@getstrata/core 0.5.12 → 0.5.14

package/dist/index.js

@@ -149,6 +149,62 @@ function resolveApplicationLogger() {
 function resolveApplicationDependencies() {
   return requireActiveApplicationContext().dependencies;
 }
+// ../../src/core/admin/formatValue.ts
+function formatAdminValue(value, type = "text") {
+  if (value === null || value === undefined) {
+    return "";
+  }
+  if (type === "boolean") {
+    return value ? "yes" : "no";
+  }
+  if (type === "number") {
+    return String(value);
+  }
+  if (type === "datetime") {
+    if (value instanceof Date) {
+      return value.toISOString();
+    }
+    return String(value);
+  }
+  if (type === "code") {
+    if (typeof value === "string") {
+      return value;
+    }
+    return JSON.stringify(value, null, 2);
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+// ../../src/core/admin/registry.ts
+class AdminResourceRegistry {
+  resources = new Map;
+  constructor() {}
+  register(resource) {
+    if (this.resources.has(resource.name)) {
+      throw new Error(`Admin resource "${resource.name}" is already registered.`);
+    }
+    this.resources.set(resource.name, resource);
+  }
+  get(name) {
+    return this.resources.get(name);
+  }
+  list() {
+    const definitions = [];
+    for (const resource of this.resources.values()) {
+      const { handlers: _handlers, ...definition } = resource;
+      definitions.push(definition);
+    }
+    return definitions;
+  }
+  all() {
+    return [...this.resources.values()];
+  }
+  clear() {
+    this.resources.clear();
+  }
+}
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage } from "async_hooks";
 var authContext = new AsyncLocalStorage;
@@ -158,6 +214,130 @@ function runWithAuthUser(user, callback) {
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
   status;
@@ -224,6 +404,84 @@ class PreconditionFailedError extends HttpError {
   }
 }
 
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage3;
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+function currentOrgRole(organizationId) {
+  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
+}
+function hasOrgMembership(organizationId) {
+  return currentOrgRole(organizationId) !== null;
+}
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
+function hasMinimumOrgRole2(organizationId, minimum) {
+  const role = currentOrgRole(organizationId);
+  if (!role) {
+    return false;
+  }
+  const ranks = {
+    member: 1,
+    admin: 2,
+    owner: 3
+  };
+  return ranks[role] >= ranks[minimum];
+}
+
+// ../../src/core/auth/membershipContextMiddleware.ts
+function createMembershipContextMiddleware() {
+  return async (_request, next) => {
+    return await runWithMembershipContext(async () => await next());
+  };
+}
+
+// ../../src/core/auth/membershipMiddleware.ts
+function createMembershipMiddleware() {
+  return createMembershipContextMiddleware();
+}
 // ../../src/core/auth/policy.ts
 class Policy {
   constructor() {}
@@ -1003,76 +1261,6 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var activeConnection = new AsyncLocalStorage2;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
 // ../../src/core/database/boundConnection.ts
 var boundConnectionHolder = {
   connection: null
@@ -2877,7 +3065,12 @@ async function defaultSmtpTransport(config, message) {
   }
 }
 function buildSmtpPayload(from, message) {
-  const headers = [`From: ${from}`, `To: ${message.to}`, `Subject: ${message.subject}`, "MIME-Version: 1.0"];
+  const headers = [
+    `From: ${from}`,
+    `To: ${message.to}`,
+    `Subject: ${message.subject}`,
+    "MIME-Version: 1.0"
+  ];
   if (message.html) {
     const boundary = `strata-${Date.now().toString(36)}`;
     headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
@@ -2957,8 +3150,11 @@ class LocalStorageDriver {
   constructor(rootDirectory) {
     this.rootDirectory = rootDirectory;
   }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
   resolvePath(path) {
-    return join3(this.rootDirectory, path.replace(/^\/+/, ""));
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);
@@ -3054,11 +3250,17 @@ function createStorageDriver() {
   if (driver === "s3") {
     return new S3StorageDriver(createS3Client());
   }
-  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
+  return new LocalStorageDriver;
 }
-var defaultStorage = new StorageManager(createStorageDriver());
+var defaultStorage = { current: null };
 function storage() {
-  return defaultStorage;
+  if (!defaultStorage.current) {
+    defaultStorage.current = new StorageManager(createStorageDriver());
+  }
+  return defaultStorage.current;
+}
+function resetDefaultStorage() {
+  defaultStorage.current = null;
 }
 
 // ../../src/core/facades/index.ts
@@ -3142,12 +3344,62 @@ function readRequestCookie(request, name) {
 function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
+// ../../src/config/cors.ts
+var corsConfig = {
+  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+  allowedHeaders: [
+    "Authorization",
+    "Content-Type",
+    "X-Request-Id",
+    "X-Tenant-Id",
+    "X-Authenticated-User-Id",
+    "X-Authenticated-User-Role",
+    "If-Match",
+    "If-None-Match"
+  ],
+  maxAgeSeconds: 86400
+};
+
+// ../../src/core/http/corsMiddleware.ts
+function createCorsMiddleware() {
+  return async (request, next) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request)
+      });
+    }
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request)) {
+      headers.set(key, value);
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+function buildCorsHeaders(request) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const allowedOrigins = corsConfig.allowedOrigins;
+  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  headers.set("Vary", "Origin");
+  return headers;
+}
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
 
 // ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage3;
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage4;
 function runWithRequestMeta(meta, callback) {
   return requestMetaContext.run(meta, callback);
 }
@@ -3379,29 +3631,142 @@ function applyConditionalGet(request, response, etag) {
     headers
   });
 }
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage4;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
+// ../../src/core/http/flashSession.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
 }
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
   }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
 }
-
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createFlashCookie(message) {
+  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
+  const issuedAt = Date.now();
+  const value = signFlashPayload(payload, issuedAt);
+  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function flashResponse(response, message) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", createFlashCookie(message));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/flashMiddleware.ts
+function createFlashMiddleware() {
+  return async (request, next) => {
+    const flash = pullFlash(request);
+    const meta = currentRequestMeta();
+    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
+      const response = await next();
+      if (flash) {
+        return withFlashClear(response);
+      }
+      return response;
+    });
+  };
+}
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage5;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
+  }
+}
+
 // ../../src/core/http/validation.ts
 function buildRequestCacheKey(fallbackPath, request) {
   if (!request) {
@@ -3791,7 +4156,7 @@ async function verifyPassword(password, passwordHash) {
 }
 
 // ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+import { createCipheriv, createDecipheriv, createHmac as createHmac2, randomBytes } from "crypto";
 var ENCRYPTION_PREFIX = "enc:v1:";
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
@@ -3840,7 +4205,7 @@ function decryptField(value, key) {
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 function hashLookupValue(normalizedValue, key) {
-  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+  return createHmac2("sha256", key).update(normalizedValue).digest("hex");
 }
 function normalizeEmail(email) {
   return email.trim().toLowerCase();
@@ -3920,7 +4285,7 @@ function resolveDefaultTokenExpiryDays() {
 }
 
 // ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -3942,7 +4307,7 @@ function generateTotp(secret, counter, digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
   buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const digest = createHmac3("sha1", key).update(buffer).digest();
   const lastByte = digest[digest.length - 1] ?? 0;
   const offset = lastByte & 15;
   const b0 = digest[offset] ?? 0;
@@ -4134,14 +4499,14 @@ var userTable = defineTable({
 });
 
 // ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac as createHmac3 } from "crypto";
+import { createHash, createHmac as createHmac4 } from "crypto";
 function resolveTokenPepper() {
   return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
 }
 function hashApiToken(token) {
   const pepper = resolveTokenPepper();
   if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac3("sha256", pepper).update(token).digest("hex");
+    return createHmac4("sha256", pepper).update(token).digest("hex");
   }
   return createHash("sha256").update(token).digest("hex");
 }
@@ -4149,105 +4514,6 @@ function hashApiToken(token) {
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function createFlashCookie(message) {
-  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
-  const issuedAt = Date.now();
-  const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-function flashResponse(response, message) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", createFlashCookie(message));
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
@@ -4843,6 +5109,38 @@ function createMetricsMiddleware() {
     return response;
   };
 }
+// ../../src/core/http/requireAbilityMiddleware.ts
+function createRequireAbilityMiddleware(abilityChecker) {
+  return (ability) => {
+    return async (_request, next) => {
+      const user = currentAuthUser();
+      try {
+        abilityChecker.requireAbility(user, ability);
+      } catch (error) {
+        if (error instanceof ForbiddenError) {
+          return Response.json({ error: error.message }, { status: error.status });
+        }
+        throw error;
+      }
+      return await next();
+    };
+  };
+}
+// ../../src/core/http/requireGlobalAdminMiddleware.ts
+function createRequireGlobalAdminMiddleware() {
+  return async (_request, next) => {
+    const user = currentAuthUser();
+    if (!isGlobalAdmin(user)) {
+      logSecurityEvent("privilege_escalation_blocked", {
+        required_role: "platform_admin",
+        path: new URL(_request.url).pathname
+      });
+      const error = new ForbiddenError("Platform admin access required.");
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
 // ../../src/core/http/requireWebAuthMiddleware.ts
 function createRequireWebAuthMiddleware(auth2) {
   return async (request, next) => {
@@ -5049,6 +5347,29 @@ function resetGracefulShutdownForTests() {
   shutdownInstalled = false;
   shuttingDown = false;
 }
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
+}
 // ../../src/core/mail/markdownMail.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -5183,6 +5504,9 @@ function createNotificationDispatcher(mailer2, databaseStore) {
 }
 // ../../src/core/notifications/notification.ts
 class Notification {
+  via(_notifiable) {
+    throw new Error("Notification subclasses must implement via().");
+  }
   toMail(_notifiable) {
     return null;
   }
@@ -5256,6 +5580,12 @@ class FailedJobService {
     await this.repository.deleteById(id);
     return failedJob;
   }
+  async delete(id) {
+    const deleted = await this.repository.deleteById(id);
+    if (!deleted) {
+      throw new Error(`Failed job ${id} not found.`);
+    }
+  }
   async flush() {
     const jobs = await this.repository.findAll();
     let deleted = 0;
@@ -5297,9 +5627,6 @@ class JobRegistry {
 }
 var jobRegistry = new JobRegistry;
 
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-
 // ../../src/config/queue.ts
 var queueConfig = {
   driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
@@ -5338,6 +5665,7 @@ async function runQueueJob(envelope, failedJobs) {
 }
 
 // ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient3 } = globalThis.Bun;
 var QUEUE_LIST_KEY = "workhub:queue:default";
 var QUEUE_HIGH_KEY = "workhub:queue:high";
 var QUEUE_LOW_KEY = "workhub:queue:low";
@@ -5542,6 +5870,208 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   }
   return due.length;
 }
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash as createHash2 } from "crypto";
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await connection_default`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  return await getDatabase().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await connection_default`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+function auditChecksum(payload) {
+  return createHash2("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+// ../../src/core/tracing/otel.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function randomHex(bytes) {
+  return randomBytes2(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/tracing/traceContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
+var traceContextStorage = new AsyncLocalStorage6;
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+function currentTraceId() {
+  return traceContextStorage.getStore()?.traceId ?? null;
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
 // ../../src/core/validation/rules.ts
 function required() {
   return (field, value) => {
@@ -5712,6 +6242,7 @@ export {
   runWithDatabaseConnection,
   runWithAuthUser,
   runSeedersFromDirectory,
+  runQueueJob,
   runInTransaction,
   runGracefulShutdown,
   runDueScheduledTasks,
@@ -5728,7 +6259,9 @@ export {
   resolveApplicationConfig,
   resolveApplicationCache,
   resolveApplicationAuth,
+  resetDefaultStorage,
   required,
+  requestIdMiddleware,
   renderMarkdownMail,
   registerShutdownHandler,
   registerModelRepository,
@@ -5757,6 +6290,7 @@ export {
   loadMigrationsFromDirectory,
   jsonResponse2 as jsonResponse,
   jobRegistry,
+  isPublicReadsEnabled,
   isHtmxRequest,
   isEtagEnabled,
   installGracefulShutdownSignals,
@@ -5776,6 +6310,7 @@ export {
   getMigrationStatus,
   getActiveDatabaseConnection,
   freshDatabase,
+  formatAdminValue,
   filterMassAssignable,
   events,
   etagFromResource,
@@ -5785,23 +6320,31 @@ export {
   currentAuthUser,
   createdResponse,
   createTrackedJob,
+  createTracingMiddleware,
   createThrottleMiddleware,
+  createTenantMiddleware,
   createSecurityHeadersMiddleware,
   createSchemaBuilder,
   createRequireWebAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
   createRequireAuthMiddleware,
+  createRequireAbilityMiddleware,
+  createRequestLoggingMiddleware,
   createQueueWorker,
   createQueue,
   createProductionQueue,
   createNotificationDispatcher,
   createMetricsMiddleware,
   createMemoryThrottleMiddleware,
+  createMembershipMiddleware,
   createLoginThrottleMiddleware,
+  createFlashMiddleware,
   createFailedJobService,
   createDatabaseConnection2 as createDatabaseConnection,
   createCsrfTokenCookie,
   createCsrfProtection,
   createCsrfMiddleware,
+  createCorsMiddleware,
   createBodySizeLimitMiddleware,
   createAuthorizeMiddleware,
   createAuthMiddleware,
@@ -5865,5 +6408,6 @@ export {
   Blueprint,
   baseRepository_default as BaseRepository,
   BadRequestError,
-  AsyncQueue
+  AsyncQueue,
+  AdminResourceRegistry
 };