@getstrata/core 0.5.13 → 0.5.14

package/README.md

@@ -3,7 +3,7 @@
 Stable **Strata** framework surface for application modules.
 
 **Source:** `src/framework/public-api.ts` (monorepo)  
-**Repository:** [EyK-26/strata](https://github.com/EyK-26/strata) — directory `packages/strata-core`
+**Repository:** [EyK-26/strata](https://github.com/EyK-26/strata), directory `packages/strata-core`
 
 WorkHub is the reference application built on Strata; import the framework from this package in your own modules.
 
@@ -15,21 +15,31 @@ Set `DATABASE_URL` before importing (connection is created lazily on first query
 process.env.DATABASE_URL ??= "postgresql://postgres:postgres@localhost:5432/myapp";
 
 import {
+  AdminResourceRegistry,
   BaseRepository,
   EtaViewEngine,
   FormRequest,
   Policy,
+  formatAdminValue,
   mailer,
   storage,
   withErrorHandling,
 } from "@getstrata/core";
 ```
 
-**Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core` — apps do not need to list it separately. The database driver is your app's choice — WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; bind it with `bindDatabaseConnection()`.
+**Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; bind it with `bindDatabaseConnection()`.
 
-`orderBy` accepts explicit `{ column, direction }` objects or Laravel-style shorthand `{ published_at: "desc" }`.
+`orderBy` accepts explicit `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`.
 
-## Build & verify (monorepo root)
+## Admin and queue helpers
+
+Exports for admin dashboards and queue recovery:
+
+- `AdminResourceRegistry`, `formatAdminValue`: read-only resource browsers
+- `createFailedJobService`, `FailedJobService.delete()`: failed job persistence and cleanup
+- `runQueueJob`, `jobRegistry`: dispatch retried jobs from admin UIs
+
+## Build and verify (monorepo root)
 
 ```bash
 bun run build:framework
@@ -41,9 +51,9 @@ bun run verify:framework   # build + public API tests
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.2.0 && git push origin v0.2.0`
+2. Tag a release: `git tag v0.5.13 && git push origin v0.5.13`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
-Previously published as `@eyk-workhub/framework@0.1.0` — deprecated in favor of this package.
+Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.
 
 See [docs/PACKAGING.md](../../docs/PACKAGING.md) for boundaries and future extraction.

package/dist/bootstrap/httpKernel.d.ts

@@ -1,5 +1,4 @@
-import type { Policy } from "../core/auth/policy";
-import { type Middleware, type RouteHandler } from "../core/http/middleware";
+import { type Middleware, type Policy, type RouteHandler } from "@getstrata/core";
 import type { AppDependencies } from "./contracts";
 type MiddlewareGroupName = "api" | "authenticated" | "web";
 declare class HttpKernel {

package/dist/core/admin/registry.d.ts

@@ -1,6 +1,7 @@
 import type { AdminResource, AdminResourceDefinition } from "./types.ts";
 declare class AdminResourceRegistry {
     private readonly resources;
+    constructor();
     register<TEntity extends object>(resource: AdminResource<TEntity>): void;
     get(name: string): AdminResource<object> | undefined;
     list(): AdminResourceDefinition[];

package/dist/core/storage/storage.d.ts

@@ -12,8 +12,9 @@ interface S3StorageConfig {
     endpoint?: string;
 }
 declare class LocalStorageDriver implements StorageDriver {
-    private readonly rootDirectory;
-    constructor(rootDirectory: string);
+    private readonly rootDirectory?;
+    constructor(rootDirectory?: string | undefined);
+    private resolveRootDirectory;
     private resolvePath;
     put(path: string, contents: string | Uint8Array): Promise<string>;
     get(path: string): Promise<Uint8Array | null>;
@@ -37,5 +38,7 @@ declare function resolveS3Config(): S3StorageConfig;
 declare function createS3Client(config?: S3StorageConfig): S3Client;
 declare function createStorageDriver(): StorageDriver;
 declare function storage(): StorageManager;
+/** Test hook: drop the process-wide storage singleton (e.g. after changing STORAGE_PATH). */
+declare function resetDefaultStorage(): void;
 export type { S3StorageConfig, StorageDriver };
-export { createS3Client, createStorageDriver, LocalStorageDriver, resolveS3Config, S3StorageDriver, StorageManager, storage, };
+export { createS3Client, createStorageDriver, LocalStorageDriver, resetDefaultStorage, resolveS3Config, S3StorageDriver, StorageManager, storage, };

package/dist/entries/storage/storage.js

@@ -9,8 +9,11 @@ class LocalStorageDriver {
   constructor(rootDirectory) {
     this.rootDirectory = rootDirectory;
   }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
   resolvePath(path) {
-    return join(this.rootDirectory, path.replace(/^\/+/, ""));
+    return join(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);
@@ -106,15 +109,22 @@ function createStorageDriver() {
   if (driver === "s3") {
     return new S3StorageDriver(createS3Client());
   }
-  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
+  return new LocalStorageDriver;
 }
-var defaultStorage = new StorageManager(createStorageDriver());
+var defaultStorage = { current: null };
 function storage() {
-  return defaultStorage;
+  if (!defaultStorage.current) {
+    defaultStorage.current = new StorageManager(createStorageDriver());
+  }
+  return defaultStorage.current;
+}
+function resetDefaultStorage() {
+  defaultStorage.current = null;
 }
 export {
   storage,
   resolveS3Config,
+  resetDefaultStorage,
   createStorageDriver,
   createS3Client,
   StorageManager,

package/dist/framework/public-api.d.ts

@@ -10,6 +10,7 @@ export { AdminResourceRegistry, formatAdminValue, } from "../core/admin/index.ts
 export type { AbilityChecker } from "../core/auth/abilityChecker.ts";
 export type { AuthUser } from "../core/auth/authContext.ts";
 export { currentAuthUser, runWithAuthUser } from "../core/auth/authContext.ts";
+export { createMembershipMiddleware } from "../core/auth/membershipMiddleware.ts";
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
 export { default as CacheRepository } from "../core/cache/repository.ts";
 export { CACHE_TAGS } from "../core/cache/tags.ts";
@@ -40,16 +41,20 @@ export { EventBus } from "../core/events/eventBus.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
 export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
+export { createCorsMiddleware } from "../core/http/corsMiddleware.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
 export { createCsrfProtection } from "../core/http/csrfProtection.ts";
 export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";
 export { assertIfMatch, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
+export { createFlashMiddleware } from "../core/http/flashMiddleware.ts";
 export { FormRequest } from "../core/http/formRequest.ts";
-export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";
+export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, requestIdMiddleware, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";
 export { createLoginThrottleMiddleware } from "../core/http/loginThrottleMiddleware.ts";
 export { createMemoryThrottleMiddleware } from "../core/http/memoryThrottleMiddleware.ts";
 export { createMetricsMiddleware, normalizeMetricPath } from "../core/http/metricsMiddleware.ts";
 export type { Middleware, RouteHandler } from "../core/http/middleware.ts";
+export { createRequireAbilityMiddleware } from "../core/http/requireAbilityMiddleware.ts";
+export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAdminMiddleware.ts";
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { serializeDate, toPaginatedResourceCollection, toResourceCollection, } from "../core/http/resources.ts";
 export type { RouteRequest } from "../core/http/route.ts";
@@ -57,6 +62,7 @@ export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMid
 export { createThrottleMiddleware } from "../core/http/throttleMiddleware.ts";
 export { WebFormRequest } from "../core/http/webFormRequest.ts";
 export { installGracefulShutdownSignals, registerShutdownHandler, runGracefulShutdown, } from "../core/lifecycle/gracefulShutdown.ts";
+export { createRequestLoggingMiddleware } from "../core/logging/requestLoggingMiddleware.ts";
 export type { MailDriver, MailMessage } from "../core/mail/mailer.ts";
 export { buildSmtpPayload, LogMailDriver, Mailer, mailer, } from "../core/mail/mailer.ts";
 export type { MarkdownMailLayoutOptions, RenderedMarkdownMail } from "../core/mail/markdownMail.ts";
@@ -73,8 +79,11 @@ export { AsyncQueue, createQueue, Job, SyncQueue } from "../core/queue/index.ts"
 export { createFailedJobService, createProductionQueue, createQueueWorker, createTrackedJob, FailedJobRepository, FailedJobService, jobRegistry, QueueWorker, RedisQueue, ResilientQueue, runQueueJob, } from "../core/queue/publicQueue.ts";
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
+export { isPublicReadsEnabled } from "../core/security/publicReads.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
-export { LocalStorageDriver, StorageManager } from "../core/storage/storage.ts";
+export { LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
+export { createTenantMiddleware } from "../core/tenant/tenantMiddleware.ts";
+export { createTracingMiddleware } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, htmlResponse, isHtmxRequest, resolveWebLayoutData, } from "../core/view/index.ts";

package/dist/index.js

@@ -180,6 +180,7 @@ function formatAdminValue(value, type = "text") {
 // ../../src/core/admin/registry.ts
 class AdminResourceRegistry {
   resources = new Map;
+  constructor() {}
   register(resource) {
     if (this.resources.has(resource.name)) {
       throw new Error(`Admin resource "${resource.name}" is already registered.`);
@@ -190,7 +191,12 @@ class AdminResourceRegistry {
     return this.resources.get(name);
   }
   list() {
-    return [...this.resources.values()].map(({ handlers: _handlers, ...definition }) => definition);
+    const definitions = [];
+    for (const resource of this.resources.values()) {
+      const { handlers: _handlers, ...definition } = resource;
+      definitions.push(definition);
+    }
+    return definitions;
   }
   all() {
     return [...this.resources.values()];
@@ -208,6 +214,130 @@ function runWithAuthUser(user, callback) {
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
   status;
@@ -274,6 +404,84 @@ class PreconditionFailedError extends HttpError {
   }
 }
 
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
+}
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
+  }
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function requireAuthenticatedUser() {
+  const user = currentAuthUser();
+  if (!user) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  return user;
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
+  }
+  return userId;
+}
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage3;
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
+}
+function currentOrgRole(organizationId) {
+  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
+}
+function hasOrgMembership(organizationId) {
+  return currentOrgRole(organizationId) !== null;
+}
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
+}
+function hasMinimumOrgRole2(organizationId, minimum) {
+  const role = currentOrgRole(organizationId);
+  if (!role) {
+    return false;
+  }
+  const ranks = {
+    member: 1,
+    admin: 2,
+    owner: 3
+  };
+  return ranks[role] >= ranks[minimum];
+}
+
+// ../../src/core/auth/membershipContextMiddleware.ts
+function createMembershipContextMiddleware() {
+  return async (_request, next) => {
+    return await runWithMembershipContext(async () => await next());
+  };
+}
+
+// ../../src/core/auth/membershipMiddleware.ts
+function createMembershipMiddleware() {
+  return createMembershipContextMiddleware();
+}
 // ../../src/core/auth/policy.ts
 class Policy {
   constructor() {}
@@ -1053,76 +1261,6 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var activeConnection = new AsyncLocalStorage2;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
 // ../../src/core/database/boundConnection.ts
 var boundConnectionHolder = {
   connection: null
@@ -3012,8 +3150,11 @@ class LocalStorageDriver {
   constructor(rootDirectory) {
     this.rootDirectory = rootDirectory;
   }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
   resolvePath(path) {
-    return join3(this.rootDirectory, path.replace(/^\/+/, ""));
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);
@@ -3109,11 +3250,17 @@ function createStorageDriver() {
   if (driver === "s3") {
     return new S3StorageDriver(createS3Client());
   }
-  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
+  return new LocalStorageDriver;
 }
-var defaultStorage = new StorageManager(createStorageDriver());
+var defaultStorage = { current: null };
 function storage() {
-  return defaultStorage;
+  if (!defaultStorage.current) {
+    defaultStorage.current = new StorageManager(createStorageDriver());
+  }
+  return defaultStorage.current;
+}
+function resetDefaultStorage() {
+  defaultStorage.current = null;
 }
 
 // ../../src/core/facades/index.ts
@@ -3197,12 +3344,62 @@ function readRequestCookie(request, name) {
 function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
+// ../../src/config/cors.ts
+var corsConfig = {
+  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+  allowedHeaders: [
+    "Authorization",
+    "Content-Type",
+    "X-Request-Id",
+    "X-Tenant-Id",
+    "X-Authenticated-User-Id",
+    "X-Authenticated-User-Role",
+    "If-Match",
+    "If-None-Match"
+  ],
+  maxAgeSeconds: 86400
+};
+
+// ../../src/core/http/corsMiddleware.ts
+function createCorsMiddleware() {
+  return async (request, next) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request)
+      });
+    }
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request)) {
+      headers.set(key, value);
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
+}
+function buildCorsHeaders(request) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const allowedOrigins = corsConfig.allowedOrigins;
+  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  headers.set("Vary", "Origin");
+  return headers;
+}
 // ../../src/core/http/csrfToken.ts
 import { timingSafeEqual } from "crypto";
 
 // ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage3;
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage4;
 function runWithRequestMeta(meta, callback) {
   return requestMetaContext.run(meta, callback);
 }
@@ -3434,9 +3631,122 @@ function applyConditionalGet(request, response, etag) {
     headers
   });
 }
+// ../../src/core/http/flashSession.ts
+import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createFlashCookie(message) {
+  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
+  const issuedAt = Date.now();
+  const value = signFlashPayload(payload, issuedAt);
+  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function flashResponse(response, message) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", createFlashCookie(message));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/flashMiddleware.ts
+function createFlashMiddleware() {
+  return async (request, next) => {
+    const flash = pullFlash(request);
+    const meta = currentRequestMeta();
+    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
+      const response = await next();
+      if (flash) {
+        return withFlashClear(response);
+      }
+      return response;
+    });
+  };
+}
 // ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage4;
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage5;
 function runWithTenant(tenant, callback) {
   return tenantContext.run(tenant, callback);
 }
@@ -3846,7 +4156,7 @@ async function verifyPassword(password, passwordHash) {
 }
 
 // ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+import { createCipheriv, createDecipheriv, createHmac as createHmac2, randomBytes } from "crypto";
 var ENCRYPTION_PREFIX = "enc:v1:";
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
@@ -3895,7 +4205,7 @@ function decryptField(value, key) {
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 function hashLookupValue(normalizedValue, key) {
-  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+  return createHmac2("sha256", key).update(normalizedValue).digest("hex");
 }
 function normalizeEmail(email) {
   return email.trim().toLowerCase();
@@ -3975,7 +4285,7 @@ function resolveDefaultTokenExpiryDays() {
 }
 
 // ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -3997,7 +4307,7 @@ function generateTotp(secret, counter, digits = 6) {
   const key = decodeBase32(secret);
   const buffer = Buffer.alloc(8);
   buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const digest = createHmac3("sha1", key).update(buffer).digest();
   const lastByte = digest[digest.length - 1] ?? 0;
   const offset = lastByte & 15;
   const b0 = digest[offset] ?? 0;
@@ -4189,14 +4499,14 @@ var userTable = defineTable({
 });
 
 // ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac as createHmac3 } from "crypto";
+import { createHash, createHmac as createHmac4 } from "crypto";
 function resolveTokenPepper() {
   return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
 }
 function hashApiToken(token) {
   const pepper = resolveTokenPepper();
   if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac3("sha256", pepper).update(token).digest("hex");
+    return createHmac4("sha256", pepper).update(token).digest("hex");
   }
   return createHash("sha256").update(token).digest("hex");
 }
@@ -4204,105 +4514,6 @@ function hashApiToken(token) {
 // ../../src/modules/user/provider.ts
 var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function createFlashCookie(message) {
-  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
-  const issuedAt = Date.now();
-  const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-function flashResponse(response, message) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", createFlashCookie(message));
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
@@ -4898,6 +5109,38 @@ function createMetricsMiddleware() {
     return response;
   };
 }
+// ../../src/core/http/requireAbilityMiddleware.ts
+function createRequireAbilityMiddleware(abilityChecker) {
+  return (ability) => {
+    return async (_request, next) => {
+      const user = currentAuthUser();
+      try {
+        abilityChecker.requireAbility(user, ability);
+      } catch (error) {
+        if (error instanceof ForbiddenError) {
+          return Response.json({ error: error.message }, { status: error.status });
+        }
+        throw error;
+      }
+      return await next();
+    };
+  };
+}
+// ../../src/core/http/requireGlobalAdminMiddleware.ts
+function createRequireGlobalAdminMiddleware() {
+  return async (_request, next) => {
+    const user = currentAuthUser();
+    if (!isGlobalAdmin(user)) {
+      logSecurityEvent("privilege_escalation_blocked", {
+        required_role: "platform_admin",
+        path: new URL(_request.url).pathname
+      });
+      const error = new ForbiddenError("Platform admin access required.");
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
 // ../../src/core/http/requireWebAuthMiddleware.ts
 function createRequireWebAuthMiddleware(auth2) {
   return async (request, next) => {
@@ -5104,6 +5347,29 @@ function resetGracefulShutdownForTests() {
   shutdownInstalled = false;
   shuttingDown = false;
 }
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
+}
 // ../../src/core/mail/markdownMail.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -5604,6 +5870,208 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   }
   return due.length;
 }
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash as createHash2 } from "crypto";
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await connection_default`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  return await getDatabase().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await connection_default`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+function auditChecksum(payload) {
+  return createHash2("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+// ../../src/core/tracing/otel.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function randomHex(bytes) {
+  return randomBytes2(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/tracing/traceContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
+var traceContextStorage = new AsyncLocalStorage6;
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+function currentTraceId() {
+  return traceContextStorage.getStore()?.traceId ?? null;
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
 // ../../src/core/validation/rules.ts
 function required() {
   return (field, value) => {
@@ -5791,7 +6259,9 @@ export {
   resolveApplicationConfig,
   resolveApplicationCache,
   resolveApplicationAuth,
+  resetDefaultStorage,
   required,
+  requestIdMiddleware,
   renderMarkdownMail,
   registerShutdownHandler,
   registerModelRepository,
@@ -5820,6 +6290,7 @@ export {
   loadMigrationsFromDirectory,
   jsonResponse2 as jsonResponse,
   jobRegistry,
+  isPublicReadsEnabled,
   isHtmxRequest,
   isEtagEnabled,
   installGracefulShutdownSignals,
@@ -5849,23 +6320,31 @@ export {
   currentAuthUser,
   createdResponse,
   createTrackedJob,
+  createTracingMiddleware,
   createThrottleMiddleware,
+  createTenantMiddleware,
   createSecurityHeadersMiddleware,
   createSchemaBuilder,
   createRequireWebAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
   createRequireAuthMiddleware,
+  createRequireAbilityMiddleware,
+  createRequestLoggingMiddleware,
   createQueueWorker,
   createQueue,
   createProductionQueue,
   createNotificationDispatcher,
   createMetricsMiddleware,
   createMemoryThrottleMiddleware,
+  createMembershipMiddleware,
   createLoginThrottleMiddleware,
+  createFlashMiddleware,
   createFailedJobService,
   createDatabaseConnection2 as createDatabaseConnection,
   createCsrfTokenCookie,
   createCsrfProtection,
   createCsrfMiddleware,
+  createCorsMiddleware,
   createBodySizeLimitMiddleware,
   createAuthorizeMiddleware,
   createAuthMiddleware,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",