@getstrata/bootstrap 0.2.5 → 0.2.7

package/dist/index.js

@@ -65,107 +65,80 @@ var appConfig = {
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
 };
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
 
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage } from "async_hooks";
 var activeConnection = new AsyncLocalStorage;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
 function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
 
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
   });
 }
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
   connection: null
 };
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
 }
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return resolveDatabase();
+  return defaultQuery.connection;
 }
-var db = new Proxy(function database() {}, {
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
+    return resolveRepositoryConnection()(...args);
   },
   get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
+    const connection = resolveRepositoryConnection();
     const value = connection[property];
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
-var connection_default = db;
 
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = input;
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = new URL(location, currentUrl).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
 
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
@@ -207,13 +180,8 @@ class UnauthorizedError extends HttpError {
   }
 }
 
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
 // ../../src/core/security/safeUrl.ts
+var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
@@ -285,14 +253,63 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
   }
   return parsed;
 }
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 
 // ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
-  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();
   } finally {
-    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
   }
 }
 
@@ -349,7 +366,7 @@ async function exportPendingAuditLogs() {
     return 0;
   }
   return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT
         id,
         user_id,
@@ -393,13 +410,13 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    });
+    }, { allowHttp: appConfig.env !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }
     const ids = rows.map((row) => row.id);
     for (const id of ids) {
-      await connection_default`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
     }
     return rows.length;
   });
@@ -559,7 +576,8 @@ class ConfigStore {
 }
 var requiredDependencyKeys = [
   "container",
-  "cache"
+  "cache",
+  "storage"
 ];
 function getRequiredDependency(dependencies, key) {
   const dependency = dependencies[key];
@@ -652,6 +670,60 @@ import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
 // ../../src/modules/user/apiTokenRepository.ts
 import { BaseRepository } from "@getstrata/core/database";
 
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
 // ../../src/modules/user/apiTokenTable.ts
 import { defineTable } from "@getstrata/core/database";
 var apiTokenTable = defineTable({
@@ -836,9 +908,6 @@ var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var authContext = new AsyncLocalStorage2;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }
@@ -1753,13 +1822,10 @@ function resolveApplicationQueue() {
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac as createHmac2 } from "crypto";
 class DispatchWebhookJob extends Job {
-  constructor() {
-    super();
-  }
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -1782,14 +1848,14 @@ class DispatchWebhookJob extends Job {
           "x-workhub-signature": signature
         },
         body
-      });
+      }, { allowHttp: appConfig.env !== "production" });
       responseStatus = response.status;
       if (!response.ok) {
         throw new Error(`Webhook delivery failed with status ${response.status}.`);
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await connection_default`
+      await repositoryConnection`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -1801,7 +1867,7 @@ class DispatchWebhookJob extends Job {
       `;
       throw error instanceof Error ? error : new Error(errorMessage);
     }
-    await connection_default`
+    await repositoryConnection`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},
@@ -2381,26 +2447,6 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? connection_default;
-}
-var repositoryConnection = new Proxy({}, {
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
 // ../../src/core/database/whereBuilder.ts
 class WhereBuilder {
   nodes = [];
@@ -3729,8 +3775,14 @@ function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
         if (tags.length === 0) {
           return;
         }
-        const cache = resolveApplicationCache();
-        const queue = resolveApplicationQueue();
+        let cache;
+        let queue;
+        try {
+          cache = resolveApplicationCache();
+          queue = resolveApplicationQueue();
+        } catch {
+          return;
+        }
         const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
         await queue.dispatch(job, { tags });
       });
@@ -3822,6 +3874,128 @@ var queueProvider = {
 };
 var queue_default = queueProvider;
 
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+var {S3Client } = globalThis.Bun;
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
+  resolvePath(path) {
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver;
+}
+
+// ../../src/bootstrap/providers/storage.ts
+var storageProvider = {
+  name: "core.storage",
+  register({ dependencies }) {
+    dependencies.storage = new StorageManager(createStorageDriver());
+  }
+};
+var storage_default = storageProvider;
+
 // ../../src/config/frontend.ts
 function readFrontendMode() {
   const mode = (process.env.FRONTEND_MODE ?? "api").trim();
@@ -3840,9 +4014,6 @@ function isViewsEnabled() {
 // ../../src/core/http/requestMetaContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 var requestMetaContext = new AsyncLocalStorage3;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -3851,9 +4022,9 @@ function currentRequestMeta() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
 class EtaViewEngine {
@@ -3892,9 +4063,6 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
-
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -3929,14 +4097,6 @@ function resolveCsrfSecret() {
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual2(leftBuffer, rightBuffer);
-}
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
@@ -3951,45 +4111,6 @@ function resolveCsrfToken(request) {
   }
   return createCsrfTokenCookie();
 }
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
-  }
-  return null;
-}
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (!cookieValue) {
-    return false;
-  }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
-  }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
   if (metaToken) {
@@ -3999,7 +4120,7 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
@@ -4046,7 +4167,7 @@ function parseFlashCookie(cookieValue) {
   if (expectedBuffer.length !== actualBuffer.length) {
     return null;
   }
-  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
     return null;
   }
   try {
@@ -4062,9 +4183,6 @@ function parseFlashCookie(cookieValue) {
     return null;
   }
 }
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
   if (!cookieValue) {
@@ -4072,15 +4190,6 @@ function pullFlash(request) {
   }
   return parseFlashCookie(cookieValue);
 }
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
@@ -4140,6 +4249,7 @@ var viewProvider = {
 var coreProviders = [
   config_default,
   cache_default,
+  storage_default,
   auth_default,
   events_default,
   policy_default,
@@ -4240,7 +4350,7 @@ function createAppContext() {
   return appContext;
 }
 // ../../src/bootstrap/createWebRoutes.ts
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // ../../src/core/http/middleware.ts
 function isRouteHandler(value) {
@@ -4272,17 +4382,6 @@ function composeMiddleware(...middleware) {
     };
   };
 }
-async function requestIdMiddleware(request, next) {
-  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-  const response = await next();
-  const headers = new Headers(response.headers);
-  headers.set("x-request-id", requestId);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 function wrapRouteHandler(handler, middleware) {
   if (isMethodRouteMap(handler)) {
     const wrapped = {};
@@ -4304,6 +4403,32 @@ function applyMiddlewareToRoutes(routes, middleware) {
   return wrapped;
 }
 
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
 // ../../src/config/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
@@ -4338,849 +4463,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/core/auth/membershipContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/accessControl.ts
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = new AsyncLocalStorage4;
-var membershipRepository = new memberRepository_default;
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-
-// ../../src/core/auth/membershipContextMiddleware.ts
-function createMembershipContextMiddleware() {
-  return async (_request, next) => {
-    return await runWithMembershipContext(async () => await next());
-  };
-}
-
-// ../../src/core/auth/membershipMiddleware.ts
-function createMembershipMiddleware() {
-  return createMembershipContextMiddleware();
-}
-
-// ../../src/core/http/authMiddleware.ts
-function createAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    return await runWithAuthUser(user, async () => {
-      const response = await next();
-      if (user) {
-        const headers = new Headers(response.headers);
-        headers.set("x-authenticated-user-id", String(user.id));
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/authorizeMiddleware.ts
-function createAuthorizeMiddleware(gate, auth, resource, action) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (!gate.allows(resource, action, user)) {
-      const error = new ForbiddenError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/bodySizeLimitMiddleware.ts
-var DEFAULT_MAX_BODY_BYTES = 1048576;
-function resolveMaxBodyBytes() {
-  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  return parsed;
-}
-function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
-  return async (request, next) => {
-    const contentLength = request.headers.get("content-length");
-    if (contentLength) {
-      const bytes = Number.parseInt(contentLength, 10);
-      if (Number.isInteger(bytes) && bytes > maxBytes) {
-        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-    }
-    return await next();
-  };
-}
-
-// ../../src/config/cors.ts
-var corsConfig = {
-  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
-  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  allowedHeaders: [
-    "Authorization",
-    "Content-Type",
-    "X-Request-Id",
-    "X-Tenant-Id",
-    "X-Authenticated-User-Id",
-    "X-Authenticated-User-Role",
-    "If-Match",
-    "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-
-// ../../src/core/http/corsMiddleware.ts
-function createCorsMiddleware() {
-  return async (request, next) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders(request)
-      });
-    }
-    const response = await next();
-    const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
-      headers.set(key, value);
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-function buildCorsHeaders(request) {
-  const headers = new Headers;
-  const origin = request.headers.get("origin");
-  const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
-  headers.set("Access-Control-Allow-Origin", allowOrigin);
-  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
-  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
-  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
-  return headers;
-}
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function appendSetCookie(response, cookie) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function createCsrfMiddleware() {
-  return async (request, next) => {
-    const method = request.method.toUpperCase();
-    if (!MUTATING_METHODS.has(method)) {
-      const csrf = resolveCsrfToken(request);
-      const meta = currentRequestMeta();
-      meta.csrfToken = csrf.token;
-      const response = await next();
-      if (!csrf.cookie) {
-        return response;
-      }
-      return appendSetCookie(response, csrf.cookie);
-    }
-    const submitted = await readSubmittedCsrfTokenFromBody(request);
-    if (!verifyCsrfToken(request, submitted)) {
-      throw new ForbiddenError("Invalid or missing CSRF token.");
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/flashMiddleware.ts
-function createFlashMiddleware() {
-  return async (request, next) => {
-    const flash = pullFlash(request);
-    const meta = currentRequestMeta();
-    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
-      const response = await next();
-      if (flash) {
-        return withFlashClear(response);
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-function resolveLoginIdentity(request) {
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-async function resolveLoginEmail(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  try {
-    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-      const formData = await request.clone().formData();
-      const email = formData.get("email");
-      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
-    }
-    const payload = await request.clone().json();
-    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function createLoginThrottleMiddleware(options) {
-  const client = new RedisClient3(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
-function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
-  return async (request, next) => {
-    const path = new URL(request.url).pathname;
-    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
-    const key = `${prefix}${identity}:${path}`;
-    const now = Date.now();
-    const existing = buckets.get(key);
-    if (!existing || existing.resetAt <= now) {
-      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
-      return await next();
-    }
-    existing.count += 1;
-    if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/metrics/prometheus.ts
-class PrometheusRegistry {
-  httpRequestsTotal = new Map;
-  httpRequestDurationMs = new Map;
-  incrementHttpRequest(labels) {
-    const key = this.metricKey(labels);
-    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
-  }
-  observeHttpDuration(labels, durationMs) {
-    const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
-  }
-  renderMetrics() {
-    const lines = [
-      "# HELP http_requests_total Total HTTP requests processed.",
-      "# TYPE http_requests_total counter"
-    ];
-    for (const [key, value] of this.httpRequestsTotal) {
-      lines.push(`http_requests_total{${key}} ${value}`);
-    }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
-    }
-    return `${lines.join(`
-`)}
-`;
-  }
-  resetForTests() {
-    this.httpRequestsTotal.clear();
-    this.httpRequestDurationMs.clear();
-  }
-  getHttpRequestSummary() {
-    const byStatus = {};
-    const pathCounts = new Map;
-    let totalRequests = 0;
-    for (const [key, count] of this.httpRequestsTotal) {
-      totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
-      byStatus[status] = (byStatus[status] ?? 0) + count;
-      const pathKey = `${method} ${path}`;
-      const existing = pathCounts.get(pathKey);
-      if (existing) {
-        existing.count += count;
-      } else {
-        pathCounts.set(pathKey, { method, path, count });
-      }
-    }
-    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
-    return {
-      totalRequests,
-      byStatus,
-      topPaths
-    };
-  }
-  metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
-  }
-}
-var prometheusRegistry = new PrometheusRegistry;
-
-// ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
-}
-function createMetricsMiddleware() {
-  return async (request, next) => {
-    const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
-  };
-}
-
-// ../../src/core/http/requireAbilityMiddleware.ts
-function createRequireAbilityMiddleware(abilityChecker) {
-  return (ability) => {
-    return async (_request, next) => {
-      const user = currentAuthUser();
-      try {
-        abilityChecker.requireAbility(user, ability);
-      } catch (error) {
-        if (error instanceof ForbiddenError) {
-          return Response.json({ error: error.message }, { status: error.status });
-        }
-        throw error;
-      }
-      return await next();
-    };
-  };
-}
-
-// ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth) {
-  return async (request, next) => {
-    if (!await auth.check(request)) {
-      const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent2(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/http/requireGlobalAdminMiddleware.ts
-function createRequireGlobalAdminMiddleware() {
-  return async (_request, next) => {
-    const user = currentAuthUser();
-    if (!isGlobalAdmin(user)) {
-      logSecurityEvent2("privilege_escalation_blocked", {
-        required_role: "platform_admin",
-        path: new URL(_request.url).pathname
-      });
-      const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
-}
-
-// ../../src/core/http/requireWebAuthMiddleware.ts
-function createRequireWebAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (user) {
-      return await next();
-    }
-    if (requestPrefersJson(request)) {
-      throw new UnauthorizedError;
-    }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  };
-}
-
-// ../../src/core/http/routeMiddleware.ts
-function withMiddleware(...middleware) {
-  const wrap = composeMiddleware(...middleware);
-  return (handler) => {
-    return wrap(handler);
-  };
-}
-
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
-  }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
-  }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
-  }
-  return strictApiContentSecurityPolicy();
-}
-
-// ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient4 } = globalThis.Bun;
-
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage5;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-function resolveThrottleIdentity(request) {
-  const user = currentAuthUser();
-  if (user?.tokenId !== undefined) {
-    return `token:${user.tokenId}`;
-  }
-  if (user) {
-    return `user:${user.id}`;
-  }
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-function createThrottleMiddleware(options) {
-  const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
-  return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
-    if (attempts > maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/logging/requestLoggingMiddleware.ts
-function createRequestLoggingMiddleware() {
-  return async (request, next) => {
-    return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
-      userAgent: request.headers.get("user-agent"),
-      request
-    }, async () => {
-      const startedAt = performance.now();
-      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-      const response = await next();
-      const durationMs = Math.round(performance.now() - startedAt);
-      appLogger.info("HTTP request completed", {
-        requestId,
-        method: request.method,
-        path: new URL(request.url).pathname,
-        status: response.status,
-        durationMs
-      });
-      return response;
-    });
-  };
-}
-
-// ../../src/core/security/publicReads.ts
-function isPublicReadsEnabled() {
-  return isFeatureEnabled("publicReads");
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  const rows = await connection_default`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  return await getDatabase().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-
-// ../../src/core/tenant/tenantMiddleware.ts
-var DEFAULT_TENANT = {
-  id: 1,
-  slug: "default",
-  plan: "enterprise",
-  region: "eu"
-};
-async function resolveUserTenantId(userId) {
-  return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
-      SELECT tenant_id
-      FROM users
-      WHERE id = ${userId}
-      LIMIT 1
-    `;
-    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
-  });
-}
-async function resolveTenantForRequest(request) {
-  const user = currentAuthUser();
-  const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
-  if (user) {
-    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
-    if (Number.isInteger(userId) && userId > 0) {
-      const userTenantId = await resolveUserTenantId(userId);
-      if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
-          throw new ForbiddenError("Tenant header does not match your account.");
-        }
-        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-      }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
-      }
-      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-    }
-  }
-  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
-  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
-}
-function createTenantMiddleware() {
-  return async (request, next) => {
-    try {
-      const tenant = await resolveTenantForRequest(request);
-      return await runWithTenantDatabase(tenant, async () => {
-        const response = await next();
-        const headers = new Headers(response.headers);
-        headers.set("x-tenant-id", String(tenant.id));
-        headers.set("x-tenant-region", tenant.region);
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      });
-    } catch (error) {
-      if (error instanceof HttpError) {
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-      throw error;
-    }
-  };
-}
-
-// ../../src/core/tracing/otel.ts
-import { randomBytes } from "crypto";
-function randomHex(bytes) {
-  return randomBytes(bytes).toString("hex");
-}
-function createSpan(input) {
-  const spanId = randomHex(8);
-  return {
-    traceId: input.traceId,
-    spanId,
-    name: input.name,
-    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
-    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
-    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
-      key,
-      value: { stringValue: value }
-    })),
-    status: { code: 1 }
-  };
-}
-async function exportOtelSpan(span) {
-  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-  if (!endpoint) {
-    return;
-  }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
-  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      resourceSpans: [
-        {
-          resource: {
-            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
-          },
-          scopeSpans: [{ spans: [span] }]
-        }
-      ]
-    })
-  });
-}
-
-// ../../src/core/tracing/traceContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
-var traceContextStorage = new AsyncLocalStorage6;
-function runWithTraceContext(context, callback) {
-  return traceContextStorage.run(context, callback);
-}
-
-// ../../src/core/tracing/tracingMiddleware.ts
-function createTracingMiddleware() {
-  return async (request, next) => {
-    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
-    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
-    const startedAt = performance.now();
-    const path = new URL(request.url).pathname;
-    return await runWithTraceContext({ traceId, spanId }, async () => {
-      const response = await next();
-      const endedAt = performance.now();
-      const headers = new Headers(response.headers);
-      headers.set("x-trace-id", traceId);
-      headers.set("x-span-id", spanId);
-      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
-      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
-      exportOtelSpan(createSpan({
-        traceId,
-        name: `${request.method} ${path}`,
-        startedAt,
-        endedAt,
-        attributes: {
-          "http.method": request.method,
-          "http.route": path,
-          "http.status_code": String(response.status)
-        }
-      })).catch(() => {
-        return;
-      });
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    });
-  };
-}
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -5402,7 +4684,7 @@ function createWebRoutes(dependencies) {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join4(process.cwd(), "public", relativePath));
+    const file = Bun.file(join5(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
       return htmlResponse("Not Found", { status: 404 });
     }
@@ -5576,7 +4858,7 @@ function createWebServer(options) {
   });
 }
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { createHash, randomBytes } from "crypto";
 class CookieSessionStore {
   sql;
   secret;
@@ -5602,7 +4884,7 @@ class CookieSessionStore {
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
   async create(user) {
-    const id = randomBytes2(32).toString("hex");
+    const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,