if (exported > 0) {
+      appLogger.info(`Exported ${exported} audit log entries to SIEM.`);
+    }
+  } catch (error) {
+    appLogger.error("Audit export failed.", { error: String(error) });
+  }
+});
+
+// ../../src/cli/commands/scheduleRun.ts
+async function scheduleRunCommand() {
+  const due = appSchedule.dueTasks();
+  if (due.length === 0) {
+    console.log("No scheduled tasks due.");
+    return;
+  }
+  for (const task of due) {
+    console.log(`Running scheduled task: ${task.name}`);
+  }
+  await runDueScheduledTasks(appSchedule);
+}
 // ../../src/bootstrap/config.ts
 var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 var DATABASE_URL_CONFIG_KEY = "database.url";
 var CORE_CONFIG_TOKEN = "core.config";
@@ -46,6 +482,11 @@ var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
 
 // ../../src/bootstrap/contracts.ts
 class ServiceContainer {
@@ -142,22 +583,3589 @@ function requireActiveApplicationContext() {
   }
   return activeContext;
 }
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+async function loadDiscoveredModules() {
+  const modulesDirectory = join(import.meta.dir, "../modules");
+  const moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+var appModules = await loadDiscoveredModules();
+// ../../src/config/auth.ts
+var authConfig = {
+  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
+  tokenDefaultAbilities: ["*"]
+};
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/modules/user/provider.ts
+import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
+import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
+import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+
+// ../../src/modules/user/apiTokenRepository.ts
+import { BaseRepository } from "@getstrata/core/database";
+
+// ../../src/modules/user/apiTokenTable.ts
+import { defineTable } from "@getstrata/core/database";
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/authService.ts
+import { verifyPassword } from "@getstrata/core/auth/password";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { UnauthorizedError as UnauthorizedError2 } from "@getstrata/core/errors/http";
+import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
+import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
+import { verifyTotp } from "@getstrata/core/security/totp";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError2("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError2("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError2("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError2("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError2("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError2("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationRepository.ts
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
+
+// ../../src/modules/user/notificationTable.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database";
+var notificationTable = defineTable2({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/notificationService.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+import { BaseRepository as BaseRepository3, defineTable as defineTable3 } from "@getstrata/core/database";
+var oauthIdentityTable = defineTable3({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository4 } from "@getstrata/core/database";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable4 } from "@getstrata/core/database";
+var userTable = defineTable4({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/tokenService.ts
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { ForbiddenError as ForbiddenError2, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var authContext = new AsyncLocalStorage2;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/auth/guard.ts
+function devHeaderAbilities(role) {
+  if (role === "admin") {
+    return [...ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+class GuestGuard {
+  resolve(request) {
+    const userId = request.headers.get("x-authenticated-user-id");
+    if (!userId) {
+      return null;
+    }
+    const role = request.headers.get("x-authenticated-user-role");
+    return {
+      id: userId,
+      abilities: devHeaderAbilities(role),
+      ...role ? { role } : {}
+    };
+  }
+}
+class DatabaseTokenGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return null;
+    }
+    const token = authorization.slice("Bearer ".length).trim();
+    if (!token) {
+      return null;
+    }
+    if (!this.container.has(tokenServiceToken)) {
+      return null;
+    }
+    const tokenService = this.container.resolve(tokenServiceToken);
+    return await tokenService.resolveUserFromToken(token);
+  }
+}
+
+class CompositeGuard {
+  guards;
+  constructor(guards) {
+    this.guards = guards;
+  }
+  async resolve(request) {
+    for (const guard of this.guards) {
+      const user = await Promise.resolve(guard.resolve(request));
+      if (user) {
+        return user;
+      }
+    }
+    return null;
+  }
+}
+
+class AuthManager {
+  guard;
+  constructor(guard) {
+    this.guard = guard;
+  }
+  async resolve(request) {
+    if (request) {
+      return await Promise.resolve(this.guard.resolve(request));
+    }
+    return currentAuthUser();
+  }
+  user(request) {
+    return this.resolve(request);
+  }
+  async check(request) {
+    return await this.user(request) !== null;
+  }
+  async requireUser(request) {
+    const user = await this.user(request);
+    if (!user) {
+      throw new UnauthorizedError;
+    }
+    return user;
+  }
+}
+
+// ../../src/core/auth/sessionCookie.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SESSION_COOKIE = "workhub_session";
+var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+function resolveSessionSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
+}
+function signSession(userId, issuedAt) {
+  const payload = `${userId}.${issuedAt}`;
+  const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCookieValue(request, cookieName) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === cookieName) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function readSessionUserId(request) {
+  const cookieValue = readCookieValue(request, SESSION_COOKIE);
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  const userId = Number.parseInt(String(userIdRaw), 10);
+  const issuedAt = Number.parseInt(String(issuedAtRaw), 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > SESSION_TTL_SECONDS * 1000) {
+    return null;
+  }
+  const expectedSignature = signSession(userId, issuedAt).split(".").pop();
+  if (!expectedSignature || !cookieSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return userId;
+}
+
+// ../../src/core/auth/sessionGuard.ts
+class SessionGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const userId = readSessionUserId(request);
+    if (!userId) {
+      return null;
+    }
+    if (!this.container.has(tokenServiceToken)) {
+      return null;
+    }
+    const tokenService = this.container.resolve(tokenServiceToken);
+    try {
+      const user = await tokenService.findByIdOrThrow(userId);
+      return {
+        id: user.id,
+        role: user.role,
+        abilities: resolveAbilitiesForRole(user.role)
+      };
+    } catch {
+      return null;
+    }
+  }
+}
+
+// ../../src/bootstrap/providers/auth.ts
+var authProvider = {
+  name: "core.auth",
+  register({ container, config }) {
+    config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
+    const guards = [new DatabaseTokenGuard(container), new SessionGuard(container)];
+    if (authConfig.allowDevHeaders) {
+      guards.push(new GuestGuard);
+    }
+    container.set(CORE_AUTH_TOKEN, new AuthManager(new CompositeGuard(guards)));
+  }
+};
+var auth_default = authProvider;
+
+// ../../src/core/cache/redisCacheStore.ts
+var {RedisClient } = globalThis.Bun;
+var KEY_PREFIX = "workhub:cache:";
+var TAG_PREFIX = "workhub:cache:tag:";
+
+class RedisCacheStore {
+  ttlMs;
+  maxEntries;
+  client;
+  inflight = new Map;
+  keyTags = new Map;
+  constructor(redisUrl, ttlMs, maxEntries) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    this.client = new RedisClient(redisUrl);
+  }
+  async get(key) {
+    const raw = await this.client.get(this.storageKey(key));
+    if (raw === null) {
+      return;
+    }
+    return JSON.parse(raw);
+  }
+  async set(key, value, ttlMs) {
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    const payload = JSON.stringify(value);
+    if (resolvedTtlMs > 0) {
+      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
+    } else {
+      await this.client.set(this.storageKey(key), payload);
+    }
+    await this.enforceMaxEntries();
+  }
+  async getOrSet(key, loader, ttlMs) {
+    const cached = await this.get(key);
+    if (cached !== undefined) {
+      return cached;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then(async (value) => {
+      await this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
+  }
+  async attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      await this.client.sadd(this.tagKey(tag), key);
+    }
+  }
+  async flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const members = await this.client.smembers(this.tagKey(tag));
+      for (const member of members) {
+        keysToRemove.add(member);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (await this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      await this.client.del(this.tagKey(tag));
+    }
+    return removed;
+  }
+  async invalidate(key) {
+    const deleted = await this.client.del(this.storageKey(key));
+    await this.detachKeyFromTags(key);
+    return deleted > 0;
+  }
+  async invalidateByPrefix(prefix) {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    let removed = 0;
+    for (const storageKey of keys) {
+      const key = storageKey.slice(KEY_PREFIX.length);
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (await this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
+  }
+  async clear() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length > 0) {
+      await this.client.del(...keys);
+    }
+    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
+    if (tagKeys.length > 0) {
+      await this.client.del(...tagKeys);
+    }
+    this.inflight.clear();
+    this.keyTags.clear();
+  }
+  async size() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    return keys.length;
+  }
+  storageKey(key) {
+    return `${KEY_PREFIX}${key}`;
+  }
+  tagKey(tag) {
+    return `${TAG_PREFIX}${tag}`;
+  }
+  async detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
+    }
+    for (const tag of tags) {
+      await this.client.srem(this.tagKey(tag), key);
+    }
+    this.keyTags.delete(key);
+  }
+  async enforceMaxEntries() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length <= this.maxEntries) {
+      return;
+    }
+    const overflow = keys.length - this.maxEntries;
+    const keysToRemove = keys.slice(0, overflow);
+    if (keysToRemove.length > 0) {
+      await this.client.del(...keysToRemove);
+    }
+  }
+}
+var redisCacheStore_default = RedisCacheStore;
+
+// ../../src/core/cache/simpleCache.ts
+class SimpleCache {
+  ttlMs;
+  maxEntries;
+  cache = new Map;
+  inflight = new Map;
+  tagIndex = new Map;
+  keyTags = new Map;
+  constructor(ttlMs = 3600000, maxEntries = 100) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
+      throw new RangeError("ttlMs must be a non-negative number.");
+    }
+    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
+      throw new RangeError("maxEntries must be a positive integer.");
+    }
+  }
+  get(key) {
+    return this.getFreshEntry(key)?.value;
+  }
+  set(key, value, ttlMs) {
+    const now = Date.now();
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    this.cache.set(key, {
+      value,
+      expiresAt: now + resolvedTtlMs,
+      lastAccessedAt: now
+    });
+    this.evictOverflow();
+  }
+  async getOrSet(key, loader, ttlMs) {
+    this.pruneExpired();
+    const cachedEntry = this.getFreshEntry(key);
+    if (cachedEntry) {
+      return cachedEntry.value;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then((value) => {
+      this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
+  }
+  attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      let keysForTag = this.tagIndex.get(tag);
+      if (!keysForTag) {
+        keysForTag = new Set;
+        this.tagIndex.set(tag, keysForTag);
+      }
+      keysForTag.add(key);
+    }
+  }
+  flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      for (const key of keys) {
+        keysToRemove.add(key);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      this.tagIndex.delete(tag);
+    }
+    return removed;
+  }
+  invalidate(key) {
+    const removed = this.cache.delete(key);
+    if (removed) {
+      this.detachKeyFromTags(key);
+    }
+    return removed;
+  }
+  invalidateByPrefix(prefix) {
+    let removed = 0;
+    for (const key of [...this.cache.keys()]) {
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
+  }
+  clear() {
+    this.cache.clear();
+    this.inflight.clear();
+    this.tagIndex.clear();
+    this.keyTags.clear();
+  }
+  size() {
+    this.pruneExpired();
+    return this.cache.size;
+  }
+  detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
+    }
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      keys.delete(key);
+      if (keys.size === 0) {
+        this.tagIndex.delete(tag);
+      }
+    }
+    this.keyTags.delete(key);
+  }
+  getFreshEntry(key) {
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return;
+    }
+    if (entry.expiresAt <= Date.now()) {
+      this.invalidate(key);
+      return;
+    }
+    entry.lastAccessedAt = Date.now();
+    return entry;
+  }
+  pruneExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache.entries()) {
+      if (entry.expiresAt <= now) {
+        this.invalidate(key);
+      }
+    }
+  }
+  evictOverflow() {
+    while (this.cache.size > this.maxEntries) {
+      let oldestKey;
+      let oldestAccessTime = Number.POSITIVE_INFINITY;
+      for (const [key, entry] of this.cache.entries()) {
+        if (entry.lastAccessedAt < oldestAccessTime) {
+          oldestAccessTime = entry.lastAccessedAt;
+          oldestKey = key;
+        }
+      }
+      if (!oldestKey) {
+        return;
+      }
+      this.invalidate(oldestKey);
+    }
+  }
+}
+var simpleCache_default = SimpleCache;
+
+// ../../src/core/cache/simpleCacheStore.ts
+class SimpleCacheStore {
+  cache;
+  constructor(cache) {
+    this.cache = cache;
+  }
+  get(key) {
+    return Promise.resolve(this.cache.get(key));
+  }
+  set(key, value, ttlMs) {
+    this.cache.set(key, value, ttlMs);
+    return Promise.resolve();
+  }
+  getOrSet(key, loader, ttlMs) {
+    return this.cache.getOrSet(key, loader, ttlMs);
+  }
+  attachTags(key, tags) {
+    this.cache.attachTags(key, tags);
+    return Promise.resolve();
+  }
+  flushTags(tags) {
+    return Promise.resolve(this.cache.flushTags(tags));
+  }
+  invalidate(key) {
+    return Promise.resolve(this.cache.invalidate(key));
+  }
+  invalidateByPrefix(prefix) {
+    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
+  }
+  clear() {
+    this.cache.clear();
+    return Promise.resolve();
+  }
+  size() {
+    return Promise.resolve(this.cache.size());
+  }
+}
+var simpleCacheStore_default = SimpleCacheStore;
+
+// ../../src/core/cache/createCacheStore.ts
+function createCacheStore(options) {
+  if (options.driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
+  }
+  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
+}
+
+// ../../src/core/cache/taggedCache.ts
+class TaggedCache {
+  store;
+  tags;
+  constructor(store, tags) {
+    this.store = store;
+    this.tags = tags;
+  }
+  async remember(key, callback, ttlMs) {
+    const value = await this.store.getOrSet(key, callback, ttlMs);
+    await this.store.attachTags(key, this.tags);
+    return value;
+  }
+  async flush() {
+    return this.store.flushTags(this.tags);
+  }
+}
+var taggedCache_default = TaggedCache;
+
+// ../../src/core/cache/repository.ts
+class CacheRepository {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  async get(key) {
+    return this.store.get(key);
+  }
+  async remember(key, callback, ttlMs) {
+    return this.store.getOrSet(key, callback, ttlMs);
+  }
+  async forget(key) {
+    return this.store.invalidate(key);
+  }
+  async flush() {
+    await this.store.clear();
+  }
+  tags(...names) {
+    return new taggedCache_default(this.store, names);
+  }
+  async getOrSet(key, loader, ttlMs) {
+    return this.remember(key, loader, ttlMs);
+  }
+  async invalidate(key) {
+    return this.forget(key);
+  }
+  async invalidateByPrefix(prefix) {
+    return this.store.invalidateByPrefix(prefix);
+  }
+  async clear() {
+    await this.flush();
+  }
+  async size() {
+    return this.store.size();
+  }
+}
+var repository_default2 = CacheRepository;
+
+// ../../src/bootstrap/providers/cache.ts
+var cacheProvider = {
+  name: "core.cache",
+  register({ container, config, dependencies }) {
+    container.singleton(CORE_CACHE_TOKEN, () => {
+      const store = createCacheStore({
+        driver: config.require(CACHE_DRIVER_CONFIG_KEY),
+        ttlMs: config.require(CACHE_TTL_MS_CONFIG_KEY),
+        maxEntries: config.require(CACHE_MAX_ENTRIES_CONFIG_KEY),
+        redisUrl: config.get(REDIS_URL_CONFIG_KEY) || undefined
+      });
+      return new repository_default2(store);
+    });
+    dependencies.cache = container.resolve(CORE_CACHE_TOKEN);
+  }
+};
+var cache_default = cacheProvider;
+
+// ../../src/config/queue.ts
+var queueConfig = {
+  driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
+  maxAttempts: Number(process.env.QUEUE_MAX_ATTEMPTS ?? "3"),
+  backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
+};
+
+// ../../src/core/config/envSchema.ts
+function defineEnvSchema(schema) {
+  return schema;
+}
+function validateEnv(schema, env = process.env) {
+  const resolved = {};
+  for (const [name, rule] of Object.entries(schema)) {
+    const rawValue = env[name];
+    const value = rawValue === undefined || rawValue.trim() === "" ? rule.default : rawValue;
+    if (value === undefined || value.trim() === "") {
+      if (rule.required) {
+        throw new Error(`Missing required environment variable "${name}".`);
+      }
+      continue;
+    }
+    if (rule.integer) {
+      const parsed = Number.parseInt(value, 10);
+      const minimum = rule.minimum ?? Number.NEGATIVE_INFINITY;
+      if (!Number.isInteger(parsed) || parsed < minimum) {
+        const comparison = minimum === Number.NEGATIVE_INFINITY ? "an integer" : `an integer >= ${minimum}`;
+        throw new Error(`Environment variable "${name}" must be ${comparison}.`);
+      }
+    }
+    if (rule.pattern && !rule.pattern.test(value)) {
+      throw new Error(`Environment variable "${name}" has an invalid format.`);
+    }
+    resolved[name] = value;
+  }
+  return resolved;
+}
+
+// ../../src/bootstrap/env.ts
+var appEnvSchema = defineEnvSchema({
+  DATABASE_URL: { required: true, pattern: /^postgres(ql)?:\/\// },
+  PORT: {
+    integer: true,
+    minimum: 1,
+    default: String(DEFAULT_APP_PORT)
+  },
+  CACHE_TTL_MS: {
+    integer: true,
+    minimum: 0,
+    default: String(DEFAULT_CACHE_TTL_MS)
+  },
+  CACHE_MAX_ENTRIES: {
+    integer: true,
+    minimum: 1,
+    default: String(DEFAULT_CACHE_MAX_ENTRIES)
+  },
+  CACHE_DRIVER: {
+    default: DEFAULT_CACHE_DRIVER,
+    pattern: /^(array|redis)$/
+  },
+  REDIS_URL: {
+    default: ""
+  },
+  QUEUE_DRIVER: {
+    default: DEFAULT_QUEUE_DRIVER,
+    pattern: /^(sync|async|redis)$/
+  },
+  AUTH_DEV_HEADERS: {
+    default: "true",
+    pattern: /^(true|false|0|1)$/
+  },
+  APP_ENV: {
+    default: "local"
+  },
+  APP_DEBUG: {
+    default: "true"
+  },
+  APP_URL: {
+    default: "http://localhost:3000"
+  },
+  API_PREFIX: {
+    default: "/api/v1"
+  },
+  CORS_ALLOWED_ORIGINS: {
+    default: "*"
+  },
+  QUEUE_MAX_ATTEMPTS: {
+    integer: true,
+    minimum: 1,
+    default: "3"
+  },
+  QUEUE_BACKOFF_MS: {
+    integer: true,
+    minimum: 0,
+    default: "1000"
+  },
+  ADMIN_API_TOKEN: {
+    default: DEFAULT_API_TOKEN
+  },
+  MEMBER_API_TOKEN: {
+    default: ""
+  },
+  DB_POOL_MAX: {
+    integer: true,
+    minimum: 1,
+    default: "10"
+  },
+  DB_POOL_IDLE_TIMEOUT: {
+    integer: true,
+    minimum: 0,
+    default: "30"
+  },
+  DB_POOL_MAX_LIFETIME: {
+    integer: true,
+    minimum: 0,
+    default: "3600"
+  },
+  DB_CONNECTION_TIMEOUT: {
+    integer: true,
+    minimum: 1,
+    default: "10"
+  }
+});
+
+// ../../src/bootstrap/providers/config.ts
+function parseInteger(value, envName, minimum) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed < minimum) {
+    const comparison = minimum === 0 ? "a non-negative" : `an integer >= ${minimum}`;
+    throw new Error(`${envName} must be ${comparison} value.`);
+  }
+  return parsed;
+}
+var configProvider = {
+  name: "core.config",
+  register({ container, config }) {
+    const env = validateEnv(appEnvSchema);
+    container.set(CORE_CONFIG_TOKEN, config);
+    config.set(DATABASE_URL_CONFIG_KEY, env.DATABASE_URL);
+    config.set(APP_PORT_CONFIG_KEY, parseInteger(env.PORT ?? String(DEFAULT_APP_PORT), "PORT", 1));
+    config.set(CACHE_TTL_MS_CONFIG_KEY, parseInteger(env.CACHE_TTL_MS ?? String(DEFAULT_CACHE_TTL_MS), "CACHE_TTL_MS", 0));
+    config.set(CACHE_MAX_ENTRIES_CONFIG_KEY, parseInteger(env.CACHE_MAX_ENTRIES ?? String(DEFAULT_CACHE_MAX_ENTRIES), "CACHE_MAX_ENTRIES", 1));
+    config.set(CACHE_DRIVER_CONFIG_KEY, env.CACHE_DRIVER ?? DEFAULT_CACHE_DRIVER);
+    config.set(REDIS_URL_CONFIG_KEY, env.REDIS_URL ?? "");
+    config.set("app.env", appConfig.env);
+    config.set("app.debug", appConfig.debug);
+    config.set("app.url", appConfig.url);
+    config.set("app.apiPrefix", appConfig.apiPrefix);
+    config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
+    config.set("queue.driver", queueConfig.driver);
+    config.set("queue.maxAttempts", queueConfig.maxAttempts);
+    config.set("queue.backoffMs", queueConfig.backoffMs);
+  }
+};
+var config_default = configProvider;
+
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  listeners = new Map;
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
+  }
+}
+var eventBus = new EventBus;
+
+// ../../src/core/events/index.ts
+function modelEventName(tableName, action) {
+  return `${tableName}.${action}`;
+}
+
+// ../../src/bootstrap/providers/events.ts
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var eventsProvider = {
+  name: "core.events",
+  register({ container }) {
+    container.set(CORE_EVENT_BUS_TOKEN, eventBus);
+  }
+};
+var events_default = eventsProvider;
+
+// ../../src/bootstrap/discoverListeners.ts
+import { readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadDiscoveredListeners() {
+  const listenersDirectory = join2(import.meta.dir, "../listeners");
+  let entries;
+  try {
+    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const listeners = await Promise.all(entries.map(async (fileName) => {
+    const moduleUrl = pathToFileURL2(join2(listenersDirectory, fileName)).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return listeners.filter((listener) => typeof listener === "function");
+}
+var appListeners = await loadDiscoveredListeners();
+function discoverListeners() {
+  return appListeners;
+}
+
+// ../../src/core/cache/modelCacheTags.ts
+function cacheTagsForModelWrite(tableName, action) {
+  const module = appModules.find((entry) => entry.tableName === tableName);
+  const baseTags = module?.cacheTags ?? [`${tableName}s`];
+  const isDelete = action === "deleted" || action === "force-deleted";
+  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
+  return [...new Set([...baseTags, ...extraTags])];
+}
+function discoverModelTableNames() {
+  return appModules.map((module) => module.tableName).filter((tableName) => tableName !== undefined);
+}
+
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+// ../../src/core/jobs/invalidateCacheTagsJob.ts
+class InvalidateCacheTagsJob extends Job {
+  cache;
+  constructor(cache) {
+    super();
+    this.cache = cache;
+  }
+  async handle(payload) {
+    await this.cache.tags(...payload.tags).flush();
+  }
+}
+var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac as createHmac2 } from "crypto";
+class DispatchWebhookJob extends Job {
+  constructor() {
+    super();
+  }
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await connection_default`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await connection_default`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await connection_default`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
+  }
+}
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  constructor() {}
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var jobRegistry = new JobRegistry;
+
+// ../../src/core/pagination/index.ts
+function buildPaginationMeta(input) {
+  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
+  return {
+    page: input.page,
+    per_page: input.perPage,
+    total: input.total,
+    last_page: lastPage
+  };
+}
+
+// ../../src/core/database/errors.ts
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
+  }
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
+  }
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
+  }
+  return;
+}
+function mapDatabaseError(error) {
+  if (error instanceof HttpError) {
+    return error;
+  }
+  if (!isPostgresError(error)) {
+    const message = error instanceof Error ? error.message : "Database operation failed.";
+    return new BadRequestError(message);
+  }
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      return new ConflictError(error.detail ?? "A record with these values already exists.", {
+        constraint: error.constraint
+      });
+    case "23503":
+      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
+        constraint: error.constraint
+      });
+    case "23502":
+      return new BadRequestError(error.detail ?? "Required field is missing.", {
+        constraint: error.constraint
+      });
+    case "23514":
+      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
+        constraint: error.constraint
+      });
+    default:
+      return new BadRequestError(error.message ?? "Database operation failed.", {
+        code: error.code,
+        sqlState
+      });
+  }
+}
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
+  }
+}
+
+// ../../src/core/database/query.ts
+function quoteIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return `"${identifier}"`;
+}
+function qualifyColumn(tableName, column) {
+  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
+}
+function resolveQualifiedColumn(defaultTable, columnName) {
+  if (columnName.includes(".")) {
+    const [table, column] = columnName.split(".", 2);
+    if (!table || !column) {
+      throw new Error(`Invalid qualified column: ${columnName}`);
+    }
+    return qualifyColumn(table, column);
+  }
+  return qualifyColumn(defaultTable, columnName);
+}
+function parseQualifiedColumn(reference) {
+  const [table, column] = reference.split(".", 2);
+  if (!table || !column) {
+    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
+  }
+  return { table, column };
+}
+function normalizeDirection(direction = "ASC") {
+  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
+}
+function isQueryOperator(value) {
+  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
+}
+function pushParam(values, value) {
+  values.push(value);
+  return `$${values.length}`;
+}
+function buildInClause(column, values, params) {
+  if (values.length === 0) {
+    return "1 = 0";
+  }
+  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
+  return `${column} IN (${placeholders})`;
+}
+function buildOperatorClauses(column, operator, params) {
+  const clauses = [];
+  if (operator.isNull === true) {
+    clauses.push(`${column} IS NULL`);
+  }
+  if (operator.isNull === false) {
+    clauses.push(`${column} IS NOT NULL`);
+  }
+  if (operator.eq !== undefined) {
+    if (operator.eq === null) {
+      clauses.push(`${column} IS NULL`);
+    } else {
+      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
+    }
+  }
+  if (operator.in !== undefined) {
+    clauses.push(buildInClause(column, operator.in, params));
+  }
+  if (operator.gt !== undefined) {
+    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
+  }
+  if (operator.gte !== undefined) {
+    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
+  }
+  if (operator.lt !== undefined) {
+    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
+  }
+  if (operator.lte !== undefined) {
+    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
+  }
+  if (operator.ilike !== undefined) {
+    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
+  }
+  if (operator.tsMatch !== undefined) {
+    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
+  }
+  return clauses;
+}
+function appendWhereParts(tableName, where, params) {
+  const clauses = [];
+  for (const [columnName, filterValue] of Object.entries(where)) {
+    if (filterValue === undefined) {
+      continue;
+    }
+    const column = resolveQualifiedColumn(tableName, columnName);
+    if (Array.isArray(filterValue)) {
+      clauses.push(buildInClause(column, filterValue, params));
+      continue;
+    }
+    if (isQueryOperator(filterValue)) {
+      clauses.push(...buildOperatorClauses(column, filterValue, params));
+      continue;
+    }
+    if (filterValue === null) {
+      clauses.push(`${column} IS NULL`);
+      continue;
+    }
+    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
+  }
+  return clauses.join(" AND ");
+}
+function buildWhereNodeClause(tableName, node, params) {
+  if ("where" in node) {
+    return appendWhereParts(tableName, node.where, params);
+  }
+  const grouped = buildWhereGroupClause(tableName, node.group, params);
+  if (!grouped) {
+    return "";
+  }
+  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
+}
+function buildWhereGroupClause(tableName, nodes, params) {
+  let result = "";
+  for (const node of nodes) {
+    const part = buildWhereNodeClause(tableName, node, params);
+    if (!part) {
+      continue;
+    }
+    if (!result) {
+      result = part;
+      continue;
+    }
+    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
+  }
+  if (!result) {
+    return "";
+  }
+  return result;
+}
+function buildAdvancedWhereClause(tableName, where = {}, whereNodes = []) {
+  const params = [];
+  const nodes = [];
+  if (Object.keys(where).length > 0) {
+    nodes.push({ kind: "and", where });
+  }
+  nodes.push(...whereNodes);
+  const combined = buildWhereGroupClause(tableName, nodes, params);
+  return {
+    clause: combined ? ` WHERE ${combined}` : "",
+    params
+  };
+}
+function resolveSoftDeleteColumn(table) {
+  if (!table.softDeletes) {
+    return null;
+  }
+  if (table.softDeletes === true) {
+    return "deleted_at";
+  }
+  return table.softDeletes.column ?? "deleted_at";
+}
+function appendSoftDeleteScope(table, options, clauses) {
+  const column = resolveSoftDeleteColumn(table);
+  if (!column) {
+    return;
+  }
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  if (options.onlyTrashed) {
+    clauses.push(`${qualifiedColumn} IS NOT NULL`);
+    return;
+  }
+  if (!options.withTrashed) {
+    clauses.push(`${qualifiedColumn} IS NULL`);
+  }
+}
+function buildQueryWhereClause(table, options = {}, whereNodes = []) {
+  const { clause, params } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes);
+  const softDeleteClauses = [];
+  appendSoftDeleteScope(table, options, softDeleteClauses);
+  if (softDeleteClauses.length === 0) {
+    return { clause, params };
+  }
+  const base = clause.replace(/^ WHERE /, "");
+  const scope = softDeleteClauses.join(" AND ");
+  return {
+    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
+    params
+  };
+}
+function isQueryOrder(value) {
+  return "column" in value;
+}
+function normalizeOrderBy(orderBy) {
+  if (!orderBy) {
+    return [];
+  }
+  if (Array.isArray(orderBy)) {
+    return orderBy;
+  }
+  if (isQueryOrder(orderBy)) {
+    return [orderBy];
+  }
+  return Object.entries(orderBy).map(([column, direction]) => ({
+    column,
+    direction
+  }));
+}
+function buildOrderByClause(tableName, orderBy) {
+  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
+    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
+  });
+  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
+}
+function buildGroupByClause(tableName, groupBy) {
+  if (!groupBy) {
+    return "";
+  }
+  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
+  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
+  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
+}
+function buildHavingClause(tableName, having, params) {
+  if (!having) {
+    return "";
+  }
+  const body = appendWhereParts(tableName, having, params);
+  return body.length > 0 ? ` HAVING ${body}` : "";
+}
+function buildJoinClause(joins = []) {
+  return joins.map((join3) => {
+    const joinType = join3.type === "left" ? "LEFT JOIN" : "INNER JOIN";
+    const onClause = join3.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
+    return ` ${joinType} ${quoteIdentifier(join3.table)} ON ${onClause}`;
+  }).join("");
+}
+function buildLimitClause(limit) {
+  if (limit === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(limit) || limit <= 0) {
+    throw new Error("Query limit must be a positive integer.");
+  }
+  return ` LIMIT ${limit}`;
+}
+function buildOffsetClause(offset) {
+  if (offset === undefined) {
+    return "";
+  }
+  if (!Number.isInteger(offset) || offset < 0) {
+    throw new Error("Query offset must be a non-negative integer.");
+  }
+  return ` OFFSET ${offset}`;
+}
+function buildReturningColumns(table) {
+  return table.columns.map((column) => qualifyColumn(table.name, column)).join(", ");
+}
+function buildSelectList(table, select, params = []) {
+  if (!select || select.length === 0) {
+    return buildReturningColumns(table);
+  }
+  return select.map((item) => {
+    if (item.kind === "column") {
+      const column2 = qualifyColumn(item.table, item.column);
+      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+    }
+    if (item.kind === "literalText") {
+      return `${pushParam(params, item.value)}::text AS ${quoteIdentifier(item.as)}`;
+    }
+    const column = qualifyColumn(item.table, item.column);
+    const placeholder = pushParam(params, item.query);
+    return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
+  }).join(", ");
+}
+function getDefinedColumnEntries(table, values, options = {}) {
+  const record = values;
+  const excluded = new Set(options.exclude ?? []);
+  return table.columns.flatMap((column) => {
+    if (excluded.has(column) || !Object.hasOwn(record, column)) {
+      return [];
+    }
+    const value = record[column];
+    if (value === undefined) {
+      return [];
+    }
+    return [[column, value]];
+  });
+}
+function buildSelectQuery(table, options = {}, whereNodes = []) {
+  const params = [];
+  const columns = buildSelectList(table, options.select, params);
+  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  const havingClause = buildHavingClause(table.name, options.having, params);
+  const orderBy = buildOrderByClause(table.name, options.orderBy ?? table.defaultOrderBy);
+  const limit = buildLimitClause(options.limit);
+  const offset = buildOffsetClause(options.offset);
+  return {
+    text: `SELECT ${columns} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${havingClause}${orderBy}${limit}${offset}`,
+    params
+  };
+}
+function buildCountQuery(table, where = {}, options = {}, whereNodes = []) {
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, {
+    where,
+    withTrashed: options.withTrashed,
+    onlyTrashed: options.onlyTrashed
+  }, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  return {
+    text: `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}`,
+    params
+  };
+}
+function buildProjectionQuery(table, expression, alias, options = {}, whereNodes = []) {
+  assertSafeProjectionExpression(expression);
+  const params = [];
+  const { clause, params: whereParams } = buildQueryWhereClause(table, options, whereNodes);
+  params.push(...whereParams);
+  const joins = buildJoinClause(options.joins);
+  const groupBy = buildGroupByClause(table.name, options.groupBy);
+  const orderBy = buildOrderByClause(table.name, options.orderBy);
+  const limit = buildLimitClause(options.limit);
+  return {
+    text: `SELECT ${expression} AS ${quoteIdentifier(alias)} FROM ${quoteIdentifier(table.name)}${joins}${clause}${groupBy}${orderBy}${limit}`,
+    params
+  };
+}
+var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
+function assertSafeProjectionExpression(expression) {
+  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
+    throw new Error(`Unsafe projection expression: ${expression}`);
+  }
+}
+function buildGroupedCountQuery(table, column, where = {}, options = {}) {
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  const { clause, params } = buildQueryWhereClause(table, {
+    where,
+    ...options
+  });
+  return {
+    text: `SELECT ${qualifiedColumn} AS ${quoteIdentifier("value")}, COUNT(*) AS ${quoteIdentifier("count")} FROM ${quoteIdentifier(table.name)}${clause} GROUP BY ${qualifiedColumn} ORDER BY ${qualifiedColumn} ASC`,
+    params
+  };
+}
+function buildInsertQuery(table, values) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot insert into ${table.name} without any column values.`);
+  }
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders}) RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildUpdateQuery(table, id, changes) {
+  const entries = getDefinedColumnEntries(table, changes, {
+    exclude: [table.primaryKey]
+  });
+  if (entries.length === 0) {
+    throw new Error(`Cannot update ${table.name} without any changed column values.`);
+  }
+  const params = [];
+  const setClause = entries.map(([column, value]) => `${quoteIdentifier(column)} = ${pushParam(params, value)}`).join(", ");
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${setClause} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix} RETURNING ${returningColumns}`,
+    params
+  };
+}
+function buildSoftDeleteByIdQuery(table, id, deletedAt) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2${scopeSuffix} RETURNING ${returningColumns}`,
+    params: [deletedAt, id]
+  };
+}
+function buildRestoreByIdQuery(table, id) {
+  const deletedAtColumn = resolveSoftDeleteColumn(table);
+  if (!deletedAtColumn) {
+    throw new Error(`Table ${table.name} does not support soft deletes.`);
+  }
+  const returningColumns = buildReturningColumns(table);
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${quoteIdentifier(deletedAtColumn)} = $1 WHERE ${quoteIdentifier(table.primaryKey)} = $2 AND ${qualifyColumn(table.name, deletedAtColumn)} IS NOT NULL RETURNING ${returningColumns}`,
+    params: [null, id]
+  };
+}
+function buildDeleteByIdQuery(table, id) {
+  return {
+    text: `DELETE FROM ${quoteIdentifier(table.name)} WHERE ${quoteIdentifier(table.primaryKey)} = $1 RETURNING ${quoteIdentifier(table.primaryKey)} AS ${quoteIdentifier("deleted_id")}`,
+    params: [id]
+  };
+}
+
+// ../../src/core/database/relationships.ts
+function indexHasManyRelation(parents, children, relation) {
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.localKey], []);
+  }
+  for (const child of children) {
+    const key = child[relation.foreignKey];
+    const group = groups.get(key);
+    if (!group) {
+      continue;
+    }
+    group.push(child);
+  }
+  return groups;
+}
+function indexBelongsToRelation(children, parents, relation) {
+  const parentsById = new Map;
+  for (const parent of parents) {
+    parentsById.set(parent[relation.ownerKey], parent);
+  }
+  const result = new Map;
+  for (const child of children) {
+    const foreignKey = child[relation.foreignKey];
+    const parent = parentsById.get(foreignKey);
+    if (parent) {
+      result.set(foreignKey, parent);
+    }
+  }
+  return result;
+}
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? connection_default;
+}
+var repositoryConnection = new Proxy({}, {
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/database/whereBuilder.ts
+class WhereBuilder {
+  nodes = [];
+  where(where) {
+    this.nodes.push({ kind: "and", where });
+    return this;
+  }
+  orWhere(where) {
+    this.nodes.push({ kind: "or", where });
+    return this;
+  }
+  whereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "and", group: nested.nodes });
+    }
+    return this;
+  }
+  orWhereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "or", group: nested.nodes });
+    }
+    return this;
+  }
+}
+
+// ../../src/core/database/repositoryQuery.ts
+class RepositoryQuery {
+  repository;
+  whereClause;
+  queryOptions;
+  eagerLoads = [];
+  whereNodes = [];
+  constructor(repository, whereClause = {}, queryOptions = {}) {
+    this.repository = repository;
+    this.whereClause = whereClause;
+    this.queryOptions = queryOptions;
+  }
+  where(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      this.whereNodes.push(...builder.nodes);
+      return this;
+    }
+    this.whereClause = { ...this.whereClause, ...input };
+    return this;
+  }
+  orWhere(input) {
+    if (typeof input === "function") {
+      const builder = new WhereBuilder;
+      input(builder);
+      if (builder.nodes.length > 0) {
+        this.whereNodes.push({ kind: "or", group: builder.nodes });
+      }
+      return this;
+    }
+    this.whereNodes.push({ kind: "or", where: input });
+    return this;
+  }
+  orderBy(orderBy) {
+    this.queryOptions = { ...this.queryOptions, orderBy };
+    return this;
+  }
+  limit(limit) {
+    this.queryOptions = { ...this.queryOptions, limit };
+    return this;
+  }
+  offset(offset) {
+    this.queryOptions = { ...this.queryOptions, offset };
+    return this;
+  }
+  join(left, right) {
+    return this.addJoin("inner", left, right);
+  }
+  leftJoin(left, right) {
+    return this.addJoin("left", left, right);
+  }
+  groupBy(groupBy) {
+    this.queryOptions = { ...this.queryOptions, groupBy };
+    return this;
+  }
+  having(having) {
+    this.queryOptions = { ...this.queryOptions, having };
+    return this;
+  }
+  withHasMany(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "hasMany",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withBelongsTo(as, relation, parentRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "belongsTo",
+      as,
+      relation,
+      repository: parentRepository,
+      options
+    });
+    return this;
+  }
+  async get() {
+    const rows = await this.repository.findAll(this.buildOptions());
+    return await this.attach(rows);
+  }
+  async first() {
+    const rows = await this.get();
+    return rows[0] ?? null;
+  }
+  async paginate(options) {
+    return await this.repository.paginate({
+      ...this.buildOptions(),
+      page: options.page,
+      perPage: options.perPage
+    });
+  }
+  buildOptions() {
+    return {
+      ...this.queryOptions,
+      where: this.whereClause,
+      whereNodes: this.whereNodes
+    };
+  }
+  addJoin(type, left, right) {
+    const leftRef = parseQualifiedColumn(left);
+    const rightRef = parseQualifiedColumn(right);
+    const table = type === "inner" ? rightRef.table : rightRef.table;
+    const joins = this.queryOptions.joins ?? [];
+    const existing = joins.find((join3) => join3.table === table && join3.type === type);
+    if (existing) {
+      existing.on.push({ left: leftRef, right: rightRef });
+      return this;
+    }
+    this.queryOptions = {
+      ...this.queryOptions,
+      joins: [
+        ...joins,
+        {
+          type,
+          table,
+          on: [{ left: leftRef, right: rightRef }]
+        }
+      ]
+    };
+    return this;
+  }
+  async attach(rows) {
+    if (rows.length === 0 || this.eagerLoads.length === 0) {
+      return rows.map((row) => ({ ...row }));
+    }
+    let result = rows.map((row) => ({ ...row }));
+    for (const load of this.eagerLoads) {
+      if (load.kind === "hasMany") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
+        }));
+        continue;
+      }
+      const relation = load.relation;
+      const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
+      result = result.map((row) => ({
+        ...row,
+        [load.as]: grouped.get(row[relation.foreignKey])
+      }));
+    }
+    return result;
+  }
+}
+
+// ../../src/core/database/baseRepository.ts
+class BaseRepository5 {
+  table;
+  connection;
+  constructor(table, connection = repositoryConnection) {
+    this.table = table;
+    this.connection = connection;
+  }
+  async findAll(options = {}) {
+    return await withDatabaseErrorHandling(async () => {
+      const { whereNodes, ...queryOptions } = options;
+      const { text, params } = buildSelectQuery(this.table, queryOptions, whereNodes ?? []);
+      return await this.connection.unsafe(text, params);
+    });
+  }
+  async paginate(options) {
+    const { whereNodes, where = {}, page, perPage, ...queryOptions } = options;
+    const total = await this.countWhere(where, {
+      withTrashed: options.withTrashed,
+      onlyTrashed: options.onlyTrashed,
+      joins: options.joins,
+      groupBy: options.groupBy
+    }, whereNodes);
+    const offset = (page - 1) * perPage;
+    const data = await this.findAll({
+      ...queryOptions,
+      where,
+      whereNodes,
+      limit: perPage,
+      offset
+    });
+    return {
+      data,
+      meta: buildPaginationMeta({ page, perPage, total })
+    };
+  }
+  async chunk(count, callback, options = {}) {
+    if (!Number.isInteger(count) || count <= 0) {
+      throw new Error("Chunk size must be a positive integer.");
+    }
+    let offset = 0;
+    while (true) {
+      const rows = await this.findAll({
+        ...options,
+        limit: count,
+        offset
+      });
+      if (rows.length === 0) {
+        return;
+      }
+      const shouldContinue = await callback(rows);
+      if (shouldContinue === false || rows.length < count) {
+        return;
+      }
+      offset += count;
+    }
+  }
+  async cursorPaginate(options) {
+    const {
+      perPage,
+      cursor,
+      cursorColumn = this.table.primaryKey,
+      direction = "asc",
+      where = {},
+      whereNodes,
+      ...queryOptions
+    } = options;
+    if (!Number.isInteger(perPage) || perPage <= 0) {
+      throw new Error("Cursor page size must be a positive integer.");
+    }
+    const cursorWhere = { ...where };
+    if (cursor !== undefined) {
+      cursorWhere[cursorColumn] = direction === "asc" ? { gt: cursor } : { lt: cursor };
+    }
+    const rows = await this.findAll({
+      ...queryOptions,
+      where: cursorWhere,
+      whereNodes,
+      orderBy: { [cursorColumn]: direction },
+      limit: perPage + 1
+    });
+    const hasMore = rows.length > perPage;
+    const data = hasMore ? rows.slice(0, perPage) : rows;
+    const nextCursor = hasMore ? data[data.length - 1]?.[cursorColumn] ?? null : null;
+    const prevCursor = cursor ?? null;
+    return {
+      data,
+      meta: {
+        per_page: perPage,
+        next_cursor: nextCursor,
+        prev_cursor: prevCursor,
+        has_more: hasMore
+      }
+    };
+  }
+  async findById(id) {
+    return await this.firstOrNull({
+      [this.table.primaryKey]: id
+    });
+  }
+  async findByIdOrThrow(id, errorFactory) {
+    const record = await this.findById(id);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async findByIds(ids) {
+    const uniqueIds = [...new Set(ids)];
+    if (uniqueIds.length === 0) {
+      return [];
+    }
+    return await this.findWhere({
+      [this.table.primaryKey]: uniqueIds
+    });
+  }
+  async firstOrNull(where, options = {}) {
+    const [record] = await this.findAll({ ...options, where, limit: 1 });
+    return record ?? null;
+  }
+  async create(values) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildInsertQuery(this.table, values);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        throw new Error(`Insert into ${this.table.name} did not return a record.`);
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "created"), entity);
+      return entity;
+    });
+  }
+  async updateById(id, changes) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildUpdateQuery(this.table, id, changes);
+      const [record] = await this.connection.unsafe(text, params);
+      const entity = record ?? null;
+      if (entity) {
+        await eventBus.dispatch(modelEventName(this.table.name, "updated"), entity);
+      }
+      return entity;
+    });
+  }
+  async updateByIdOrThrow(id, changes, errorFactory) {
+    const record = await this.updateById(id, changes);
+    if (record) {
+      return record;
+    }
+    throw errorFactory?.(id) ?? new Error(`${this.table.name} ${String(id)} was not found.`);
+  }
+  async deleteById(id) {
+    if (resolveSoftDeleteColumn(this.table)) {
+      return await this.softDeleteById(id);
+    }
+    return await this.forceDeleteById(id);
+  }
+  async softDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "deleted"), record);
+      return true;
+    });
+  }
+  async forceDeleteById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildDeleteByIdQuery(this.table, id);
+      const [row] = await this.connection.unsafe(text, params);
+      if (!row) {
+        return false;
+      }
+      await eventBus.dispatch(modelEventName(this.table.name, "force-deleted"), {
+        id
+      });
+      return true;
+    });
+  }
+  async restoreById(id) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildRestoreByIdQuery(this.table, id);
+      const [record] = await this.connection.unsafe(text, params);
+      if (!record) {
+        return null;
+      }
+      const entity = record;
+      await eventBus.dispatch(modelEventName(this.table.name, "restored"), entity);
+      return entity;
+    });
+  }
+  withConnection(connection) {
+    const clone = Object.create(Object.getPrototypeOf(this));
+    Object.assign(clone, this);
+    clone.connection = connection;
+    return clone;
+  }
+  getConnection() {
+    return this.connection;
+  }
+  getTable() {
+    return this.table;
+  }
+  query(where = {}) {
+    return new RepositoryQuery(this, where);
+  }
+  async findWhere(where, options = {}) {
+    return await this.findAll({ ...options, where });
+  }
+  async countWhere(where = {}, options = {}, whereNodes = []) {
+    const { text, params } = buildCountQuery(this.table, where, options, whereNodes);
+    const [row] = await this.connection.unsafe(text, params);
+    return Number(row?.count ?? 0);
+  }
+  async averageColumn(column, where = {}) {
+    const qualifiedColumn = qualifyColumn(this.table.name, column);
+    return await this.averageExpression(`AVG(${qualifiedColumn})`, "value", where);
+  }
+  async averageExpression(expression, alias, where = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
+    const [row] = await this.connection.unsafe(text, params);
+    return Math.round(Number(row?.[alias] ?? 0));
+  }
+  async pluckNumberValues(expression, alias, options = {}) {
+    const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.flatMap((row) => {
+      const value = row[alias];
+      return value === null || value === undefined ? [] : [Number(value)];
+    });
+  }
+  async countGroupedBy(column, where = {}) {
+    const { text, params } = buildGroupedCountQuery(this.table, column, where);
+    const rows = await this.connection.unsafe(text, params);
+    return rows.map(({ value, count }) => ({
+      value,
+      count: Number(count)
+    }));
+  }
+  async findByHasManyRelation(relation, parentId, options = {}) {
+    return await this.findWhere({
+      [relation.foreignKey]: parentId
+    }, options);
+  }
+  async loadHasManyForParents(parents, relation, options = {}) {
+    if (parents.length === 0) {
+      return indexHasManyRelation(parents, [], relation);
+    }
+    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
+    const children = await this.findWhere({
+      [relation.foreignKey]: parentIds
+    }, options);
+    return indexHasManyRelation(parents, children, relation);
+  }
+  async loadBelongsToForParents(children, relation, parentRepository, options = {}) {
+    if (children.length === 0) {
+      return new Map;
+    }
+    const ownerIds = [...new Set(children.map((child) => child[relation.foreignKey]))];
+    const parents = await parentRepository.withConnection(this.connection).findWhere({
+      [relation.ownerKey]: ownerIds
+    }, options);
+    return indexBelongsToRelation(children, parents, relation);
+  }
+}
+var baseRepository_default = BaseRepository5;
+// ../../src/core/database/model.ts
+var modelRepositories = new WeakMap;
+var modelGlobalScopes = new WeakMap;
+var modelBooted = new WeakSet;
+// ../../src/core/database/schema/columnDefinition.ts
+class ColumnDefinition {
+  name;
+  kind;
+  length;
+  isNullable = false;
+  isPrimary = false;
+  isUnique = false;
+  autoIncrement = false;
+  defaultValue;
+  checkExpression;
+  foreignKey;
+  constructor(name, kind) {
+    this.name = name;
+    this.kind = kind;
+  }
+  nullable() {
+    this.isNullable = true;
+    return this;
+  }
+  notNullable() {
+    this.isNullable = false;
+    return this;
+  }
+  default(value) {
+    if (typeof value === "boolean") {
+      this.defaultValue = value ? "TRUE" : "FALSE";
+      return this;
+    }
+    if (typeof value === "number") {
+      this.defaultValue = String(value);
+      return this;
+    }
+    this.defaultValue = `'${value.replace(/'/g, "''")}'`;
+    return this;
+  }
+  defaultRaw(expression) {
+    this.defaultValue = expression;
+    return this;
+  }
+  unique() {
+    this.isUnique = true;
+    return this;
+  }
+  primary() {
+    this.isPrimary = true;
+    return this;
+  }
+  check(expression) {
+    this.checkExpression = expression;
+    return this;
+  }
+}
+
+class ForeignIdColumnDefinition extends ColumnDefinition {
+  constructor(name) {
+    super(name, "foreignId");
+    this.notNullable();
+  }
+  references(table, column = "id") {
+    this.foreignKey = {
+      referencesTable: table,
+      referencesColumn: column
+    };
+    return this;
+  }
+  constrained(table) {
+    const referencesTable = table ?? inferReferencedTable(this.name);
+    return this.references(referencesTable);
+  }
+  cascadeOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "cascade";
+    return this;
+  }
+  nullOnDelete() {
+    if (!this.foreignKey) {
+      throw new Error(`Foreign key is not defined for column ${this.name}`);
+    }
+    this.foreignKey.onDelete = "set null";
+    return this;
+  }
+}
+function inferReferencedTable(columnName) {
+  if (!columnName.endsWith("_id")) {
+    throw new Error(`Cannot infer referenced table from column ${columnName}`);
+  }
+  return columnName.slice(0, -3);
+}
+
+// ../../src/core/database/schema/blueprint.ts
+class Blueprint {
+  table;
+  action;
+  columns = [];
+  indexes = [];
+  droppedColumns = [];
+  droppedIndexes = [];
+  constructor(table, action) {
+    this.table = table;
+    this.action = action;
+  }
+  id(name = "id") {
+    const column = new ColumnDefinition(name, "id");
+    column.primary();
+    column.autoIncrement = true;
+    this.columns.push(column);
+    return column;
+  }
+  string(name, length) {
+    const column = new ColumnDefinition(name, "string");
+    column.length = length;
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  text(name) {
+    const column = new ColumnDefinition(name, "text");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  boolean(name) {
+    const column = new ColumnDefinition(name, "boolean");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  integer(name) {
+    const column = new ColumnDefinition(name, "integer");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  bigInteger(name) {
+    const column = new ColumnDefinition(name, "bigInteger");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  timestamp(name) {
+    const column = new ColumnDefinition(name, "timestamp");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  json(name) {
+    const column = new ColumnDefinition(name, "json");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  jsonb(name) {
+    const column = new ColumnDefinition(name, "jsonb");
+    column.notNullable();
+    this.columns.push(column);
+    return column;
+  }
+  foreignId(name) {
+    const column = new ForeignIdColumnDefinition(name);
+    this.columns.push(column);
+    return column;
+  }
+  timestamps() {
+    this.timestamp("created_at").defaultRaw("NOW()");
+    this.timestamp("updated_at").defaultRaw("NOW()");
+  }
+  softDeletes() {
+    this.timestamp("deleted_at").nullable();
+  }
+  dropColumn(name) {
+    this.droppedColumns.push(name);
+  }
+  dropSoftDeletes() {
+    this.dropColumn("deleted_at");
+    this.dropIndex(`idx_${this.table}_deleted_at`);
+  }
+  dropIndex(name) {
+    this.droppedIndexes.push(name);
+  }
+  unique(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "unique"
+    });
+  }
+  index(columns, options = {}) {
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "index",
+      order: options.order
+    });
+  }
+  partialIndex(columns, where, nameOrOptions) {
+    const options = typeof nameOrOptions === "string" ? { name: nameOrOptions } : nameOrOptions ?? {};
+    this.indexes.push({
+      name: options.name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: options.unique ? "uniquePartial" : "partial",
+      where
+    });
+  }
+  fullText(columns, name) {
+    this.indexes.push({
+      name,
+      columns: Array.isArray(columns) ? columns : [columns],
+      kind: "fullText"
+    });
+  }
+  ginIndex(column, name) {
+    this.indexes.push({
+      name,
+      columns: [column],
+      kind: "gin"
+    });
+  }
+}
+// ../../src/core/database/schema/errors.ts
+class UnsupportedSchemaFeatureError extends Error {
+  constructor(feature, driver) {
+    super(`${feature} is not supported for the ${driver} driver`);
+    this.name = "UnsupportedSchemaFeatureError";
+  }
+}
+// ../../src/core/database/schema/grammars/grammar.ts
+function compileColumnType(driver, column) {
+  switch (column.kind) {
+    case "id":
+      return compileIdType(driver);
+    case "string":
+      return compileStringType(driver, column.length);
+    case "text":
+      return compileTextType(driver);
+    case "boolean":
+      return compileBooleanType(driver);
+    case "integer":
+    case "foreignId":
+      return compileIntegerType(driver);
+    case "bigInteger":
+      return compileBigIntegerType(driver);
+    case "timestamp":
+      return compileTimestampType(driver);
+    case "json":
+      return compileJsonType(driver);
+    case "jsonb":
+      return compileJsonbType(driver);
+    default:
+      throw new Error(`Unsupported column kind: ${column.kind}`);
+  }
+}
+function compileIdType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "SERIAL";
+    case "mysql":
+      return "BIGINT UNSIGNED";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileStringType(driver, length) {
+  switch (driver) {
+    case "pgsql":
+      return "TEXT";
+    case "mysql":
+      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileTextType(driver) {
+  switch (driver) {
+    case "pgsql":
+    case "sqlite":
+      return "TEXT";
+    case "mysql":
+      return "TEXT";
+  }
+}
+function compileBooleanType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BOOLEAN";
+    case "mysql":
+      return "BOOLEAN";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "INTEGER";
+    case "mysql":
+      return "INT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileBigIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BIGINT";
+    case "mysql":
+      return "BIGINT";
+    case "sqlite":
+      return "INTEGER";
+  }
+}
+function compileTimestampType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "TIMESTAMPTZ";
+    case "mysql":
+      return "TIMESTAMP";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+function compileJsonbType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
+  }
+}
+
+// ../../src/core/database/schema/grammars/compileStatements.ts
+function compileCreateTable(driver, blueprint) {
+  const table = quoteIdentifier(blueprint.table);
+  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length > 1) {
+      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+      parts.push(`UNIQUE (${columns})`);
+    }
+  }
+  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
+  ${parts.join(`,
+  `)}
+)`];
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length === 1) {
+      continue;
+    }
+    if (index.kind === "index") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileAlterTable(driver, blueprint) {
+  const statements = [];
+  const table = quoteIdentifier(blueprint.table);
+  for (const column of blueprint.columns) {
+    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
+    statements.push(`ALTER TABLE ${table}
+${addPrefix} ${compileColumn(driver, column, "alter")}`);
+  }
+  for (const columnName of blueprint.droppedColumns) {
+    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
+    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
+  }
+  for (const indexName of blueprint.droppedIndexes) {
+    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
+  }
+  for (const index of blueprint.indexes) {
+    if (index.kind === "index" || index.kind === "unique") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
+    }
+  }
+  return statements;
+}
+function compileDropTable(driver, tableName) {
+  const cascade = driver === "pgsql" ? " CASCADE" : "";
+  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
+}
+function compileColumn(driver, column, mode) {
+  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
+  if (column.autoIncrement && driver === "mysql") {
+    parts[1] = `${parts[1]} AUTO_INCREMENT`;
+  }
+  if (column.isPrimary && mode === "create") {
+    if (driver === "sqlite") {
+      parts.push("PRIMARY KEY AUTOINCREMENT");
+    } else {
+      parts.push("PRIMARY KEY");
+    }
+  } else if (!column.isNullable) {
+    parts.push("NOT NULL");
+  } else if (column.isNullable) {
+    parts.push("NULL");
+  }
+  if (column.defaultValue !== undefined) {
+    parts.push(`DEFAULT ${column.defaultValue}`);
+  }
+  if (column.isUnique) {
+    parts.push("UNIQUE");
+  }
+  if (column.checkExpression) {
+    parts.push(`CHECK (${column.checkExpression})`);
+  }
+  if (column.foreignKey) {
+    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
+    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
+    let clause = `REFERENCES ${reference}`;
+    if (onDelete === "cascade") {
+      clause += " ON DELETE CASCADE";
+    } else if (onDelete === "set null") {
+      clause += " ON DELETE SET NULL";
+    }
+    parts.push(clause);
+  }
+  return parts.join(" ");
+}
+function compileIndex(_driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
+  const columns = index.columns.map((column) => {
+    const quoted = quoteIdentifier(column);
+    if (index.order === "desc") {
+      return `${quoted} DESC`;
+    }
+    return quoted;
+  }).join(", ");
+  const unique = index.kind === "unique" ? "UNIQUE " : "";
+  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
+}
+function compileSpecialIndex(driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
+  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+  switch (index.kind) {
+    case "partial":
+    case "uniquePartial": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
+      }
+      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
+      return [
+        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
+      ];
+    }
+    case "gin": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
+      }
+      return [
+        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
+      ];
+    }
+    case "fullText": {
+      if (driver === "mysql") {
+        return [
+          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
+        ];
+      }
+      if (driver === "pgsql") {
+        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
+      }
+      throw new UnsupportedSchemaFeatureError("fullText()", driver);
+    }
+    default:
+      return [];
+  }
+}
+function defaultIndexName(tableName, columns, kind) {
+  return `idx_${tableName}_${columns.join("_")}_${kind}`;
+}
+function compileBlueprint(driver, blueprint) {
+  switch (blueprint.action) {
+    case "create":
+      return compileCreateTable(driver, blueprint);
+    case "alter":
+      return compileAlterTable(driver, blueprint);
+    case "drop":
+      return compileDropTable(driver, blueprint.table);
+    default:
+      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+  }
+}
+// ../../src/core/database/schema/grammars/createGrammar.ts
+function createGrammar(driver) {
+  return {
+    driver,
+    compile(blueprint) {
+      return compileBlueprint(driver, blueprint);
+    }
+  };
+}
+
+// ../../src/core/database/schema/grammars/mysqlGrammar.ts
+var MySqlGrammar = createGrammar("mysql");
+
+// ../../src/core/database/schema/grammars/postgresGrammar.ts
+var PostgresGrammar = createGrammar("pgsql");
+
+// ../../src/core/database/schema/grammars/sqliteGrammar.ts
+var SqliteGrammar = createGrammar("sqlite");
+
+// ../../src/core/database/schema/grammars/index.ts
+function grammarForDriver(driver) {
+  switch (driver) {
+    case "pgsql":
+      return PostgresGrammar;
+    case "mysql":
+      return MySqlGrammar;
+    case "sqlite":
+      return SqliteGrammar;
+    default:
+      throw new Error(`Unsupported database driver: ${driver}`);
+  }
+}
+// ../../src/core/database/schema/schema.ts
+class SchemaBuilder {
+  #driver;
+  #statements = [];
+  constructor(driver) {
+    this.#driver = driver;
+  }
+  create(table, callback) {
+    const blueprint = new Blueprint(table, "create");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  table(table, callback) {
+    const blueprint = new Blueprint(table, "alter");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  drop(table) {
+    const blueprint = new Blueprint(table, "drop");
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
+  }
+  toSql() {
+    return [...this.#statements];
+  }
+  async execute(db2) {
+    for (const statement of this.#statements) {
+      await db2.unsafe(statement);
+    }
+  }
+}
+// ../../src/core/database/table.ts
+function defineTable5(definition) {
+  return definition;
+}
+// ../../src/core/queue/failedJobTable.ts
+var failedJobTable = defineTable5({
+  name: "failed_job",
+  primaryKey: "id",
+  columns: ["id", "job_name", "payload", "exception", "failed_at"],
+  defaultOrderBy: { column: "failed_at", direction: "DESC" }
+});
+
+// ../../src/core/queue/failedJobRepository.ts
+class FailedJobRepository extends baseRepository_default {
+  constructor() {
+    super(failedJobTable);
+  }
+}
+var failedJobRepository_default = FailedJobRepository;
+
+// ../../src/core/queue/failedJobService.ts
+class FailedJobService {
+  repository;
+  constructor(repository) {
+    this.repository = repository;
+  }
+  async recordFailure(input) {
+    return await this.repository.create({
+      job_name: input.jobName,
+      payload: input.payload,
+      exception: input.exception,
+      failed_at: new Date
+    });
+  }
+  listRecent(limit = 50) {
+    return this.repository.findAll({
+      limit,
+      orderBy: { column: "failed_at", direction: "DESC" }
+    });
+  }
+  async retry(id) {
+    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
+    await this.repository.deleteById(id);
+    return failedJob;
+  }
+  async flush() {
+    const jobs = await this.repository.findAll();
+    let deleted = 0;
+    for (const job of jobs) {
+      if (await this.repository.deleteById(job.id)) {
+        deleted += 1;
+      }
+    }
+    return deleted;
+  }
+}
+var failedJobService_default = FailedJobService;
+
+// ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+
+// ../../src/core/queue/jobRunner.ts
+async function runQueueJob(envelope, failedJobs) {
+  const job = jobRegistry.create(envelope.name);
+  if (!job) {
+    throw new Error(`Unknown job "${envelope.name}".`);
+  }
+  const attempts = envelope.attempts ?? 0;
+  try {
+    await job.handle(envelope.payload);
+  } catch (error) {
+    const nextAttempt = attempts + 1;
+    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
+    if (nextAttempt < maxAttempts) {
+      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
+      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
+      await runQueueJob({
+        ...envelope,
+        attempts: nextAttempt
+      }, failedJobs);
+      return;
+    }
+    await failedJobs.recordFailure({
+      jobName: envelope.name,
+      payload: envelope.payload,
+      exception: error instanceof Error ? error.stack ?? error.message : String(error)
+    });
+    throw error;
+  }
+}
+
+// ../../src/core/queue/redisQueue.ts
+var QUEUE_LIST_KEY = "workhub:queue:default";
+var QUEUE_HIGH_KEY = "workhub:queue:high";
+var QUEUE_LOW_KEY = "workhub:queue:low";
+function queueKeyForPriority(priority = "default") {
+  switch (priority) {
+    case "high":
+      return QUEUE_HIGH_KEY;
+    case "low":
+      return QUEUE_LOW_KEY;
+    default:
+      return QUEUE_LIST_KEY;
+  }
+}
+class RedisQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient2(redisUrl);
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    const queueKey = queueKeyForPriority(job.priority);
+    await this.client.lpush(queueKey, JSON.stringify(envelope));
+  }
+}
+
+// ../../src/core/queue/resilientQueue.ts
+class ResilientQueue {
+  failedJobs;
+  asyncDispatch;
+  constructor(failedJobs, asyncDispatch = false) {
+    this.failedJobs = failedJobs;
+    this.asyncDispatch = asyncDispatch;
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    if (this.asyncDispatch) {
+      setTimeout(() => {
+        runQueueJob(envelope, this.failedJobs).catch((error) => {
+          console.error("[ResilientQueue] Job failed:", error);
+        });
+      }, 0);
+      return;
+    }
+    await runQueueJob(envelope, this.failedJobs);
+  }
+}
+
+// ../../src/core/queue/publicQueue.ts
+function createFailedJobService() {
+  return new failedJobService_default(new failedJobRepository_default);
+}
+function createTrackedJob(name, job) {
+  return jobRegistry.track(name, job);
+}
+function createProductionQueue(driver, options = {}) {
+  options.registerJobs?.();
+  const failedJobs = options.failedJobs ?? createFailedJobService();
+  if (driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new RedisQueue(options.redisUrl);
+  }
+  return new ResilientQueue(failedJobs, driver === "async");
+}
+
+// ../../src/core/queue/createAppQueue.ts
+var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+function registerDefaultJobs() {
+  jobRegistry.register("cache.invalidate-tags", () => {
+    return new invalidateCacheTagsJob_default(resolveApplicationCache());
+  });
+  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
+}
+function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService()) {
+  return createProductionQueue(driver, {
+    redisUrl,
+    failedJobs,
+    registerJobs: registerDefaultJobs
+  });
+}
+
+// ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
+var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
+function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
+  for (const tableName of discoverModelTableNames()) {
+    for (const action of MODEL_WRITE_ACTIONS) {
+      bus.listen(modelEventName(tableName, action), async () => {
+        const tags = cacheTagsForModelWrite(tableName, action);
+        if (tags.length === 0) {
+          return;
+        }
+        const cache = resolveApplicationCache();
+        const queue = resolveApplicationQueue();
+        const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
+        await queue.dispatch(job, { tags });
+      });
+    }
+  }
+}
+
+// ../../src/bootstrap/providers/listeners.ts
+var registeredListenerGroups = new Set;
+function registerListenerGroup(name, register) {
+  if (registeredListenerGroups.has(name)) {
+    return;
+  }
+  registeredListenerGroups.add(name);
+  register();
+}
+var listenersProvider = {
+  name: "core.listeners",
+  boot() {
+    registerListenerGroup("cache.invalidate-on-model-write", () => {
+      registerInvalidateCacheOnModelWriteListeners();
+    });
+    for (const [index, registerListener] of discoverListeners().entries()) {
+      registerListenerGroup(`app.listener.${index}`, registerListener);
+    }
+  }
+};
+var listeners_default = listenersProvider;
+
+// ../../src/core/auth/policy.ts
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
+    }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
+  }
+}
+
+// ../../src/bootstrap/providers/policy.ts
+var policyProvider = {
+  name: "core.policy",
+  register({ container }) {
+    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate);
+  }
+};
+var policy_default = policyProvider;
+
+// ../../src/bootstrap/providers/queue.ts
+var queueProvider = {
+  name: "core.queue",
+  register({ container, config }) {
+    const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
+    const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
+    config.set("queue.driver", driver);
+    const failedJobs = createFailedJobService();
+    container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
+    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs));
+  }
+};
+var queue_default = queueProvider;
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage3;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/view/etaViewEngine.ts
+import { join as join3 } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+// ../../src/core/http/csrfToken.ts
+import { createHmac as createHmac3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function signCsrfToken(token, issuedAt) {
+  const payload = `${token}.${issuedAt}`;
+  const signature = createHmac3("sha256", resolveCsrfSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCsrfCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === CSRF_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseSignedCsrfValue(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [token, issuedAtRaw, cookieSignature] = parts;
+  if (!token || !issuedAtRaw || !cookieSignature) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt)) {
+    return null;
+  }
+  if (Date.now() - issuedAt > CSRF_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  return { token, issuedAt };
+}
+function createCsrfTokenCookie() {
+  const token = randomBytes(24).toString("hex");
+  const issuedAt = Date.now();
+  const value = signCsrfToken(token, issuedAt);
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readCsrfCookie(request);
+  if (cookieValue) {
+    const parsed = parseSignedCsrfValue(cookieValue);
+    if (parsed) {
+      return { token: parsed.token };
+    }
+  }
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+  }
+  return null;
+}
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readCsrfCookie(request);
+  if (!cookieValue) {
+    return false;
+  }
+  const parsed = parseSignedCsrfValue(cookieValue);
+  if (!parsed) {
+    return false;
+  }
+  const submittedBuffer = Buffer.from(submittedToken);
+  const expectedBuffer = Buffer.from(parsed.token);
+  if (submittedBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual2(submittedBuffer, expectedBuffer);
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/flashSession.ts
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
+// ../../src/bootstrap/providers/view.ts
+var CORE_VIEW_TOKEN = "core.view";
+var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
+var viewProvider = {
+  name: "view",
+  register({ container, config }) {
+    if (!isViewsEnabled()) {
+      return;
+    }
+    const viewsDirectory = process.env.VIEW_DIRECTORY?.trim() || DEFAULT_VIEWS_DIRECTORY;
+    config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
+    container.set(CORE_VIEW_TOKEN, new EtaViewEngine(viewsDirectory, () => resolveWebLayoutData(container, currentRequestMeta().request)));
+  }
+};
+
+// ../../src/bootstrap/providers/index.ts
+var coreProviders = [
+  config_default,
+  cache_default,
+  auth_default,
+  events_default,
+  policy_default,
+  queue_default,
+  listeners_default,
+  viewProvider
+];
+
+// ../../src/domain/auth.ts
+var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+
+// ../../src/bootstrap/secretsGuard.ts
+var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? appConfig.env;
+  if (appEnv !== "production") {
+    return;
+  }
+  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
+  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  if (devHeadersEnabled) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
+  }
+  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
+  }
+  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+  }
+  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
+  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+  if (corsOrigins.includes("*")) {
+    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+  }
+  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (!env.TOKEN_HASH_PEPPER?.trim()) {
+    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  }
+  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
+    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
+  }
+}
+
+// ../../src/bootstrap/context.ts
+function collectProviders(modules = appModules) {
+  return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
+}
+function runProviderPhase(providers, phase, context) {
+  for (const provider of providers) {
+    provider[phase]?.(context);
+  }
+}
+function createAppContext() {
+  assertProductionSecrets();
+  const container = new ServiceContainer;
+  const config = new ConfigStore;
+  const dependencies = {
+    container
+  };
+  const context = {
+    container,
+    config,
+    dependencies
+  };
+  const providers = collectProviders();
+  runProviderPhase(providers, "register", context);
+  runProviderPhase(providers, "boot", context);
+  assertAppDependenciesComplete(dependencies);
+  const appContext = {
+    container,
+    config,
+    dependencies
+  };
+  setActiveApplicationContext(appContext);
+  return appContext;
+}
+var appContext = createAppContext();
+// ../../src/bootstrap/createWebRoutes.ts
+import { join as join4 } from "path";
+
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
+}
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
+}
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+async function requestIdMiddleware(request, next) {
+  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+  const response = await next();
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+    }
+    return wrapped;
   }
-  if (mode === "spa-react") {
-    return "spa-react";
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
   }
-  return "api";
+  return handler;
 }
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+  }
+  return wrapped;
 }
 
 // ../../src/config/rateLimit.ts
@@ -186,79 +4194,16 @@ function resolveLoginRateLimit() {
     decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
   };
 }
-
-// ../../src/core/auth/membershipContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var activeConnection = new AsyncLocalStorage;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
 }
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 
 // ../../src/modules/organization/memberRepository.ts
 class OrganizationMemberRepository {
@@ -311,45 +4256,6 @@ class OrganizationMemberRepository {
 }
 var memberRepository_default = OrganizationMemberRepository;
 
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
-// ../../src/core/auth/authContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var authContext = new AsyncLocalStorage2;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
 // ../../src/core/auth/accessControl.ts
 function isGlobalAdmin(user) {
   return user?.role === "admin";
@@ -363,7 +4269,7 @@ function resolveUserId(user) {
 }
 
 // ../../src/core/auth/membershipContext.ts
-var membershipContext = new AsyncLocalStorage3;
+var membershipContext = new AsyncLocalStorage4;
 var membershipRepository = new memberRepository_default;
 async function runWithMembershipContext(callback) {
   const user = currentAuthUser();
@@ -462,173 +4368,42 @@ var corsConfig = {
     "X-Authenticated-User-Role",
     "If-Match",
     "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-
-// ../../src/core/http/corsMiddleware.ts
-function createCorsMiddleware() {
-  return async (request, next) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders(request)
-      });
-    }
-    const response = await next();
-    const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
-      headers.set(key, value);
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-function buildCorsHeaders(request) {
-  const headers = new Headers;
-  const origin = request.headers.get("origin");
-  const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
-  headers.set("Access-Control-Allow-Origin", allowOrigin);
-  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
-  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
-  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
-  return headers;
-}
-
-// ../../src/core/http/csrfToken.ts
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-
-// ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage4;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
-}
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  return { token, issuedAt };
-}
-function createCsrfTokenCookie() {
-  const token = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
-  return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
+  ],
+  maxAgeSeconds: 86400
+};
+
+// ../../src/core/http/corsMiddleware.ts
+function createCorsMiddleware() {
+  return async (request, next) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request)
+      });
     }
-  }
-  return createCsrfTokenCookie();
-}
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request)) {
+      headers.set(key, value);
     }
-  }
-  return null;
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
 }
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readCsrfCookie(request);
-  if (!cookieValue) {
-    return false;
-  }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
-    return false;
-  }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(submittedBuffer, expectedBuffer);
+function buildCorsHeaders(request) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const allowedOrigins = corsConfig.allowedOrigins;
+  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  headers.set("Vary", "Origin");
+  return headers;
 }
 
 // ../../src/core/http/csrfMiddleware.ts
@@ -663,90 +4438,6 @@ function createCsrfMiddleware() {
   };
 }
 
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac2("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
 // ../../src/core/http/flashMiddleware.ts
 function createFlashMiddleware() {
   return async (request, next) => {
@@ -763,7 +4454,7 @@ function createFlashMiddleware() {
 }
 
 // ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient } = globalThis.Bun;
+var {RedisClient: RedisClient3 } = globalThis.Bun;
 function resolveLoginIdentity(request) {
   return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
 }
@@ -782,7 +4473,7 @@ async function resolveLoginEmail(request) {
   }
 }
 function createLoginThrottleMiddleware(options) {
-  const client = new RedisClient(options.redisUrl);
+  const client = new RedisClient3(options.redisUrl);
   const prefix = options.keyPrefix ?? "workhub:login-throttle:";
   return async (request, next) => {
     const identity = resolveLoginIdentity(request);
@@ -918,38 +4609,6 @@ function createMetricsMiddleware() {
   };
 }
 
-// ../../src/core/http/middleware.ts
-function composeMiddleware(...middleware) {
-  return (handler) => {
-    return async (request) => {
-      let index = 0;
-      const dispatch = async () => {
-        if (index >= middleware.length) {
-          return await handler(request);
-        }
-        const current = middleware[index];
-        index += 1;
-        if (!current) {
-          return await handler(request);
-        }
-        return await current(request, dispatch);
-      };
-      return await dispatch();
-    };
-  };
-}
-async function requestIdMiddleware(request, next) {
-  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-  const response = await next();
-  const headers = new Headers(response.headers);
-  headers.set("x-request-id", requestId);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
 // ../../src/core/http/requireAbilityMiddleware.ts
 function createRequireAbilityMiddleware(abilityChecker) {
   return (ability) => {
@@ -980,7 +4639,7 @@ function createRequireAuthMiddleware(auth) {
 }
 
 // ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
+function logSecurityEvent2(event, details = {}) {
   const meta = currentRequestMeta();
   const user = currentAuthUser();
   console.log(JSON.stringify({
@@ -999,7 +4658,7 @@ function createRequireGlobalAdminMiddleware() {
   return async (_request, next) => {
     const user = currentAuthUser();
     if (!isGlobalAdmin(user)) {
-      logSecurityEvent("privilege_escalation_blocked", {
+      logSecurityEvent2("privilege_escalation_blocked", {
         required_role: "platform_admin",
         path: new URL(_request.url).pathname
       });
@@ -1056,15 +4715,6 @@ function withMiddleware(...middleware) {
   };
 }
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
 // ../../src/config/contentSecurityPolicy.ts
 function strictApiContentSecurityPolicy() {
   return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
@@ -1131,7 +4781,7 @@ function createSecurityHeadersMiddleware() {
 }
 
 // ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
+var {RedisClient: RedisClient4 } = globalThis.Bun;
 
 // ../../src/core/tenant/tenantContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
@@ -1165,7 +4815,7 @@ function resolveThrottleIdentity(request) {
   return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
 }
 function createThrottleMiddleware(options) {
-  const client = new RedisClient2(options.redisUrl);
+  const client = new RedisClient4(options.redisUrl);
   const prefix = options.keyPrefix ?? "workhub:throttle:";
   return async (request, next) => {
     const identity = resolveThrottleIdentity(request);
@@ -1212,42 +4862,11 @@ function createRequestLoggingMiddleware() {
   };
 }
 
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
 // ../../src/core/security/publicReads.ts
 function isPublicReadsEnabled() {
   return isFeatureEnabled("publicReads");
 }
 
-// ../../src/core/tenant/databaseTenantContext.ts
-async function runWithMigrationBypass(callback) {
-  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
-  }
-}
-
 // ../../src/core/tenant/resolveTenant.ts
 async function resolveTenant(tenantId) {
   const rows = await connection_default`
@@ -1543,29 +5162,41 @@ class HttpKernel {
     return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
   }
   wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
     const middleware = [];
-    const loginRateLimit = resolveLoginRateLimit();
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
     if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
       const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
       const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
       if (redisUrl) {
-        middleware.push(createLoginThrottleMiddleware({
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
           redisUrl,
-          maxAttempts: loginRateLimit.maxAttempts,
-          decaySeconds: loginRateLimit.decaySeconds
-        }));
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
       } else {
         middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: loginRateLimit.maxAttempts,
-          decaySeconds: loginRateLimit.decaySeconds,
-          keyPrefix: "workhub:login-throttle:"
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
         }));
       }
     } else {
       middleware.push(createMemoryThrottleMiddleware({
-        maxAttempts: loginRateLimit.maxAttempts,
-        decaySeconds: loginRateLimit.decaySeconds,
-        keyPrefix: "workhub:login-throttle:"
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
       }));
     }
     if (middleware.length === 0) {
@@ -1577,6 +5208,82 @@ class HttpKernel {
 function createHttpKernel(dependencies) {
   return new HttpKernel(dependencies);
 }
+
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var routeRegistry = new RouteRegistry;
+
+// ../../src/bootstrap/createWebRoutes.ts
+function registerRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function registerRouteMap(routes, middleware) {
+  const registered = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methodMap = handler;
+      registered[path] = methodMap;
+      for (const method of Object.keys(methodMap)) {
+        registerRoute(method.toUpperCase(), path, middleware);
+      }
+      continue;
+    }
+    registered[path] = handler;
+    registerRoute("GET", path, middleware);
+  }
+  return registered;
+}
+function createWebRoutes(dependencies) {
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const moduleRoutes = {
+    "/": () => Response.redirect("/organizations", 302)
+  };
+  registerRoute("GET", "/", ["global", "web"]);
+  for (const module of appModules) {
+    if (!module.webRoutes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.webRoutes({
+      dependencies,
+      cachedJson: async () => htmlResponse(""),
+      kernel
+    }));
+  }
+  const wrappedRoutes = applyMiddlewareToRoutes(registerRouteMap(moduleRoutes, ["global", "web"]), middleware);
+  wrappedRoutes["/assets/*"] = async (request) => {
+    registerRoute("GET", "/assets/*", ["global", "web"]);
+    const pathname = new URL(request.url).pathname;
+    const relativePath = pathname.replace(/^\//, "");
+    const file = Bun.file(join4(process.cwd(), "public", relativePath));
+    if (!await file.exists()) {
+      return htmlResponse("Not Found", { status: 404 });
+    }
+    return new Response(file);
+  };
+  registerRoute("GET", "/assets/*", ["global", "web"]);
+  return wrappedRoutes;
+}
+function mergeWebRoutes(dependencies, routes) {
+  if (!isViewsEnabled()) {
+    return routes;
+  }
+  return {
+    ...createWebRoutes(dependencies),
+    ...routes
+  };
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -1738,16 +5445,26 @@ function slugify(value) {
 export {
   slugify,
   setActiveApplicationContext,
+  scheduleRunCommand,
+  runProviderPhase,
+  runDueScheduledTasks,
   resolveService,
   resolveApplicationQueue,
   prefixRouteMap,
   parseFormBody,
+  mergeWebRoutes,
   getRequiredDependency,
   createWebServer,
+  createWebRoutes,
   createHttpKernel,
   createCsrfProtection,
+  createAppContext,
+  coreProviders,
+  collectProviders,
   assertAppDependenciesComplete,
+  appSchedule,
   ServiceContainer,
+  Schedule,
   REDIS_URL_CONFIG_KEY,
   DEFAULT_APP_PORT,
   DATABASE_URL_CONFIG_KEY,