@getstrata/bootstrap 0.2.22 → 0.2.23

package/dist/index.js

@@ -503,242 +503,624 @@ async function scheduleRunCommand() {
   }
   await runDueScheduledTasks(appSchedule);
 }
-// ../../src/core/contracts/di.ts
-var requiredDependencyKeys = [
-  "container",
-  "cache",
-  "storage"
-];
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-function assertAppDependenciesComplete(dependencies) {
-  for (const key of requiredDependencyKeys) {
-    getRequiredDependency(dependencies, key);
-  }
-}
-function resolveService(dependencies, token) {
-  return dependencies.container.resolve(token);
+// ../../src/bootstrap/applicationRegistry.ts
+import {
+  resolveApplicationAuth,
+  resolveApplicationCache,
+  resolveApplicationConfig,
+  resolveApplicationDependencies,
+  resolveApplicationEventBus,
+  resolveApplicationLogger,
+  resolveApplicationPolicyGate,
+  resolveApplicationQueue,
+  setActiveApplicationContext
+} from "@getstrata/core/runtime/applicationRegistry.ts";
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
 }
 
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_CONFIG_TOKEN = "core.config";
-var CORE_CACHE_TOKEN = "core.cache";
-var CORE_QUEUE_TOKEN = "core.queue";
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
-var CORE_POLICY_GATE_TOKEN = "core.policyGate";
-var CORE_AUTH_TOKEN = "core.auth";
-var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function setActiveApplicationContext(context) {
-  activeContext = context;
-  globalThis[APPLICATION_CONTEXT_KEY] = context;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationQueue() {
-  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
-}
-function resolveApplicationEventBus() {
-  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
 }
-function resolveApplicationAuth() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
 }
-function resolveApplicationPolicyGate() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+function computeEtagFromJson(data) {
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
+  return formatWeakEtag(digest);
 }
-function resolveApplicationConfig() {
-  return requireActiveApplicationContext().config;
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
 }
-function resolveApplicationLogger() {
-  return appLogger;
+function normalizeEtag(value) {
+  return value.trim();
 }
-function resolveApplicationDependencies() {
-  return requireActiveApplicationContext().dependencies;
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
 }
-// ../../src/bootstrap/discoverModules.ts
-import { readdirSync } from "fs";
-import { join } from "path";
-import { pathToFileURL } from "url";
-var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
-function readDiscoverModulesState() {
-  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
-  if (existing) {
-    return existing;
+function parseEtagList(header) {
+  if (!header) {
+    return [];
   }
-  const state = { appModules: [] };
-  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
-  return state;
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
 }
-function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-function resolveModulesDirectory(options) {
-  const state = readDiscoverModulesState();
-  if (options?.modulesDir) {
-    return options.modulesDir;
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
   }
-  if (state.configuredModulesDir) {
-    return state.configuredModulesDir;
+  if (header.trim() === "*") {
+    return true;
   }
-  return join(import.meta.dir, "../modules");
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-async function loadDiscoveredModules(options) {
-  const modulesDirectory = resolveModulesDirectory(options);
-  let moduleNames;
-  try {
-    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return [];
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
     }
-    throw error;
+    return;
   }
-  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
-    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
-    const loaded = await import(moduleUrl);
-    return loaded.default;
-  }));
-  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
-}
-async function ensureModulesLoaded(options) {
-  const state = readDiscoverModulesState();
-  if (state.appModules.length > 0) {
-    return state.appModules;
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
   }
-  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
-    state.appModules.splice(0, state.appModules.length, ...modules);
-    return state.appModules;
-  });
-  return state.modulesReady;
-}
-function discoverModules() {
-  return readDiscoverModulesState().appModules;
 }
-
-// ../../src/bootstrap/cache/modelCacheTags.ts
-function cacheTagsForModelWrite(tableName, action) {
-  const module = discoverModules().find((entry) => entry.tableName === tableName);
-  const baseTags = module?.cacheTags ?? [`${tableName}s`];
-  const isDelete = action === "deleted" || action === "force-deleted";
-  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
-  return [...new Set([...baseTags, ...extraTags])];
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
 }
-function discoverModelTableNames() {
-  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
 }
-// ../../src/bootstrap/config.ts
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-// ../../src/core/contracts/container.ts
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
-  }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
-  }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
   }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
-    }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
-    }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
-    }
-    throw new Error(`Service "${key}" is not registered.`);
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
   }
-  resolve(key) {
-    return this.get(key);
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/conditionalResponse.ts
+function jsonResponse(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
+  });
+}
+function conditionalJsonResponse(request, data, init = {}) {
+  if (!request || !isEtagEnabled()) {
+    return jsonResponse(data, init);
   }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  const etag = computeEtagFromJson(data);
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
   }
+  const response = jsonResponse(data, init);
+  const headers = new Headers(response.headers);
+  headers.set("ETag", etag);
+  headers.set("Cache-Control", "private, must-revalidate");
+  headers.append("Vary", "Authorization");
+  headers.append("Vary", "X-Tenant-Id");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
-  }
-  get(key) {
-    return this.values.get(key);
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
+}
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
   }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
+}
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
     }
-    return this.values.get(key);
+    return wrapped;
   }
-  has(key) {
-    return this.values.has(key);
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
   }
+  return handler;
 }
-// ../../src/config/auth.ts
-var authConfig = {
-  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
-  tokenDefaultAbilities: ["*"]
-};
-
-// ../../src/domain/abilities.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+  }
+  return wrapped;
+}
+
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
+}
+
+// ../../src/bootstrap/config.ts
+import {
+  CORE_AUTH_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens.ts";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
+function readDiscoverModulesState() {
+  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = { appModules: [] };
+  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
+  return state;
+}
+function configureModulesDirectory(modulesDir) {
+  readDiscoverModulesState().configuredModulesDir = modulesDir;
+}
+function resolveModulesDirectory(options) {
+  const state = readDiscoverModulesState();
+  if (options?.modulesDir) {
+    return options.modulesDir;
+  }
+  if (state.configuredModulesDir) {
+    return state.configuredModulesDir;
+  }
+  return join(import.meta.dir, "../modules");
+}
+async function loadDiscoveredModules(options) {
+  const modulesDirectory = resolveModulesDirectory(options);
+  let moduleNames;
+  try {
+    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+async function ensureModulesLoaded(options) {
+  const state = readDiscoverModulesState();
+  if (state.appModules.length > 0) {
+    return state.appModules;
+  }
+  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
+    state.appModules.splice(0, state.appModules.length, ...modules);
+    return state.appModules;
+  });
+  return state.modulesReady;
+}
+function discoverModules() {
+  return readDiscoverModulesState().appModules;
+}
+// ../../src/bootstrap/prefixRouteMap.ts
+function prefixRouteMap(prefix, routes) {
+  const normalizedPrefix = prefix.replace(/\/$/, "");
+  const prefixed = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
+  }
+  return prefixed;
+}
+
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
+
+// ../../src/bootstrap/buildModuleRoutes.ts
+function registerOpenApiRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function registerOpenApiRouteMap(routes, middleware) {
+  const registered = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methodMap = handler;
+      registered[path] = methodMap;
+      for (const method of Object.keys(methodMap)) {
+        registerOpenApiRoute(method.toUpperCase(), path, middleware);
+      }
+      continue;
+    }
+    registered[path] = handler;
+    registerOpenApiRoute("GET", path, middleware);
+  }
+  return registered;
+}
+function createCachedJson(dependencies) {
+  return async (cacheKey, loader, tags = [], request) => {
+    const data = tags.length > 0 ? await dependencies.cache.tags(...tags).remember(cacheKey, loader) : await dependencies.cache.remember(cacheKey, loader);
+    return conditionalJsonResponse(request, data);
+  };
+}
+function buildModuleRoutes(dependencies, options = {}) {
+  const { apiPrefix = "", modules = discoverModules(), clearRegistry = true } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
+  }
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const cachedJson = createCachedJson(dependencies);
+  const moduleRoutes = {};
+  for (const module of modules) {
+    if (!module.routes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.routes({ dependencies, cachedJson, kernel }));
+  }
+  const prefixedModuleRoutes = prefixRouteMap(apiPrefix, moduleRoutes);
+  return applyMiddlewareToRoutes(registerOpenApiRouteMap(prefixedModuleRoutes, ["global", "api"]), middleware);
+}
+// ../../src/bootstrap/cache/modelCacheTags.ts
+function cacheTagsForModelWrite(tableName, action) {
+  const module = discoverModules().find((entry) => entry.tableName === tableName);
+  const baseTags = module?.cacheTags ?? [`${tableName}s`];
+  const isDelete = action === "deleted" || action === "force-deleted";
+  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
+  return [...new Set([...baseTags, ...extraTags])];
+}
+function discoverModelTableNames() {
+  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
+}
+// ../../src/bootstrap/contracts.ts
+import {
+  ConfigStore,
+  ServiceContainer
+} from "@getstrata/core/contracts/container";
+import {
+  assertAppDependenciesComplete,
+  getRequiredDependency,
+  resolveService
+} from "@getstrata/core/contracts/di";
+
+// ../../src/config/auth.ts
+var authConfig = {
+  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
+  tokenDefaultAbilities: ["*"]
+};
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
   "projects:read",
   "projects:create",
   "tasks:read",
@@ -3214,1539 +3596,1268 @@ class Blueprint {
       kind: "fullText"
     });
   }
-  ginIndex(column, name) {
-    this.indexes.push({
-      name,
-      columns: [column],
-      kind: "gin"
-    });
-  }
-}
-// ../../src/core/database/schema/errors.ts
-class UnsupportedSchemaFeatureError extends Error {
-  constructor(feature, driver) {
-    super(`${feature} is not supported for the ${driver} driver`);
-    this.name = "UnsupportedSchemaFeatureError";
-  }
-}
-// ../../src/core/database/schema/grammars/grammar.ts
-function compileColumnType(driver, column) {
-  switch (column.kind) {
-    case "id":
-      return compileIdType(driver);
-    case "string":
-      return compileStringType(driver, column.length);
-    case "text":
-      return compileTextType(driver);
-    case "boolean":
-      return compileBooleanType(driver);
-    case "integer":
-    case "foreignId":
-      return compileIntegerType(driver);
-    case "bigInteger":
-      return compileBigIntegerType(driver);
-    case "timestamp":
-      return compileTimestampType(driver);
-    case "json":
-      return compileJsonType(driver);
-    case "jsonb":
-      return compileJsonbType(driver);
-    default:
-      throw new Error(`Unsupported column kind: ${column.kind}`);
-  }
-}
-function compileIdType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "SERIAL";
-    case "mysql":
-      return "BIGINT UNSIGNED";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileStringType(driver, length) {
-  switch (driver) {
-    case "pgsql":
-      return "TEXT";
-    case "mysql":
-      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileTextType(driver) {
-  switch (driver) {
-    case "pgsql":
-    case "sqlite":
-      return "TEXT";
-    case "mysql":
-      return "TEXT";
-  }
-}
-function compileBooleanType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BOOLEAN";
-    case "mysql":
-      return "BOOLEAN";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "INTEGER";
-    case "mysql":
-      return "INT";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileBigIntegerType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "BIGINT";
-    case "mysql":
-      return "BIGINT";
-    case "sqlite":
-      return "INTEGER";
-  }
-}
-function compileTimestampType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "TIMESTAMPTZ";
-    case "mysql":
-      return "TIMESTAMP";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileJsonType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-function compileJsonbType(driver) {
-  switch (driver) {
-    case "pgsql":
-      return "JSONB";
-    case "mysql":
-      return "JSON";
-    case "sqlite":
-      return "TEXT";
-  }
-}
-
-// ../../src/core/database/schema/grammars/compileStatements.ts
-function compileCreateTable(driver, blueprint) {
-  const table = quoteIdentifier(blueprint.table);
-  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length > 1) {
-      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-      parts.push(`UNIQUE (${columns})`);
-    }
-  }
-  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
-  ${parts.join(`,
-  `)}
-)`];
-  for (const index of blueprint.indexes) {
-    if (index.kind === "unique" && index.columns.length === 1) {
-      continue;
-    }
-    if (index.kind === "index") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
-}
-function compileAlterTable(driver, blueprint) {
-  const statements = [];
-  const table = quoteIdentifier(blueprint.table);
-  for (const column of blueprint.columns) {
-    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
-    statements.push(`ALTER TABLE ${table}
-${addPrefix} ${compileColumn(driver, column, "alter")}`);
-  }
-  for (const columnName of blueprint.droppedColumns) {
-    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
-    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
-  }
-  for (const indexName of blueprint.droppedIndexes) {
-    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
-  }
-  for (const index of blueprint.indexes) {
-    if (index.kind === "index" || index.kind === "unique") {
-      statements.push(compileIndex(driver, blueprint.table, index));
-    } else {
-      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
-    }
-  }
-  return statements;
-}
-function compileDropTable(driver, tableName) {
-  const cascade = driver === "pgsql" ? " CASCADE" : "";
-  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
-}
-function compileColumn(driver, column, mode) {
-  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
-  if (column.autoIncrement && driver === "mysql") {
-    parts[1] = `${parts[1]} AUTO_INCREMENT`;
-  }
-  if (column.isPrimary && mode === "create") {
-    if (driver === "sqlite") {
-      parts.push("PRIMARY KEY AUTOINCREMENT");
-    } else {
-      parts.push("PRIMARY KEY");
-    }
-  } else if (!column.isNullable) {
-    parts.push("NOT NULL");
-  } else if (column.isNullable) {
-    parts.push("NULL");
-  }
-  if (column.defaultValue !== undefined) {
-    parts.push(`DEFAULT ${column.defaultValue}`);
-  }
-  if (column.isUnique) {
-    parts.push("UNIQUE");
-  }
-  if (column.checkExpression) {
-    parts.push(`CHECK (${column.checkExpression})`);
-  }
-  if (column.foreignKey) {
-    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
-    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
-    let clause = `REFERENCES ${reference}`;
-    if (onDelete === "cascade") {
-      clause += " ON DELETE CASCADE";
-    } else if (onDelete === "set null") {
-      clause += " ON DELETE SET NULL";
-    }
-    parts.push(clause);
+  ginIndex(column, name) {
+    this.indexes.push({
+      name,
+      columns: [column],
+      kind: "gin"
+    });
   }
-  return parts.join(" ");
-}
-function compileIndex(_driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
-  const columns = index.columns.map((column) => {
-    const quoted = quoteIdentifier(column);
-    if (index.order === "desc") {
-      return `${quoted} DESC`;
-    }
-    return quoted;
-  }).join(", ");
-  const unique = index.kind === "unique" ? "UNIQUE " : "";
-  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
 }
-function compileSpecialIndex(driver, tableName, index) {
-  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
-  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
-  switch (index.kind) {
-    case "partial":
-    case "uniquePartial": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
-      }
-      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
-      return [
-        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
-      ];
-    }
-    case "gin": {
-      if (driver !== "pgsql") {
-        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
-      }
-      return [
-        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
-      ];
-    }
-    case "fullText": {
-      if (driver === "mysql") {
-        return [
-          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
-        ];
-      }
-      if (driver === "pgsql") {
-        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
-      }
-      throw new UnsupportedSchemaFeatureError("fullText()", driver);
-    }
-    default:
-      return [];
+// ../../src/core/database/schema/errors.ts
+class UnsupportedSchemaFeatureError extends Error {
+  constructor(feature, driver) {
+    super(`${feature} is not supported for the ${driver} driver`);
+    this.name = "UnsupportedSchemaFeatureError";
   }
 }
-function defaultIndexName(tableName, columns, kind) {
-  return `idx_${tableName}_${columns.join("_")}_${kind}`;
-}
-function compileBlueprint(driver, blueprint) {
-  switch (blueprint.action) {
-    case "create":
-      return compileCreateTable(driver, blueprint);
-    case "alter":
-      return compileAlterTable(driver, blueprint);
-    case "drop":
-      return compileDropTable(driver, blueprint.table);
+// ../../src/core/database/schema/grammars/grammar.ts
+function compileColumnType(driver, column) {
+  switch (column.kind) {
+    case "id":
+      return compileIdType(driver);
+    case "string":
+      return compileStringType(driver, column.length);
+    case "text":
+      return compileTextType(driver);
+    case "boolean":
+      return compileBooleanType(driver);
+    case "integer":
+    case "foreignId":
+      return compileIntegerType(driver);
+    case "bigInteger":
+      return compileBigIntegerType(driver);
+    case "timestamp":
+      return compileTimestampType(driver);
+    case "json":
+      return compileJsonType(driver);
+    case "jsonb":
+      return compileJsonbType(driver);
     default:
-      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+      throw new Error(`Unsupported column kind: ${column.kind}`);
   }
 }
-// ../../src/core/database/schema/grammars/createGrammar.ts
-function createGrammar(driver) {
-  return {
-    driver,
-    compile(blueprint) {
-      return compileBlueprint(driver, blueprint);
-    }
-  };
-}
-
-// ../../src/core/database/schema/grammars/mysqlGrammar.ts
-var MySqlGrammar = createGrammar("mysql");
-
-// ../../src/core/database/schema/grammars/postgresGrammar.ts
-var PostgresGrammar = createGrammar("pgsql");
-
-// ../../src/core/database/schema/grammars/sqliteGrammar.ts
-var SqliteGrammar = createGrammar("sqlite");
-
-// ../../src/core/database/schema/grammars/index.ts
-function grammarForDriver(driver) {
+function compileIdType(driver) {
   switch (driver) {
     case "pgsql":
-      return PostgresGrammar;
+      return "SERIAL";
     case "mysql":
-      return MySqlGrammar;
+      return "BIGINT UNSIGNED";
     case "sqlite":
-      return SqliteGrammar;
-    default:
-      throw new Error(`Unsupported database driver: ${driver}`);
+      return "INTEGER";
   }
 }
-// ../../src/core/database/schema/schema.ts
-class SchemaBuilder {
-  #driver;
-  #statements = [];
-  constructor(driver) {
-    this.#driver = driver;
-  }
-  create(table, callback) {
-    const blueprint = new Blueprint(table, "create");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  table(table, callback) {
-    const blueprint = new Blueprint(table, "alter");
-    callback(blueprint);
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  drop(table) {
-    const blueprint = new Blueprint(table, "drop");
-    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
-    return this;
-  }
-  toSql() {
-    return [...this.#statements];
+function compileStringType(driver, length) {
+  switch (driver) {
+    case "pgsql":
+      return "TEXT";
+    case "mysql":
+      return length ? `VARCHAR(${length})` : "VARCHAR(255)";
+    case "sqlite":
+      return "TEXT";
   }
-  async execute(db2) {
-    for (const statement of this.#statements) {
-      await db2.unsafe(statement);
-    }
+}
+function compileTextType(driver) {
+  switch (driver) {
+    case "pgsql":
+    case "sqlite":
+      return "TEXT";
+    case "mysql":
+      return "TEXT";
   }
 }
-// ../../src/core/database/table.ts
-function defineTable5(definition) {
-  return definition;
+function compileBooleanType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BOOLEAN";
+    case "mysql":
+      return "BOOLEAN";
+    case "sqlite":
+      return "INTEGER";
+  }
 }
-// ../../src/core/queue/failedJobTable.ts
-var failedJobTable = defineTable5({
-  name: "failed_job",
-  primaryKey: "id",
-  columns: ["id", "job_name", "payload", "exception", "failed_at"],
-  defaultOrderBy: { column: "failed_at", direction: "DESC" }
-});
-
-// ../../src/core/queue/failedJobRepository.ts
-class FailedJobRepository extends baseRepository_default {
-  constructor() {
-    super(failedJobTable);
+function compileIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "INTEGER";
+    case "mysql":
+      return "INT";
+    case "sqlite":
+      return "INTEGER";
   }
 }
-var failedJobRepository_default = FailedJobRepository;
-
-// ../../src/core/queue/failedJobService.ts
-class FailedJobService {
-  repository;
-  constructor(repository) {
-    this.repository = repository;
+function compileBigIntegerType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "BIGINT";
+    case "mysql":
+      return "BIGINT";
+    case "sqlite":
+      return "INTEGER";
   }
-  async recordFailure(input) {
-    return await this.repository.create({
-      job_name: input.jobName,
-      payload: input.payload,
-      exception: input.exception,
-      failed_at: new Date
-    });
+}
+function compileTimestampType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "TIMESTAMPTZ";
+    case "mysql":
+      return "TIMESTAMP";
+    case "sqlite":
+      return "TEXT";
   }
-  listRecent(limit = 50) {
-    return this.repository.findAll({
-      limit,
-      orderBy: { column: "failed_at", direction: "DESC" }
-    });
+}
+function compileJsonType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
   }
-  async retry(id) {
-    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
-    await this.repository.deleteById(id);
-    return failedJob;
+}
+function compileJsonbType(driver) {
+  switch (driver) {
+    case "pgsql":
+      return "JSONB";
+    case "mysql":
+      return "JSON";
+    case "sqlite":
+      return "TEXT";
   }
-  async delete(id) {
-    const deleted = await this.repository.deleteById(id);
-    if (!deleted) {
-      throw new Error(`Failed job ${id} not found.`);
+}
+
+// ../../src/core/database/schema/grammars/compileStatements.ts
+function compileCreateTable(driver, blueprint) {
+  const table = quoteIdentifier(blueprint.table);
+  const parts = blueprint.columns.map((column) => compileColumn(driver, column, "create"));
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length > 1) {
+      const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+      parts.push(`UNIQUE (${columns})`);
     }
   }
-  async flush() {
-    const jobs = await this.repository.findAll();
-    let deleted = 0;
-    for (const job of jobs) {
-      if (await this.repository.deleteById(job.id)) {
-        deleted += 1;
-      }
+  const statements = [`CREATE TABLE IF NOT EXISTS ${table} (
+  ${parts.join(`,
+  `)}
+)`];
+  for (const index of blueprint.indexes) {
+    if (index.kind === "unique" && index.columns.length === 1) {
+      continue;
+    }
+    if (index.kind === "index") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else if (index.kind === "partial" || index.kind === "uniquePartial" || index.kind === "gin" || index.kind === "fullText") {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
     }
-    return deleted;
   }
+  return statements;
 }
-var failedJobService_default = FailedJobService;
-
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
+function compileAlterTable(driver, blueprint) {
+  const statements = [];
+  const table = quoteIdentifier(blueprint.table);
+  for (const column of blueprint.columns) {
+    const addPrefix = driver === "pgsql" ? "ADD COLUMN IF NOT EXISTS" : "ADD COLUMN";
+    statements.push(`ALTER TABLE ${table}
+${addPrefix} ${compileColumn(driver, column, "alter")}`);
   }
-  resolveName(job) {
-    return this.instances.get(job);
+  for (const columnName of blueprint.droppedColumns) {
+    const dropPrefix = driver === "pgsql" ? "DROP COLUMN IF EXISTS" : "DROP COLUMN";
+    statements.push(`ALTER TABLE ${table} ${dropPrefix} ${quoteIdentifier(columnName)}`);
   }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
+  for (const indexName of blueprint.droppedIndexes) {
+    statements.push(`DROP INDEX IF EXISTS ${quoteIdentifier(indexName)}`);
   }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
+  for (const index of blueprint.indexes) {
+    if (index.kind === "index" || index.kind === "unique") {
+      statements.push(compileIndex(driver, blueprint.table, index));
+    } else {
+      statements.push(...compileSpecialIndex(driver, blueprint.table, index));
     }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
   }
+  return statements;
 }
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
+function compileDropTable(driver, tableName) {
+  const cascade = driver === "pgsql" ? " CASCADE" : "";
+  return [`DROP TABLE IF EXISTS ${quoteIdentifier(tableName)}${cascade}`];
 }
-var jobRegistry = readSharedJobRegistry();
-
-// ../../src/core/queue/jobRunner.ts
-async function runQueueJob(envelope, failedJobs) {
-  const job = jobRegistry.create(envelope.name);
-  if (!job) {
-    throw new Error(`Unknown job "${envelope.name}".`);
+function compileColumn(driver, column, mode) {
+  const parts = [quoteIdentifier(column.name), compileColumnType(driver, column)];
+  if (column.autoIncrement && driver === "mysql") {
+    parts[1] = `${parts[1]} AUTO_INCREMENT`;
   }
-  const attempts = envelope.attempts ?? 0;
-  try {
-    await job.handle(envelope.payload);
-  } catch (error) {
-    const nextAttempt = attempts + 1;
-    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
-    if (nextAttempt < maxAttempts) {
-      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
-      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
-      await runQueueJob({
-        ...envelope,
-        attempts: nextAttempt
-      }, failedJobs);
-      return;
+  if (column.isPrimary && mode === "create") {
+    if (driver === "sqlite") {
+      parts.push("PRIMARY KEY AUTOINCREMENT");
+    } else {
+      parts.push("PRIMARY KEY");
     }
-    await failedJobs.recordFailure({
-      jobName: envelope.name,
-      payload: envelope.payload,
-      exception: error instanceof Error ? error.stack ?? error.message : String(error)
-    });
-    throw error;
+  } else if (!column.isNullable) {
+    parts.push("NOT NULL");
+  } else if (column.isNullable) {
+    parts.push("NULL");
   }
-}
-
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
-function queueKeyForPriority(priority = "default") {
-  switch (priority) {
-    case "high":
-      return QUEUE_HIGH_KEY;
-    case "low":
-      return QUEUE_LOW_KEY;
-    default:
-      return QUEUE_LIST_KEY;
+  if (column.defaultValue !== undefined) {
+    parts.push(`DEFAULT ${column.defaultValue}`);
   }
-}
-class RedisQueue {
-  client;
-  constructor(redisUrl) {
-    this.client = new RedisClient2(redisUrl);
+  if (column.isUnique) {
+    parts.push("UNIQUE");
   }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
+  if (column.checkExpression) {
+    parts.push(`CHECK (${column.checkExpression})`);
+  }
+  if (column.foreignKey) {
+    const { referencesTable, referencesColumn, onDelete } = column.foreignKey;
+    const reference = `${quoteIdentifier(referencesTable)}(${quoteIdentifier(referencesColumn)})`;
+    let clause = `REFERENCES ${reference}`;
+    if (onDelete === "cascade") {
+      clause += " ON DELETE CASCADE";
+    } else if (onDelete === "set null") {
+      clause += " ON DELETE SET NULL";
     }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    const queueKey = queueKeyForPriority(job.priority);
-    await this.client.lpush(queueKey, JSON.stringify(envelope));
+    parts.push(clause);
   }
+  return parts.join(" ");
 }
-
-// ../../src/core/queue/resilientQueue.ts
-class ResilientQueue {
-  failedJobs;
-  asyncDispatch;
-  constructor(failedJobs, asyncDispatch = false) {
-    this.failedJobs = failedJobs;
-    this.asyncDispatch = asyncDispatch;
-  }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
+function compileIndex(_driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind === "unique" ? "unique" : "index");
+  const columns = index.columns.map((column) => {
+    const quoted = quoteIdentifier(column);
+    if (index.order === "desc") {
+      return `${quoted} DESC`;
     }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    if (this.asyncDispatch) {
-      setTimeout(() => {
-        runQueueJob(envelope, this.failedJobs).catch((error) => {
-          console.error("[ResilientQueue] Job failed:", error);
-        });
-      }, 0);
-      return;
+    return quoted;
+  }).join(", ");
+  const unique = index.kind === "unique" ? "UNIQUE " : "";
+  return `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`;
+}
+function compileSpecialIndex(driver, tableName, index) {
+  const indexName = index.name ?? defaultIndexName(tableName, index.columns, index.kind);
+  const columns = index.columns.map((column) => quoteIdentifier(column)).join(", ");
+  switch (index.kind) {
+    case "partial":
+    case "uniquePartial": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("partialIndex()", driver);
+      }
+      const unique = index.kind === "uniquePartial" ? "UNIQUE " : "";
+      return [
+        `CREATE ${unique}INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns}) WHERE ${index.where}`
+      ];
+    }
+    case "gin": {
+      if (driver !== "pgsql") {
+        throw new UnsupportedSchemaFeatureError("ginIndex()", driver);
+      }
+      return [
+        `CREATE INDEX IF NOT EXISTS ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)} USING GIN(${columns})`
+      ];
+    }
+    case "fullText": {
+      if (driver === "mysql") {
+        return [
+          `CREATE FULLTEXT INDEX ${quoteIdentifier(indexName)} ON ${quoteIdentifier(tableName)}(${columns})`
+        ];
+      }
+      if (driver === "pgsql") {
+        throw new UnsupportedSchemaFeatureError("fullText(); use ginIndex() with a tsvector column on PostgreSQL", driver);
+      }
+      throw new UnsupportedSchemaFeatureError("fullText()", driver);
     }
-    await runQueueJob(envelope, this.failedJobs);
+    default:
+      return [];
   }
 }
-
-// ../../src/core/queue/publicQueue.ts
-function createFailedJobService() {
-  return new failedJobService_default(new failedJobRepository_default);
+function defaultIndexName(tableName, columns, kind) {
+  return `idx_${tableName}_${columns.join("_")}_${kind}`;
 }
-function createTrackedJob(name, job) {
-  return jobRegistry.track(name, job);
+function compileBlueprint(driver, blueprint) {
+  switch (blueprint.action) {
+    case "create":
+      return compileCreateTable(driver, blueprint);
+    case "alter":
+      return compileAlterTable(driver, blueprint);
+    case "drop":
+      return compileDropTable(driver, blueprint.table);
+    default:
+      throw new Error(`Unsupported blueprint action: ${blueprint.action}`);
+  }
 }
-function createProductionQueue(driver, options = {}) {
-  options.registerJobs?.();
-  const failedJobs = options.failedJobs ?? createFailedJobService();
-  if (driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+// ../../src/core/database/schema/grammars/createGrammar.ts
+function createGrammar(driver) {
+  return {
+    driver,
+    compile(blueprint) {
+      return compileBlueprint(driver, blueprint);
     }
-    return new RedisQueue(options.redisUrl);
-  }
-  return new ResilientQueue(failedJobs, driver === "async");
+  };
 }
 
-// ../../src/core/queue/createAppQueue.ts
-var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
-function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
-  return createProductionQueue(driver, {
-    redisUrl,
-    failedJobs,
-    registerJobs
-  });
-}
+// ../../src/core/database/schema/grammars/mysqlGrammar.ts
+var MySqlGrammar = createGrammar("mysql");
 
-// ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
-var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
-function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
-  for (const tableName of discoverModelTableNames()) {
-    for (const action of MODEL_WRITE_ACTIONS) {
-      bus.listen(modelEventName(tableName, action), async () => {
-        const tags = cacheTagsForModelWrite(tableName, action);
-        if (tags.length === 0) {
-          return;
-        }
-        let cache;
-        let queue;
-        try {
-          cache = resolveApplicationCache();
-          queue = resolveApplicationQueue();
-        } catch {
-          return;
-        }
-        const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
-        await queue.dispatch(job, { tags });
-      });
-    }
-  }
-}
+// ../../src/core/database/schema/grammars/postgresGrammar.ts
+var PostgresGrammar = createGrammar("pgsql");
 
-// ../../src/bootstrap/providers/listeners.ts
-var registeredListenerGroups = new Set;
-function registerListenerGroup(name, register) {
-  if (registeredListenerGroups.has(name)) {
-    return;
+// ../../src/core/database/schema/grammars/sqliteGrammar.ts
+var SqliteGrammar = createGrammar("sqlite");
+
+// ../../src/core/database/schema/grammars/index.ts
+function grammarForDriver(driver) {
+  switch (driver) {
+    case "pgsql":
+      return PostgresGrammar;
+    case "mysql":
+      return MySqlGrammar;
+    case "sqlite":
+      return SqliteGrammar;
+    default:
+      throw new Error(`Unsupported database driver: ${driver}`);
   }
-  registeredListenerGroups.add(name);
-  register();
 }
-var listenersProvider = {
-  name: "core.listeners",
-  boot() {
-    registerListenerGroup("cache.invalidate-on-model-write", () => {
-      registerInvalidateCacheOnModelWriteListeners();
-    });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
-    }
+// ../../src/core/database/schema/schema.ts
+class SchemaBuilder {
+  #driver;
+  #statements = [];
+  constructor(driver) {
+    this.#driver = driver;
   }
-};
-var listeners_default = listenersProvider;
-
-// ../../src/core/auth/policy.ts
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
-
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
+  create(table, callback) {
+    const blueprint = new Blueprint(table, "create");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
-    }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  table(table, callback) {
+    const blueprint = new Blueprint(table, "alter");
+    callback(blueprint);
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
+  drop(table) {
+    const blueprint = new Blueprint(table, "drop");
+    this.#statements.push(...grammarForDriver(this.#driver).compile(blueprint));
+    return this;
   }
-}
-
-// ../../src/bootstrap/providers/policy.ts
-var policyProvider = {
-  name: "core.policy",
-  register({ container }) {
-    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate);
+  toSql() {
+    return [...this.#statements];
   }
-};
-var policy_default = policyProvider;
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac as createHmac2 } from "crypto";
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
+  async execute(db2) {
+    for (const statement of this.#statements) {
+      await db2.unsafe(statement);
     }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
   }
 }
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/bootstrap/queue/defaultJobs.ts
-function registerDefaultJobs() {
-  jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache());
-  });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
-}
-
-// ../../src/bootstrap/providers/queue.ts
-var queueProvider = {
-  name: "core.queue",
-  register({ container, config }) {
-    const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
-    const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
-    config.set("queue.driver", driver);
-    const failedJobs = createFailedJobService();
-    container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
-    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs, registerDefaultJobs));
-  }
-};
-var queue_default = queueProvider;
+// ../../src/core/database/table.ts
+function defineTable5(definition) {
+  return definition;
+}
+// ../../src/core/queue/failedJobTable.ts
+var failedJobTable = defineTable5({
+  name: "failed_job",
+  primaryKey: "id",
+  columns: ["id", "job_name", "payload", "exception", "failed_at"],
+  defaultOrderBy: { column: "failed_at", direction: "DESC" }
+});
 
-// ../../src/core/storage/storage.ts
-import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join3 } from "path";
-var {S3Client } = globalThis.Bun;
+// ../../src/core/queue/failedJobRepository.ts
+class FailedJobRepository extends baseRepository_default {
+  constructor() {
+    super(failedJobTable);
+  }
+}
+var failedJobRepository_default = FailedJobRepository;
 
-class LocalStorageDriver {
-  rootDirectory;
-  constructor(rootDirectory) {
-    this.rootDirectory = rootDirectory;
+// ../../src/core/queue/failedJobService.ts
+class FailedJobService {
+  repository;
+  constructor(repository) {
+    this.repository = repository;
   }
-  resolveRootDirectory() {
-    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  async recordFailure(input) {
+    return await this.repository.create({
+      job_name: input.jobName,
+      payload: input.payload,
+      exception: input.exception,
+      failed_at: new Date
+    });
   }
-  resolvePath(path) {
-    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+  listRecent(limit = 50) {
+    return this.repository.findAll({
+      limit,
+      orderBy: { column: "failed_at", direction: "DESC" }
+    });
   }
-  async put(path, contents) {
-    const absolutePath = this.resolvePath(path);
-    await mkdir(dirname(absolutePath), { recursive: true });
-    await writeFile(absolutePath, contents);
-    return path;
+  async retry(id) {
+    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
+    await this.repository.deleteById(id);
+    return failedJob;
   }
-  async get(path) {
-    try {
-      return await readFile(this.resolvePath(path));
-    } catch {
-      return null;
+  async delete(id) {
+    const deleted = await this.repository.deleteById(id);
+    if (!deleted) {
+      throw new Error(`Failed job ${id} not found.`);
     }
   }
-  async delete(path) {
-    try {
-      await unlink(this.resolvePath(path));
-      return true;
-    } catch {
-      return false;
+  async flush() {
+    const jobs = await this.repository.findAll();
+    let deleted = 0;
+    for (const job of jobs) {
+      if (await this.repository.deleteById(job.id)) {
+        deleted += 1;
+      }
     }
+    return deleted;
   }
 }
+var failedJobService_default = FailedJobService;
 
-class S3StorageDriver {
-  client;
-  constructor(client) {
-    this.client = client;
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
   }
-  async put(path, contents) {
-    await this.client.write(path.replace(/^\/+/, ""), contents);
-    return path;
+  resolveName(job) {
+    return this.instances.get(job);
   }
-  async get(path) {
-    const normalizedPath = path.replace(/^\/+/, "");
-    const file = this.client.file(normalizedPath);
-    if (!await file.exists()) {
-      return null;
-    }
-    return new Uint8Array(await file.arrayBuffer());
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
   }
-  async delete(path) {
-    try {
-      await this.client.unlink(path.replace(/^\/+/, ""));
-      return true;
-    } catch {
-      return false;
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
     }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
   }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
 }
+var jobRegistry = readSharedJobRegistry();
 
-class StorageManager {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
+// ../../src/core/queue/jobRunner.ts
+async function runQueueJob(envelope, failedJobs) {
+  const job = jobRegistry.create(envelope.name);
+  if (!job) {
+    throw new Error(`Unknown job "${envelope.name}".`);
   }
-  put(path, contents) {
-    return this.driver.put(path, contents);
+  const attempts = envelope.attempts ?? 0;
+  try {
+    await job.handle(envelope.payload);
+  } catch (error) {
+    const nextAttempt = attempts + 1;
+    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
+    if (nextAttempt < maxAttempts) {
+      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
+      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
+      await runQueueJob({
+        ...envelope,
+        attempts: nextAttempt
+      }, failedJobs);
+      return;
+    }
+    await failedJobs.recordFailure({
+      jobName: envelope.name,
+      payload: envelope.payload,
+      exception: error instanceof Error ? error.stack ?? error.message : String(error)
+    });
+    throw error;
   }
-  get(path) {
-    return this.driver.get(path);
+}
+
+// ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+var QUEUE_LIST_KEY = "workhub:queue:default";
+var QUEUE_HIGH_KEY = "workhub:queue:high";
+var QUEUE_LOW_KEY = "workhub:queue:low";
+function queueKeyForPriority(priority = "default") {
+  switch (priority) {
+    case "high":
+      return QUEUE_HIGH_KEY;
+    case "low":
+      return QUEUE_LOW_KEY;
+    default:
+      return QUEUE_LIST_KEY;
   }
-  delete(path) {
-    return this.driver.delete(path);
+}
+class RedisQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient2(redisUrl);
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    const queueKey = queueKeyForPriority(job.priority);
+    await this.client.lpush(queueKey, JSON.stringify(envelope));
   }
 }
-function resolveS3Config() {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
-  const bucket = process.env.AWS_BUCKET?.trim();
-  if (!accessKeyId || !secretAccessKey || !bucket) {
-    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+
+// ../../src/core/queue/resilientQueue.ts
+class ResilientQueue {
+  failedJobs;
+  asyncDispatch;
+  constructor(failedJobs, asyncDispatch = false) {
+    this.failedJobs = failedJobs;
+    this.asyncDispatch = asyncDispatch;
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    if (this.asyncDispatch) {
+      setTimeout(() => {
+        runQueueJob(envelope, this.failedJobs).catch((error) => {
+          console.error("[ResilientQueue] Job failed:", error);
+        });
+      }, 0);
+      return;
+    }
+    await runQueueJob(envelope, this.failedJobs);
   }
-  return {
-    accessKeyId,
-    secretAccessKey,
-    bucket,
-    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
-    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
-  };
 }
-function createS3Client(config = resolveS3Config()) {
-  return new S3Client({
-    accessKeyId: config.accessKeyId,
-    secretAccessKey: config.secretAccessKey,
-    bucket: config.bucket,
-    ...config.region ? { region: config.region } : {},
-    ...config.endpoint ? { endpoint: config.endpoint } : {}
-  });
+
+// ../../src/core/queue/publicQueue.ts
+function createFailedJobService() {
+  return new failedJobService_default(new failedJobRepository_default);
 }
-function createStorageDriver() {
-  const driver = process.env.STORAGE_DRIVER ?? "local";
-  if (driver === "s3") {
-    return new S3StorageDriver(createS3Client());
+function createTrackedJob(name, job) {
+  return jobRegistry.track(name, job);
+}
+function createProductionQueue(driver, options = {}) {
+  options.registerJobs?.();
+  const failedJobs = options.failedJobs ?? createFailedJobService();
+  if (driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new RedisQueue(options.redisUrl);
   }
-  return new LocalStorageDriver;
+  return new ResilientQueue(failedJobs, driver === "async");
 }
 
-// ../../src/bootstrap/providers/storage.ts
-var storageProvider = {
-  name: "core.storage",
-  register({ dependencies }) {
-    dependencies.storage = new StorageManager(createStorageDriver());
-  }
-};
-var storage_default = storageProvider;
+// ../../src/core/queue/createAppQueue.ts
+var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
+  return createProductionQueue(driver, {
+    redisUrl,
+    failedJobs,
+    registerJobs
+  });
+}
 
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
+// ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
+var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
+function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
+  for (const tableName of discoverModelTableNames()) {
+    for (const action of MODEL_WRITE_ACTIONS) {
+      bus.listen(modelEventName(tableName, action), async () => {
+        const tags = cacheTagsForModelWrite(tableName, action);
+        if (tags.length === 0) {
+          return;
+        }
+        let cache;
+        let queue;
+        try {
+          cache = resolveApplicationCache();
+          queue = resolveApplicationQueue();
+        } catch {
+          return;
+        }
+        const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
+        await queue.dispatch(job, { tags });
+      });
+    }
   }
-  return "api";
-}
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
 }
 
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
+// ../../src/bootstrap/providers/listeners.ts
+var registeredListenerGroups = new Set;
+function registerListenerGroup(name, register) {
+  if (registeredListenerGroups.has(name)) {
+    return;
+  }
+  registeredListenerGroups.add(name);
+  register();
 }
+var listenersProvider = {
+  name: "core.listeners",
+  boot() {
+    registerListenerGroup("cache.invalidate-on-model-write", () => {
+      registerInvalidateCacheOnModelWriteListeners();
+    });
+    for (const [index, registerListener] of discoverListeners().entries()) {
+      registerListenerGroup(`app.listener.${index}`, registerListener);
+    }
+  }
+};
+var listeners_default = listenersProvider;
 
-// ../../src/core/view/etaViewEngine.ts
-import { join as join4 } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
+// ../../src/core/auth/policy.ts
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
 
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
   }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
     }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
     }
-  });
-}
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
     }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
   }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
   }
-  return null;
 }
 
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
+// ../../src/bootstrap/providers/policy.ts
+var policyProvider = {
+  name: "core.policy",
+  register({ container }) {
+    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate);
+  }
+};
+var policy_default = policyProvider;
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac as createHmac2 } from "crypto";
+class DispatchWebhookJob extends Job {
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await repositoryConnection`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac2("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      }, { allowHttp: appConfig.env !== "production" });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await repositoryConnection`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await repositoryConnection`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
   }
-  return createCsrfTokenCookie();
 }
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/core/contracts/di.ts
+function getRequiredDependency2(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
   }
-  return resolveCsrfToken(request).token;
+  return dependency;
 }
 
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_POLICY_GATE_TOKEN2 = "core.policyGate";
+var CORE_AUTH_TOKEN2 = "core.auth";
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
   }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
   }
-  return null;
+  return activeContext;
 }
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
   }
+  return context;
 }
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
+function resolveApplicationCache2() {
+  return getRequiredDependency2(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationAuth2() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN2);
+}
+function resolveApplicationPolicyGate2() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN2);
+}
+function resolveApplicationDependencies2() {
+  return requireActiveApplicationContext().dependencies;
 }
 
-// ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return { authUser: null, csrfToken, flash };
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
-  }
-  if (!container.has(tokenServiceToken)) {
-    return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  }
-  const tokenService = container.resolve(tokenServiceToken);
-  try {
-    const user = await tokenService.findByIdOrThrow(userId);
-    return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  } catch {
-    return { authUser: null, csrfToken, flash };
-  }
+// ../../src/bootstrap/queue/defaultJobs.ts
+function registerDefaultJobs() {
+  jobRegistry.register("cache.invalidate-tags", () => {
+    return new invalidateCacheTagsJob_default(resolveApplicationCache2());
+  });
+  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
 }
-// ../../src/bootstrap/providers/view.ts
-var CORE_VIEW_TOKEN = "core.view";
-var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
-var viewProvider = {
-  name: "view",
+
+// ../../src/bootstrap/providers/queue.ts
+var queueProvider = {
+  name: "core.queue",
   register({ container, config }) {
-    if (!isViewsEnabled()) {
-      return;
-    }
-    const viewsDirectory = process.env.VIEW_DIRECTORY?.trim() || DEFAULT_VIEWS_DIRECTORY;
-    config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
-    container.set(CORE_VIEW_TOKEN, new EtaViewEngine(viewsDirectory, () => resolveWebLayoutData(container, currentRequestMeta().request)));
+    const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
+    const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
+    config.set("queue.driver", driver);
+    const failedJobs = createFailedJobService();
+    container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
+    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs, registerDefaultJobs));
   }
 };
+var queue_default = queueProvider;
 
-// ../../src/bootstrap/providers/index.ts
-var coreProviders = [
-  config_default,
-  cache_default,
-  storage_default,
-  auth_default,
-  events_default,
-  policy_default,
-  queue_default,
-  listeners_default,
-  viewProvider
-];
-
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+var {S3Client } = globalThis.Bun;
 
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
-  if (appEnv !== "production") {
-    return;
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
   }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
   }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
+  resolvePath(path) {
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
   }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
   }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
   }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
   }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  put(path, contents) {
+    return this.driver.put(path, contents);
   }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  get(path) {
+    return this.driver.get(path);
   }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  delete(path) {
+    return this.driver.delete(path);
   }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
   }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
 }
-
-// ../../src/bootstrap/context.ts
-function collectProviders(modules = discoverModules()) {
-  return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
 }
-function runProviderPhase(providers, phase, context) {
-  for (const provider of providers) {
-    provider[phase]?.(context);
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
   }
+  return new LocalStorageDriver;
 }
-function createAppContext() {
-  assertProductionSecrets();
-  const container = new ServiceContainer;
-  const config = new ConfigStore;
-  const dependencies = {
-    container
-  };
-  const context = {
-    container,
-    config,
-    dependencies
-  };
-  const providers = collectProviders();
-  runProviderPhase(providers, "register", context);
-  runProviderPhase(providers, "boot", context);
-  assertAppDependenciesComplete(dependencies);
-  const appContext = {
-    container,
-    config,
-    dependencies
+
+// ../../src/bootstrap/providers/storage.ts
+var storageProvider = {
+  name: "core.storage",
+  register({ dependencies }) {
+    dependencies.storage = new StorageManager(createStorageDriver());
+  }
+};
+var storage_default = storageProvider;
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
   };
-  setActiveApplicationContext(appContext);
-  return appContext;
 }
-// ../../src/bootstrap/createWebRoutes.ts
-import { join as join5 } from "path";
 
-// ../../src/core/http/middleware.ts
-function isRouteHandler(value) {
-  return typeof value === "function";
-}
-function isMethodRouteMap(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
+// ../../src/core/view/etaViewEngine.ts
+import { join as join4 } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
   }
-  const entries = Object.entries(value);
-  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
 }
-function composeMiddleware(...middleware) {
-  return (handler) => {
-    return async (request) => {
-      let index = 0;
-      const dispatch = async () => {
-        if (index >= middleware.length) {
-          return await handler(request);
-        }
-        const current = middleware[index];
-        index += 1;
-        if (!current) {
-          return await handler(request);
-        }
-        return await current(request, dispatch);
-      };
-      return await dispatch();
-    };
-  };
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
 }
-function wrapRouteHandler(handler, middleware) {
-  if (isMethodRouteMap(handler)) {
-    const wrapped = {};
-    for (const [method, routeHandler] of Object.entries(handler)) {
-      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
     }
-    return wrapped;
-  }
-  if (isRouteHandler(handler)) {
-    return composeMiddleware(...middleware)(handler);
   }
-  return handler;
-}
-function applyMiddlewareToRoutes(routes, middleware) {
-  const wrapped = {};
-  for (const [path, routeHandler] of Object.entries(routes)) {
-    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
   }
-  return wrapped;
-}
-
-// ../../src/bootstrap/httpKernel.ts
-import {
-  createAuthMiddleware,
-  createAuthorizeMiddleware,
-  createBodySizeLimitMiddleware,
-  createCorsMiddleware,
-  createCsrfMiddleware,
-  createFlashMiddleware,
-  createLoginThrottleMiddleware,
-  createMembershipMiddleware,
-  createMemoryThrottleMiddleware,
-  createMetricsMiddleware,
-  createRequestLoggingMiddleware,
-  createRequireAbilityMiddleware,
-  createRequireAuthMiddleware,
-  createRequireGlobalAdminMiddleware,
-  createRequireWebAuthMiddleware,
-  createSecurityHeadersMiddleware,
-  createTenantMiddleware,
-  createThrottleMiddleware,
-  createTracingMiddleware,
-  isPublicReadsEnabled,
-  requestIdMiddleware,
-  withMiddleware
-} from "@getstrata/core";
-
-// ../../src/config/rateLimit.ts
-var LOCAL_LOGIN_RATE_LIMIT = {
-  maxAttempts: 100,
-  decaySeconds: 60
-};
-var PRODUCTION_LOGIN_RATE_LIMIT = {
-  maxAttempts: 5,
-  decaySeconds: 900
-};
-function isLocalAppEnv() {
-  return (process.env.APP_ENV ?? "local") === "local";
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    return fallback;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
   }
-  return Math.trunc(parsed);
+  return null;
 }
-function resolveLoginRateLimit() {
-  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
-  return {
-    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
-  };
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function resolveRegisterRateLimit() {
-  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+}
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
-    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
-
-// ../../src/bootstrap/httpKernel.ts
-class HttpKernel {
-  dependencies;
-  constructor(dependencies) {
-    this.dependencies = dependencies;
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
-  globalMiddleware() {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return [
-      createCorsMiddleware(),
-      createSecurityHeadersMiddleware(),
-      createBodySizeLimitMiddleware(),
-      createTracingMiddleware(),
-      createMetricsMiddleware(),
-      createRequestLoggingMiddleware(),
-      requestIdMiddleware,
-      createAuthMiddleware(auth),
-      createMembershipMiddleware(),
-      createTenantMiddleware()
-    ];
+  return createCsrfTokenCookie();
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
   }
-  group(name) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    switch (name) {
-      case "authenticated":
-        return [createRequireAuthMiddleware(auth)];
-      case "web":
-        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
-      case "api": {
-        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
-        }
-        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-        if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
-          return [
-            createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
-              decaySeconds: 60
-            })
-          ];
-        }
-        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
-        return [
-          createThrottleMiddleware({
-            redisUrl,
-            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
-            decaySeconds: 60
-          })
-        ];
-      }
-      default:
-        throw new Error(`Unknown middleware group "${name}".`);
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/flashSession.ts
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
     }
   }
-  wrap(groups, handler) {
-    const names = Array.isArray(groups) ? groups : [groups];
-    const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
     }
-    return withMiddleware(...middleware)(handler);
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
   }
-  wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
   }
-  wrapWeb(handler) {
-    return handler;
+  return parseFlashCookie(cookieValue);
+}
+
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
-      return this.wrapWeb(handler);
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
+// ../../src/bootstrap/providers/view.ts
+var CORE_VIEW_TOKEN = "core.view";
+var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
+var viewProvider = {
+  name: "view",
+  register({ container, config }) {
+    if (!isViewsEnabled()) {
+      return;
     }
-    return this.wrapWebAuthenticated(handler);
+    const viewsDirectory = process.env.VIEW_DIRECTORY?.trim() || DEFAULT_VIEWS_DIRECTORY;
+    config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
+    container.set(CORE_VIEW_TOKEN, new EtaViewEngine(viewsDirectory, () => resolveWebLayoutData(container, currentRequestMeta().request)));
   }
-  wrapWebAuthenticated(handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+};
+
+// ../../src/bootstrap/providers/index.ts
+var coreProviders = [
+  config_default,
+  cache_default,
+  storage_default,
+  auth_default,
+  events_default,
+  policy_default,
+  queue_default,
+  listeners_default,
+  viewProvider
+];
+
+// ../../src/domain/auth.ts
+var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+
+// ../../src/bootstrap/secretsGuard.ts
+var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? appConfig.env;
+  if (appEnv !== "production") {
+    return;
   }
-  wrapWebAbility(ability, handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
-    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
+  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  if (devHeadersEnabled) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
-  wrapWebGlobalAdmin(handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
   }
-  wrapAuthenticated(handler) {
-    return this.wrap("authenticated", handler);
+  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
-      return handler;
-    }
-    return this.wrapAuthenticated(handler);
+  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  wrapGlobalAdmin(handler) {
-    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
-  wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
-    const middleware = [...this.group("authenticated"), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
+  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
-  wrapPolicy(resource, action, handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
-    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+  if (corsOrigins.includes("*")) {
+    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
   }
-  wrapLogin(handler) {
-    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
-  wrapRegister(handler) {
-    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  if (!env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
   }
-  wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
-    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
-        maxAttempts: rateLimit.maxAttempts,
-        decaySeconds: rateLimit.decaySeconds,
-        keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
-    }
-    return withMiddleware(...middleware)(handler);
+  if (!env.TOKEN_HASH_PEPPER?.trim()) {
+    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  }
+  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
+    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
-}
-function createHttpKernel(dependencies) {
-  return new HttpKernel(dependencies);
 }
 
-// ../../src/bootstrap/routeRegistry.ts
-class RouteRegistry {
-  routes = [];
-  register(route) {
-    this.routes.push(route);
-  }
-  clear() {
-    this.routes.length = 0;
-  }
-  list() {
-    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
-  }
+// ../../src/bootstrap/context.ts
+function collectProviders(modules = discoverModules()) {
+  return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
 }
-var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
-function readSharedRouteRegistry() {
-  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
+function runProviderPhase(providers, phase, context) {
+  for (const provider of providers) {
+    provider[phase]?.(context);
   }
-  const registry = new RouteRegistry;
-  globalThis[ROUTE_REGISTRY_KEY] = registry;
-  return registry;
 }
-var routeRegistry = readSharedRouteRegistry();
-
+function createAppContext() {
+  assertProductionSecrets();
+  const container = new ServiceContainer;
+  const config = new ConfigStore;
+  const dependencies = {
+    container
+  };
+  const context = {
+    container,
+    config,
+    dependencies
+  };
+  const providers = collectProviders();
+  runProviderPhase(providers, "register", context);
+  runProviderPhase(providers, "boot", context);
+  assertAppDependenciesComplete(dependencies);
+  const appContext = {
+    container,
+    config,
+    dependencies
+  };
+  setActiveApplicationContext(appContext);
+  return appContext;
+}
 // ../../src/bootstrap/createWebRoutes.ts
+import { join as join5 } from "path";
 function registerRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
@@ -4810,97 +4921,6 @@ function mergeWebRoutes(dependencies, routes) {
 function createAppDependencies() {
   return createAppContext().dependencies;
 }
-// ../../src/core/crypto/nonCryptographicHash.ts
-function nonCryptographicDigest(input) {
-  return Bun.hash(input).toString(16);
-}
-
-// ../../src/core/http/etag.ts
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
-}
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
-}
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
-  return formatWeakEtag(digest);
-}
-function normalizeEtag(value) {
-  return value.trim();
-}
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
-}
-function parseEtagList(header) {
-  if (!header) {
-    return [];
-  }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
-}
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
-    }
-    return;
-  }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
-  }
-}
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
-}
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
-  });
-}
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
-  }
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
-  }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 
@@ -4921,8 +4941,8 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
   return async (request) => {
     const id = parsePositiveIntParam(String(request.params[param]), String(param));
     const model = await resolver(id, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth = resolveApplicationAuth();
+    const gate = resolveApplicationPolicyGate2();
+    const auth = resolveApplicationAuth2();
     const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
@@ -4944,8 +4964,8 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
       throw new BadRequestError(`Missing route parameter "${String(param)}".`);
     }
     const model = await resolver(key, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth = resolveApplicationAuth();
+    const gate = resolveApplicationPolicyGate2();
+    const auth = resolveApplicationAuth2();
     const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
@@ -5096,22 +5116,12 @@ var membershipService_default = MembershipService;
 
 // ../../src/core/auth/resolveMembershipService.ts
 function resolveMembershipService() {
-  const dependencies = resolveApplicationDependencies();
+  const dependencies = resolveApplicationDependencies2();
   if (dependencies.container.has("core.membership")) {
     return dependencies.container.resolve("core.membership");
   }
   return new membershipService_default;
 }
-// ../../src/bootstrap/prefixRouteMap.ts
-function prefixRouteMap(prefix, routes) {
-  const normalizedPrefix = prefix.replace(/\/$/, "");
-  const prefixed = {};
-  for (const [path, handler] of Object.entries(routes)) {
-    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
-  }
-  return prefixed;
-}
 // ../../src/core/http/csrfProtection.ts
 var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
 function createCsrfProtection(secret, options = {}) {
@@ -5372,6 +5382,7 @@ export {
   configureModulesDirectory,
   collectProviders,
   cacheTagsForModelWrite,
+  buildModuleRoutes,
   assertProductionSecrets,
   assertAppDependenciesComplete,
   appSchedule,