@getstrata/bootstrap 0.2.25 → 0.2.28

package/dist/index.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/bootstrap/public-api.ts
-import { appSchedule as appSchedule2, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
+import { appSchedule as appSchedule3, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
 
 // ../../src/core/scheduler/schedule.ts
 class Schedule {
@@ -35,452 +35,37 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   return due.length;
 }
 
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
-}
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveRepositoryConnection()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-
-class BadRequestError extends HttpError {
-  constructor(message = "Bad Request", details) {
-    super(400, message, details);
-  }
-}
-class ConflictError extends HttpError {
-  constructor(message = "Conflict", details) {
-    super(409, message, details);
-  }
-}
-
-class UnprocessableEntityError extends HttpError {
-  constructor(message = "Unprocessable Entity", details) {
-    super(422, message, details);
-  }
-}
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-class PreconditionFailedError extends HttpError {
-  constructor(message = "Precondition Failed", details) {
-    super(412, message, details);
-  }
-}
-
-// ../../src/core/security/safeUrl.ts
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/tenant/databaseTenantContext.ts
-async function runWithMigrationBypass(callback) {
-  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
-  }
-}
-
-// ../../src/core/audit/siemFormatter.ts
-function formatSiemAuditEvent(input) {
-  return {
-    timestamp: input.created_at.toISOString(),
-    event_type: "workhub.audit",
-    actor_user_id: input.user_id,
-    tenant_id: input.tenant_id ?? null,
-    trace_id: input.trace_id ?? null,
-    action: input.action,
-    subject_type: input.subject_type,
-    subject_id: input.subject_id,
-    ip_address: input.ip_address ?? null,
-    user_agent: input.user_agent ?? null,
-    checksum: input.checksum ?? null,
-    payload: input.payload ?? {}
-  };
-}
-function formatCefLine(event) {
-  const extension = [
-    `rt=${event.timestamp}`,
-    `suid=${event.actor_user_id ?? "unknown"}`,
-    `cs1=${event.action}`,
-    `cs1Label=Action`,
-    `cs2=${event.subject_type}`,
-    `cs2Label=SubjectType`,
-    `cs3=${event.subject_id ?? ""}`,
-    `cs3Label=SubjectId`,
-    `src=${event.ip_address ?? ""}`,
-    `request=${event.trace_id ?? ""}`
-  ].join(" ");
-  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
-}
-
-// ../../src/core/audit/exportAuditLogs.ts
-function resolveAuditExportConfig() {
-  const endpoint = process.env.SIEM_EXPORT_URL?.trim();
-  if (!endpoint) {
-    return null;
-  }
-  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
-  const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
-  return {
-    endpoint,
-    format: process.env.SIEM_EXPORT_FORMAT === "cef" ? "cef" : "json",
-    batchSize: Number.isFinite(batchSize) ? batchSize : 100
-  };
-}
-async function exportPendingAuditLogs() {
-  const config = resolveAuditExportConfig();
-  if (!config) {
-    return 0;
-  }
-  return await runWithMigrationBypass(async () => {
-    const rows = await repositoryConnection`
-      SELECT
-        id,
-        user_id,
-        action,
-        subject_type,
-        subject_id,
-        payload,
-        ip_address,
-        user_agent,
-        checksum,
-        tenant_id,
-        trace_id,
-        created_at
-      FROM audit_log
-      WHERE exported_at IS NULL
-      ORDER BY id
-      LIMIT ${config.batchSize}
-    `;
-    if (rows.length === 0) {
-      return 0;
-    }
-    const events = rows.map((row) => formatSiemAuditEvent({
-      action: row.action,
-      subject_type: row.subject_type,
-      subject_id: row.subject_id,
-      user_id: row.user_id,
-      tenant_id: row.tenant_id,
-      trace_id: row.trace_id,
-      ip_address: row.ip_address,
-      user_agent: row.user_agent,
-      checksum: row.checksum,
-      payload: row.payload,
-      created_at: row.created_at
-    }));
-    const body = config.format === "cef" ? events.map((event) => formatCefLine(event)).join(`
-`) : JSON.stringify({ events });
-    const response = await safeFetch(config.endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": config.format === "cef" ? "text/plain" : "application/json",
-        ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
-      },
-      body
-    }, { allowHttp: appConfig.env !== "production" });
-    if (!response.ok) {
-      throw new Error(`SIEM export failed with status ${response.status}.`);
-    }
-    const ids = rows.map((row) => row.id);
-    for (const id of ids) {
-      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
-    }
-    return rows.length;
-  });
-}
-
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
+// ../../src/bootstrap/schedule.ts
+import { exportPendingAuditLogs } from "@getstrata/core/audit/exportAuditLogs";
+import { appLogger } from "@getstrata/core/logging/logger";
+import { appSchedule as appSchedule2 } from "@getstrata/core/scheduler/schedule";
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
 }
-var appLogger = new Logger("app");
 
 // ../../src/bootstrap/schedule.ts
-appSchedule.command("* * * * *", "heartbeat", () => {
+appSchedule2.command("* * * * *", "heartbeat", () => {
   appLogger.debug("Scheduler heartbeat");
 });
-appSchedule.command("* * * * *", "audit-export", async () => {
+appSchedule2.command("* * * * *", "audit-export", async () => {
   if (!isFeatureEnabled("siemExport")) {
     return;
   }
@@ -517,7 +102,7 @@ import {
   resolveApplicationPolicyGate,
   resolveApplicationQueue,
   setActiveApplicationContext
-} from "@getstrata/core/runtime/applicationRegistry.ts";
+} from "@getstrata/core/runtime/applicationRegistry";
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
@@ -606,7 +191,7 @@ import {
   CORE_POLICY_GATE_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens.ts";
+} from "@getstrata/core/contracts/serviceTokens";
 var APP_PORT_CONFIG_KEY = "app.port";
 var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
 var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
@@ -1032,6 +617,68 @@ var databaseConfig = {
   connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
 };
 
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
 // ../../src/db/connection/createConnection.ts
 var {SQL } = globalThis.Bun;
 function createDatabaseConnection(config) {
@@ -1094,7 +741,7 @@ var apiTokenTable = defineTable({
 // ../../src/modules/user/authService.ts
 import { verifyPassword } from "@getstrata/core/auth/password";
 import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError as UnauthorizedError2 } from "@getstrata/core/errors/http";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
 import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
 import { verifyTotp } from "@getstrata/core/security/totp";
@@ -1119,22 +766,22 @@ class AuthService {
     const user = await this.users.findByEmail(email);
     if (!user?.password_hash) {
       logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError2("Invalid credentials.");
+      throw new UnauthorizedError("Invalid credentials.");
     }
     const valid = await verifyPassword(password, user.password_hash);
     if (!valid) {
       logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError2("Invalid credentials.");
+      throw new UnauthorizedError("Invalid credentials.");
     }
     if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
       logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError2("Email address is not verified.");
+      throw new UnauthorizedError("Email address is not verified.");
     }
     if (isFeatureEnabled("mfa") && user.mfa_enabled) {
       const mfaSecret = revealMfaSecret(user.mfa_secret);
       if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
         logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError2("Invalid MFA code.");
+        throw new UnauthorizedError("Invalid MFA code.");
       }
     }
     logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
@@ -1147,7 +794,7 @@ class AuthService {
   async loginWithOAuth(providerName, code) {
     const provider = this.oauthProviders.get(providerName);
     if (!provider) {
-      throw new UnauthorizedError2("Unsupported OAuth provider.");
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
     const profile = await provider.exchangeCode(code);
     const user = await this.findOrCreateOAuthUser(providerName, profile);
@@ -1161,7 +808,7 @@ class AuthService {
   buildOAuthAuthorizationUrl(providerName, state) {
     const provider = this.oauthProviders.get(providerName);
     if (!provider) {
-      throw new UnauthorizedError2("Unsupported OAuth provider.");
+      throw new UnauthorizedError("Unsupported OAuth provider.");
     }
     return provider.getAuthorizationUrl(state);
   }
@@ -1248,12 +895,57 @@ var userTable = defineTable4({
 
 // ../../src/modules/user/tokenService.ts
 import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError as ForbiddenError2, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
 import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+class ForbiddenError2 extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError2 extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
 // ../../src/core/auth/authContext.ts
 var authContext = createAsyncContextStore("@getstrata/authContext");
 function currentAuthUser() {
@@ -1340,7 +1032,7 @@ class AuthManager {
   async requireUser(request) {
     const user = await this.user(request);
     if (!user) {
-      throw new UnauthorizedError;
+      throw new UnauthorizedError2;
     }
     return user;
   }
@@ -1895,6 +1587,15 @@ var cacheProvider = {
 };
 var cache_default = cacheProvider;
 
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
 // ../../src/config/queue.ts
 var queueConfig = {
   driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
@@ -2117,25 +1818,103 @@ function discoverListeners() {
   return appListeners;
 }
 
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
+// ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
+import { eventBus as eventBus2, modelEventName as modelEventName2 } from "@getstrata/core/events";
+import InvalidateCacheTagsJob from "@getstrata/core/jobs/invalidateCacheTagsJob";
+import { createTrackedJob } from "@getstrata/core/queue/createAppQueue";
+var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
+function registerInvalidateCacheOnModelWriteListeners(bus = eventBus2) {
+  for (const tableName of discoverModelTableNames()) {
+    for (const action of MODEL_WRITE_ACTIONS) {
+      bus.listen(modelEventName2(tableName, action), async () => {
+        const tags = cacheTagsForModelWrite(tableName, action);
+        if (tags.length === 0) {
+          return;
+        }
+        let cache;
+        let queue;
+        try {
+          cache = resolveApplicationCache();
+          queue = resolveApplicationQueue();
+        } catch {
+          return;
+        }
+        const job = createTrackedJob("cache.invalidate-tags", new InvalidateCacheTagsJob(cache));
+        await queue.dispatch(job, { tags });
+      });
+    }
+  }
 }
 
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
+// ../../src/bootstrap/providers/listeners.ts
+var registeredListenerGroups = new Set;
+function registerListenerGroup(name, register) {
+  if (registeredListenerGroups.has(name)) {
+    return;
   }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
+  registeredListenerGroups.add(name);
+  register();
+}
+var listenersProvider = {
+  name: "core.listeners",
+  boot() {
+    registerListenerGroup("cache.invalidate-on-model-write", () => {
+      registerInvalidateCacheOnModelWriteListeners();
+    });
+    for (const [index, registerListener] of discoverListeners().entries()) {
+      registerListenerGroup(`app.listener.${index}`, registerListener);
+    }
+  }
+};
+var listeners_default = listenersProvider;
+
+// ../../src/core/auth/policy.ts
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
+    }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError2;
+    }
   }
 }
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
+
+// ../../src/bootstrap/providers/policy.ts
+var policyProvider = {
+  name: "core.policy",
+  register({ container }) {
+    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate);
+  }
+};
+var policy_default = policyProvider;
 
 // ../../src/core/pagination/index.ts
 function buildPaginationMeta(input) {
@@ -2673,8 +2452,31 @@ function indexMorphToRelation(children, parentsByType, relation) {
       result.set(child[relation.morphIdKey], parent);
     }
   }
-  return result;
-}
+  return result;
+}
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveRepositoryConnection()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
 
 // ../../src/core/database/whereBuilder.ts
 class WhereBuilder {
@@ -4000,9 +3802,6 @@ class ResilientQueue {
 function createFailedJobService() {
   return new failedJobService_default(new failedJobRepository_default);
 }
-function createTrackedJob(name, job) {
-  return jobRegistry.track(name, job);
-}
 function createProductionQueue(driver, options = {}) {
   options.registerJobs?.();
   const failedJobs = options.failedJobs ?? createFailedJobService();
@@ -4025,103 +3824,141 @@ function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(),
   });
 }
 
-// ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
-var MODEL_WRITE_ACTIONS = ["created", "updated", "deleted", "restored", "force-deleted"];
-function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
-  for (const tableName of discoverModelTableNames()) {
-    for (const action of MODEL_WRITE_ACTIONS) {
-      bus.listen(modelEventName(tableName, action), async () => {
-        const tags = cacheTagsForModelWrite(tableName, action);
-        if (tags.length === 0) {
-          return;
-        }
-        let cache;
-        let queue;
-        try {
-          cache = resolveApplicationCache();
-          queue = resolveApplicationQueue();
-        } catch {
-          return;
-        }
-        const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
-        await queue.dispatch(job, { tags });
-      });
-    }
-  }
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac as createHmac2 } from "crypto";
+
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
 }
 
-// ../../src/bootstrap/providers/listeners.ts
-var registeredListenerGroups = new Set;
-function registerListenerGroup(name, register) {
-  if (registeredListenerGroups.has(name)) {
-    return;
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
   }
-  registeredListenerGroups.add(name);
-  register();
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
 }
-var listenersProvider = {
-  name: "core.listeners",
-  boot() {
-    registerListenerGroup("cache.invalidate-on-model-write", () => {
-      registerInvalidateCacheOnModelWriteListeners();
-    });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
-    }
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
   }
-};
-var listeners_default = listenersProvider;
-
-// ../../src/core/auth/policy.ts
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
-
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
   }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
-    }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
   }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
   }
+  return parsed;
 }
 
-// ../../src/bootstrap/providers/policy.ts
-var policyProvider = {
-  name: "core.policy",
-  register({ container }) {
-    container.set(CORE_POLICY_GATE_TOKEN, new PolicyGate);
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
   }
-};
-var policy_default = policyProvider;
+}
 
 // ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac as createHmac2 } from "crypto";
 class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
@@ -4181,6 +4018,19 @@ class DispatchWebhookJob extends Job {
 }
 var dispatchWebhookJob_default = DispatchWebhookJob;
 
+// ../../src/core/jobs/invalidateCacheTagsJob.ts
+class InvalidateCacheTagsJob2 extends Job {
+  cache;
+  constructor(cache) {
+    super();
+    this.cache = cache;
+  }
+  async handle(payload) {
+    await this.cache.tags(...payload.tags).flush();
+  }
+}
+var invalidateCacheTagsJob_default = InvalidateCacheTagsJob2;
+
 // ../../src/core/contracts/di.ts
 function getRequiredDependency2(dependencies, key) {
   const dependency = dependencies[key];
@@ -4194,6 +4044,42 @@ function getRequiredDependency2(dependencies, key) {
 var CORE_POLICY_GATE_TOKEN2 = "core.policyGate";
 var CORE_AUTH_TOKEN2 = "core.auth";
 
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger2 = new Logger("app");
+
 // ../../src/core/runtime/applicationRegistry.ts
 var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
 var activeContext;
@@ -5151,7 +5037,7 @@ export {
   buildModuleRoutes,
   assertProductionSecrets,
   assertAppDependenciesComplete,
-  appSchedule2 as appSchedule,
+  appSchedule3 as appSchedule,
   ServiceContainer,
   Schedule2 as Schedule,
   RouteRegistry,