@getstrata/core 0.5.13 → 0.5.15

package/dist/index.js

@@ -180,6 +180,7 @@ function formatAdminValue(value, type = "text") {
 // ../../src/core/admin/registry.ts
 class AdminResourceRegistry {
   resources = new Map;
+  constructor() {}
   register(resource) {
     if (this.resources.has(resource.name)) {
       throw new Error(`Admin resource "${resource.name}" is already registered.`);
@@ -190,7 +191,12 @@ class AdminResourceRegistry {
     return this.resources.get(name);
   }
   list() {
-    return [...this.resources.values()].map(({ handlers: _handlers, ...definition }) => definition);
+    const definitions = [];
+    for (const resource of this.resources.values()) {
+      const { handlers: _handlers, ...definition } = resource;
+      definitions.push(definition);
+    }
+    return definitions;
   }
   all() {
     return [...this.resources.values()];
@@ -199,15 +205,6 @@ class AdminResourceRegistry {
     this.resources.clear();
   }
 }
-// ../../src/core/auth/authContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var authContext = new AsyncLocalStorage;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
   status;
@@ -274,125 +271,97 @@ class PreconditionFailedError extends HttpError {
   }
 }
 
-// ../../src/core/auth/policy.ts
-class Policy {
-  constructor() {}
-  view(_user, _resource) {
-    return false;
-  }
-  create(_user) {
-    return false;
-  }
-  update(_user, _resource) {
-    return false;
-  }
-  delete(_user, _resource) {
-    return false;
-  }
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function runWithAuthUser(user, callback) {
+  return authContext.run(user, callback);
+}
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
 }
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
 
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
-  }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
-    }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
-  }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
-  }
+// ../../src/core/auth/accessControl.ts
+var ROLE_RANK = {
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function isGlobalAdmin(user) {
+  return user?.role === "admin";
 }
-// ../../src/core/cache/taggedCache.ts
-class TaggedCache {
-  store;
-  tags;
-  constructor(store, tags) {
-    this.store = store;
-    this.tags = tags;
+function hasMinimumOrgRole(role, minimum) {
+  if (!role) {
+    return false;
   }
-  async remember(key, callback, ttlMs) {
-    const value = await this.store.getOrSet(key, callback, ttlMs);
-    await this.store.attachTags(key, this.tags);
-    return value;
+  return ROLE_RANK[role] >= ROLE_RANK[minimum];
+}
+function resolveUserId(user) {
+  const userId = typeof user.id === "number" ? user.id : Number(user.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    throw new ForbiddenError("Invalid authenticated user.");
   }
-  async flush() {
-    return this.store.flushTags(this.tags);
+  return userId;
+}
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
   }
+  return [...MEMBER_ABILITIES];
 }
-var taggedCache_default = TaggedCache;
 
-// ../../src/core/cache/repository.ts
-class CacheRepository {
-  store;
-  constructor(store) {
-    this.store = store;
-  }
-  async get(key) {
-    return this.store.get(key);
-  }
-  async remember(key, callback, ttlMs) {
-    return this.store.getOrSet(key, callback, ttlMs);
-  }
-  async forget(key) {
-    return this.store.invalidate(key);
-  }
-  async flush() {
-    await this.store.clear();
-  }
-  tags(...names) {
-    return new taggedCache_default(this.store, names);
-  }
-  async getOrSet(key, loader, ttlMs) {
-    return this.remember(key, loader, ttlMs);
-  }
-  async invalidate(key) {
-    return this.forget(key);
-  }
-  async invalidateByPrefix(prefix) {
-    return this.store.invalidateByPrefix(prefix);
-  }
-  async clear() {
-    await this.flush();
-  }
-  async size() {
-    return this.store.size();
-  }
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
 }
-var repository_default = CacheRepository;
-// ../../src/core/cache/tags.ts
-var CACHE_TAGS = {
-  organizations: "organizations",
-  projects: "projects",
-  tasks: "tasks",
-  comments: "comments",
-  attachments: "attachments",
-  reports: "reports"
-};
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
 // ../../src/core/events/eventBus.ts
 class EventBus {
   constructor() {}
@@ -598,14 +567,6 @@ function appendWhereParts(tableName, where, params) {
   }
   return clauses.join(" AND ");
 }
-function buildWhereClause(tableName, where = {}) {
-  const params = [];
-  const body = appendWhereParts(tableName, where, params);
-  return {
-    clause: body.length > 0 ? ` WHERE ${body}` : "",
-    params
-  };
-}
 function buildWhereNodeClause(tableName, node, params) {
   if ("where" in node) {
     return appendWhereParts(tableName, node.where, params);
@@ -1053,18 +1014,19 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
 };
+function bindDatabaseConnection(connection) {
+  boundConnectionHolder.connection = connection;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+function resetBoundDatabaseConnection() {
+  boundConnectionHolder.connection = null;
+}
 
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
@@ -1075,72 +1037,68 @@ function runWithDatabaseConnection(connection, callback) {
 function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
 
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
   });
 }
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
   connection: null
 };
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
 }
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
+function getDefaultDatabasePool() {
+  if (!defaultPool.connection) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultPool.connection;
 }
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return resolveDatabase();
+  return defaultQuery.connection;
 }
-var db = new Proxy(function database() {}, {
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
+    return resolveRepositoryConnection()(...args);
   },
   get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function bindDatabaseConnection(connection) {
-  boundConnectionHolder.connection = connection;
-}
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? connection_default;
-}
-var repositoryConnection = new Proxy({}, {
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
+    const connection = resolveRepositoryConnection();
     const value = connection[property];
     return typeof value === "function" ? value.bind(connection) : value;
   }
@@ -1701,130 +1659,14 @@ class BaseRepository {
   }
 }
 var baseRepository_default = BaseRepository;
-// ../../src/core/database/bindConnection.ts
-function bindDatabaseConnection2(connection) {
-  bindDatabaseConnection(connection);
-}
 // ../../src/core/database/connection.ts
-function createDatabaseConnection2(source) {
+function createDatabaseConnection(source) {
   return {
     async unsafe(query, params = []) {
       return await source.unsafe(query, params);
     }
   };
 }
-// ../../src/core/database/migrations/advisoryLock.ts
-var MIGRATION_LOCK_KEY = 42424242;
-async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
-  await db2.unsafe("SELECT pg_advisory_lock($1)", [lockKey]);
-  try {
-    return await callback();
-  } finally {
-    await db2.unsafe("SELECT pg_advisory_unlock($1)", [lockKey]);
-  }
-}
-// ../../src/core/database/migrations/runner.ts
-import { readdir } from "fs/promises";
-import { join } from "path";
-import { pathToFileURL } from "url";
-var MIGRATIONS_TABLE = "framework_migrations";
-async function ensureMigrationsTable(db2) {
-  await db2.unsafe(`
-    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
-      name TEXT PRIMARY KEY,
-      batch INTEGER NOT NULL,
-      run_on TIMESTAMPTZ NOT NULL DEFAULT NOW()
-    )
-  `);
-}
-async function getAppliedMigrations(db2) {
-  await ensureMigrationsTable(db2);
-  return await db2.unsafe(`
-    SELECT name, batch
-    FROM ${MIGRATIONS_TABLE}
-    ORDER BY batch ASC, name ASC
-  `);
-}
-async function loadMigrationsFromDirectory(directory) {
-  const entries = await readdir(directory);
-  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
-  const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
-    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
-    const module = await import(moduleUrl);
-    return module.default;
-  }));
-  return loadedMigrations.filter((migration) => migration?.name !== undefined);
-}
-async function getMigrationStatus(db2, migrations) {
-  const applied = await getAppliedMigrations(db2);
-  const appliedByName = new Map(applied.map(({ name, batch }) => [name, Number(batch)]));
-  return migrations.map(({ name }) => ({
-    name,
-    status: appliedByName.has(name) ? "up" : "pending",
-    batch: appliedByName.get(name) ?? null
-  }));
-}
-async function runPendingMigrations(db2, migrations, options = {}) {
-  const applied = await getAppliedMigrations(db2);
-  const appliedNames = new Set(applied.map(({ name }) => name));
-  const nextBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0) + 1;
-  const pendingMigrations = migrations.filter(({ name }) => !appliedNames.has(name));
-  for (const migration of pendingMigrations) {
-    options.onMigration?.(migration.name);
-    await migration.up(db2);
-    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
-    if (inserted.length === 0) {
-      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
-    }
-  }
-  return pendingMigrations.length;
-}
-async function migrateDatabase(db2, migrations, options = {}) {
-  const { advisoryLock = false, onMigration } = options;
-  if (advisoryLock) {
-    return withMigrationLock(db2, () => runPendingMigrations(db2, migrations, { onMigration }));
-  }
-  return runPendingMigrations(db2, migrations, { onMigration });
-}
-async function rollbackDatabase(db2, migrations, options = {}) {
-  const applied = await getAppliedMigrations(db2);
-  if (applied.length === 0) {
-    return 0;
-  }
-  const lastBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0);
-  const migrationsToRollback = new Set(applied.filter(({ batch }) => Number(batch) === lastBatch).map(({ name }) => name));
-  let rolledBack = 0;
-  for (const migration of [...migrations].reverse()) {
-    if (!migrationsToRollback.has(migration.name)) {
-      continue;
-    }
-    options.onMigration?.(migration.name);
-    await migration.down(db2);
-    await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE} WHERE name = $1`, [migration.name]);
-    rolledBack += 1;
-  }
-  return rolledBack;
-}
-async function freshDatabase(db2, migrations, options = {}) {
-  const runFresh = async () => {
-    const applied = await getAppliedMigrations(db2);
-    const appliedNames = new Set(applied.map(({ name }) => name));
-    const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
-    for (const migration of [...appliedMigrations].reverse()) {
-      options.onMigration?.(migration.name);
-      await migration.down(db2);
-    }
-    if (appliedMigrations.length > 0) {
-      await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
-    }
-    await runPendingMigrations(db2, migrations, options);
-  };
-  if (options.advisoryLock) {
-    await withMigrationLock(db2, runFresh);
-    return;
-  }
-  await runFresh();
-}
 // ../../src/core/database/model.ts
 var modelRepositories = new WeakMap;
 var modelGlobalScopes = new WeakMap;
@@ -2736,9 +2578,9 @@ class SchemaBuilder {
   toSql() {
     return [...this.#statements];
   }
-  async execute(db2) {
+  async execute(db) {
     for (const statement of this.#statements) {
-      await db2.unsafe(statement);
+      await db.unsafe(statement);
     }
   }
 }
@@ -2747,45 +2589,20 @@ class Schema {
   static builder(driver) {
     return new SchemaBuilder(driver ?? resolveDatabaseDriver());
   }
-  static async run(db2, driver, callback) {
+  static async run(db, driver, callback) {
     const schema = Schema.builder(driver);
     await callback(schema);
-    await schema.execute(db2);
+    await schema.execute(db);
   }
 }
-function createSchemaBuilder(db2, driver) {
+function createSchemaBuilder(db, driver) {
   const builder = Schema.builder(driver);
   return Object.assign(builder, {
     async commit() {
-      await builder.execute(db2);
+      await builder.execute(db);
     }
   });
 }
-// ../../src/core/database/seeders/runner.ts
-import { readdir as readdir2 } from "fs/promises";
-import { join as join2 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
-async function loadSeedersFromDirectory(directory) {
-  const entries = await readdir2(directory);
-  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
-  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
-    const moduleUrl = pathToFileURL2(join2(directory, fileName)).href;
-    const module = await import(moduleUrl);
-    return module.default;
-  }));
-  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
-}
-async function runSeedersFromDirectory(directory, db2, options) {
-  const seeders = await loadSeedersFromDirectory(directory);
-  if (seeders.length === 0) {
-    return 0;
-  }
-  for (const seeder of seeders) {
-    options?.onSeeder?.(seeder.name);
-    await seeder.run(db2);
-  }
-  return seeders.length;
-}
 // ../../src/core/database/table.ts
 function defineTable(definition) {
   return definition;
@@ -2800,1419 +2617,1830 @@ async function runInTransaction(operation) {
     throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
   }
   return await pool.begin(async (transaction) => {
-    return await operation(createDatabaseConnection2(transaction));
+    return await operation(createDatabaseConnection(transaction));
   });
 }
-// ../../src/core/mail/mailer.ts
-function resolveSmtpConfig() {
-  const host = process.env.MAIL_HOST?.trim();
-  if (!host) {
-    throw new Error('MAIL_DRIVER="smtp" requires MAIL_HOST to be set.');
-  }
-  const from = process.env.MAIL_FROM?.trim();
-  if (!from) {
-    throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection2(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
   }
-  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
-  if (!Number.isInteger(port) || port <= 0) {
-    throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
   }
-  return {
-    host,
-    port,
-    from,
-    secure: (process.env.MAIL_SECURE ?? "false") === "true",
-    ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
-    ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
-  };
+  return connectionHolder.connection;
 }
-function encodeBase64(value) {
-  return Buffer.from(value, "utf8").toString("base64");
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
 }
-function parseSmtpResponses(buffer) {
-  const responses = [];
-  let remainder = buffer;
-  while (remainder.includes(`\r
-`)) {
-    const index = remainder.indexOf(`\r
-`);
-    const line = remainder.slice(0, index);
-    remainder = remainder.slice(index + 2);
-    if (line.length >= 4 && line[3] === "-") {
-      continue;
-    }
-    responses.push(line);
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
   }
-  return { responses, remainder };
+});
+var connection_default = db;
+
+// ../../src/modules/user/apiTokenTable.ts
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/password.ts
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
 }
-async function waitForSmtpResponse(readResponse, expectedCodes) {
-  const response = await readResponse();
-  const code = response.slice(0, 3);
-  if (!expectedCodes.includes(code)) {
-    throw new Error(`Unexpected SMTP response: ${response}`);
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
   }
-  return response;
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
 }
-async function openSmtpConnection(config) {
-  let buffer = "";
-  const waiters = [];
-  const readResponse = () => new Promise((resolve, reject) => {
-    const parsed = parseSmtpResponses(buffer);
-    if (parsed.responses.length > 0) {
-      buffer = parsed.remainder;
-      resolve(parsed.responses.shift());
-      return;
-    }
-    waiters.push({ resolve, reject });
-  });
-  const socket = await Bun.connect({
-    hostname: config.host,
-    port: config.port,
-    socket: {
-      open() {},
-      data(_socket, chunk) {
-        buffer += Buffer.from(chunk).toString("utf8");
-        const parsed = parseSmtpResponses(buffer);
-        buffer = parsed.remainder;
-        while (parsed.responses.length > 0 && waiters.length > 0) {
-          const response = parsed.responses.shift();
-          waiters.shift()?.resolve(response);
-        }
-      },
-      error(_socket, error) {
-        const pending = waiters.splice(0);
-        for (const waiter of pending) {
-          waiter.reject(error instanceof Error ? error : new Error(String(error)));
-        }
-      }
-    }
-  });
-  return { socket, readResponse };
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
 }
-async function defaultSmtpTransport(config, message) {
-  const { socket, readResponse } = await openSmtpConnection(config);
-  try {
-    await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
-`);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    if (config.username && config.password) {
-      await socket.write(`AUTH LOGIN\r
-`);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.username)}\r
-`);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.password)}\r
-`);
-      await waitForSmtpResponse(readResponse, ["235"]);
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
+  }
+  return decryptField(stored, key);
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage3;
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
+  }
+  return parsed;
+}
+
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2 } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
     }
-    await socket.write(`MAIL FROM:<${config.from}>\r
-`);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${message.to}>\r
-`);
-    await waitForSmtpResponse(readResponse, ["250", "251"]);
-    await socket.write(`DATA\r
-`);
-    await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(config.from, message);
-    await socket.write(payload);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`QUIT\r
-`);
-    await waitForSmtpResponse(readResponse, ["221"]);
-  } finally {
-    socket.end();
+    bits += value.toString(2).padStart(5, "0");
   }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
 }
-function buildSmtpPayload(from, message) {
-  const headers = [
-    `From: ${from}`,
-    `To: ${message.to}`,
-    `Subject: ${message.subject}`,
-    "MIME-Version: 1.0"
-  ];
-  if (message.html) {
-    const boundary = `strata-${Date.now().toString(36)}`;
-    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
-    const parts = [
-      `--${boundary}`,
-      "Content-Type: text/plain; charset=utf-8",
-      "",
-      message.body,
-      `--${boundary}`,
-      "Content-Type: text/html; charset=utf-8",
-      "",
-      message.html,
-      `--${boundary}--`,
-      ""
-    ];
-    return [...headers, "", ...parts, ".", ""].join(`\r
-`);
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
   }
-  headers.push("Content-Type: text/plain; charset=utf-8");
-  return [...headers, "", message.body, ".", ""].join(`\r
-`);
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
+  }
+  return false;
 }
 
-class LogMailDriver {
-  async send(message) {
-    console.log(JSON.stringify({
-      level: "info",
-      channel: "mail",
-      to: message.to,
-      subject: message.subject,
-      body: message.body,
-      ...message.html ? { html: message.html } : {}
-    }));
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage4;
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+function rateLimitMultiplierForPlan(plan) {
+  switch (plan) {
+    case "enterprise":
+      return 4;
+    case "pro":
+      return 2;
+    default:
+      return 1;
   }
 }
 
-class SmtpMailDriver {
-  config;
-  transport;
-  constructor(config, transport = defaultSmtpTransport) {
-    this.config = config;
-    this.transport = transport;
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
   }
-  send(message) {
-    return this.transport(this.config, message);
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
   }
 }
 
-class Mailer {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
-  }
-  send(message) {
-    return this.driver.send(message);
+// ../../src/modules/user/notificationTable.ts
+var notificationTable = defineTable({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+var oauthIdentityTable = defineTable({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/table.ts
+var userTable = defineTable({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/guard.ts
+function devHeaderAbilities(role) {
+  if (role === "admin") {
+    return [...ADMIN_ABILITIES];
   }
+  return [...MEMBER_ABILITIES];
 }
-function createMailDriver() {
-  const driver = process.env.MAIL_DRIVER ?? "log";
-  if (driver === "smtp") {
-    return new SmtpMailDriver(resolveSmtpConfig());
+
+class GuestGuard {
+  resolve(request) {
+    const userId = request.headers.get("x-authenticated-user-id");
+    if (!userId) {
+      return null;
+    }
+    const role = request.headers.get("x-authenticated-user-role");
+    return {
+      id: userId,
+      abilities: devHeaderAbilities(role),
+      ...role ? { role } : {}
+    };
   }
-  return new LogMailDriver;
-}
-var appMailer = new Mailer(createMailDriver());
-function mailer() {
-  return appMailer;
 }
 
-// ../../src/core/storage/storage.ts
-import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join3 } from "path";
-var {S3Client } = globalThis.Bun;
-
-class LocalStorageDriver {
-  rootDirectory;
-  constructor(rootDirectory) {
-    this.rootDirectory = rootDirectory;
-  }
-  resolvePath(path) {
-    return join3(this.rootDirectory, path.replace(/^\/+/, ""));
-  }
-  async put(path, contents) {
-    const absolutePath = this.resolvePath(path);
-    await mkdir(dirname(absolutePath), { recursive: true });
-    await writeFile(absolutePath, contents);
-    return path;
+class ApiTokenGuard {
+  options;
+  constructor(options) {
+    this.options = options;
   }
-  async get(path) {
-    try {
-      return await readFile(this.resolvePath(path));
-    } catch {
+  resolve(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
       return null;
     }
-  }
-  async delete(path) {
-    try {
-      await unlink(this.resolvePath(path));
-      return true;
-    } catch {
-      return false;
+    const token = authorization.slice("Bearer ".length).trim();
+    if (token !== this.options.token) {
+      return null;
     }
+    return this.options.user;
   }
 }
 
-class S3StorageDriver {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async put(path, contents) {
-    await this.client.write(path.replace(/^\/+/, ""), contents);
-    return path;
-  }
-  async get(path) {
-    const normalizedPath = path.replace(/^\/+/, "");
-    const file = this.client.file(normalizedPath);
-    if (!await file.exists()) {
+class DatabaseTokenGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
       return null;
     }
-    return new Uint8Array(await file.arrayBuffer());
+    const token = authorization.slice("Bearer ".length).trim();
+    if (!token) {
+      return null;
+    }
+    if (!this.container.has(tokenServiceToken)) {
+      return null;
+    }
+    const tokenService = this.container.resolve(tokenServiceToken);
+    return await tokenService.resolveUserFromToken(token);
   }
-  async delete(path) {
-    try {
-      await this.client.unlink(path.replace(/^\/+/, ""));
-      return true;
-    } catch {
-      return false;
+}
+
+class CompositeGuard {
+  guards;
+  constructor(guards) {
+    this.guards = guards;
+  }
+  async resolve(request) {
+    for (const guard of this.guards) {
+      const user = await Promise.resolve(guard.resolve(request));
+      if (user) {
+        return user;
+      }
     }
+    return null;
   }
 }
 
-class StorageManager {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
+class AuthManager {
+  guard;
+  constructor(guard) {
+    this.guard = guard;
   }
-  put(path, contents) {
-    return this.driver.put(path, contents);
+  async resolve(request) {
+    if (request) {
+      return await Promise.resolve(this.guard.resolve(request));
+    }
+    return currentAuthUser();
   }
-  get(path) {
-    return this.driver.get(path);
+  user(request) {
+    return this.resolve(request);
   }
-  delete(path) {
-    return this.driver.delete(path);
+  async check(request) {
+    return await this.user(request) !== null;
   }
-}
-function resolveS3Config() {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
-  const bucket = process.env.AWS_BUCKET?.trim();
-  if (!accessKeyId || !secretAccessKey || !bucket) {
-    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  async requireUser(request) {
+    const user = await this.user(request);
+    if (!user) {
+      throw new UnauthorizedError;
+    }
+    return user;
   }
-  return {
-    accessKeyId,
-    secretAccessKey,
-    bucket,
-    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
-    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
-  };
-}
-function createS3Client(config = resolveS3Config()) {
-  return new S3Client({
-    accessKeyId: config.accessKeyId,
-    secretAccessKey: config.secretAccessKey,
-    bucket: config.bucket,
-    ...config.region ? { region: config.region } : {},
-    ...config.endpoint ? { endpoint: config.endpoint } : {}
-  });
 }
-function createStorageDriver() {
-  const driver = process.env.STORAGE_DRIVER ?? "local";
-  if (driver === "s3") {
-    return new S3StorageDriver(createS3Client());
+// ../../src/core/auth/membershipContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
   }
-  return new LocalStorageDriver(process.env.STORAGE_PATH ?? "storage");
-}
-var defaultStorage = new StorageManager(createStorageDriver());
-function storage() {
-  return defaultStorage;
-}
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
 
-// ../../src/core/facades/index.ts
-function cache() {
-  return resolveApplicationCache();
-}
-function auth() {
-  return resolveApplicationAuth();
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = new AsyncLocalStorage5;
+var membershipRepository = new memberRepository_default;
+async function runWithMembershipContext(callback) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return await callback();
+  }
+  const memberships = await membershipRepository.listForUser(resolveUserId(user));
+  const context = {
+    organizationIds: memberships.map((membership) => membership.organization_id),
+    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
+  };
+  return await membershipContext.run(context, callback);
 }
-function policyGate() {
-  return resolveApplicationPolicyGate();
+function currentOrgRole(organizationId) {
+  return membershipContext.getStore()?.rolesByOrganizationId.get(organizationId) ?? null;
 }
-function queue() {
-  return resolveApplicationQueue();
+function hasOrgMembership(organizationId) {
+  return currentOrgRole(organizationId) !== null;
 }
-function events() {
-  return eventBus;
+function currentOrganizationIds() {
+  return membershipContext.getStore()?.organizationIds ?? [];
 }
-function config(key) {
-  return resolveApplicationConfig().get(key);
+function hasMinimumOrgRole2(organizationId, minimum) {
+  const role = currentOrgRole(organizationId);
+  if (!role) {
+    return false;
+  }
+  const ranks = {
+    member: 1,
+    admin: 2,
+    owner: 3
+  };
+  return ranks[role] >= ranks[minimum];
 }
-function log() {
-  return resolveApplicationLogger();
+// ../../src/core/auth/membershipContextMiddleware.ts
+function createMembershipContextMiddleware() {
+  return async (_request, next) => {
+    return await runWithMembershipContext(async () => await next());
+  };
 }
-function mail() {
-  return mailer();
+
+// ../../src/core/auth/membershipMiddleware.ts
+function createMembershipMiddleware() {
+  return createMembershipContextMiddleware();
 }
-function storageFacade() {
-  return storage();
+// ../../src/core/auth/membershipScope.ts
+function resolveOrganizationScope() {
+  const user = currentAuthUser();
+  if (!user) {
+    return null;
+  }
+  if (isGlobalAdmin(user)) {
+    return null;
+  }
+  return currentOrganizationIds();
 }
-// ../../src/core/http/bodySizeLimitMiddleware.ts
-var DEFAULT_MAX_BODY_BYTES = 1048576;
-function resolveMaxBodyBytes() {
-  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_BODY_BYTES;
+function scopedOrganizationIds(requestedOrganizationId) {
+  const scope = resolveOrganizationScope();
+  if (scope === null) {
+    return requestedOrganizationId === undefined ? null : [requestedOrganizationId];
   }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_BODY_BYTES;
+  if (requestedOrganizationId !== undefined) {
+    return scope.includes(requestedOrganizationId) ? [requestedOrganizationId] : [];
   }
-  return parsed;
+  return scope;
 }
-function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
-  return async (request, next) => {
-    const contentLength = request.headers.get("content-length");
-    if (contentLength) {
-      const bytes = Number.parseInt(contentLength, 10);
-      if (Number.isInteger(bytes) && bytes > maxBytes) {
-        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-    }
-    return await next();
+function appendOrganizationScope(where, requestedOrganizationId) {
+  const organizationIds = scopedOrganizationIds(requestedOrganizationId);
+  if (organizationIds === null) {
+    return where;
+  }
+  if (organizationIds.length === 0) {
+    return {
+      ...where,
+      organization_id: [-1]
+    };
+  }
+  return {
+    ...where,
+    organization_id: organizationIds.length === 1 ? organizationIds[0] : organizationIds
   };
 }
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
+function appendProjectScope(where, accessibleProjectIds, requestedProjectId) {
+  if (accessibleProjectIds === null) {
+    if (requestedProjectId === undefined) {
+      return where;
     }
+    return {
+      ...where,
+      project_id: requestedProjectId
+    };
   }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+  if (accessibleProjectIds.length === 0) {
+    return {
+      ...where,
+      project_id: [-1]
+    };
   }
-  return null;
-}
-function readBunRequestCookie(request, name) {
-  return request.cookies.get(name) ?? readRequestCookie(request, name);
-}
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual } from "crypto";
-
-// ../../src/core/http/requestMetaContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
-var requestMetaContext = new AsyncLocalStorage3;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
+  if (requestedProjectId !== undefined) {
+    return {
+      ...where,
+      project_id: accessibleProjectIds.includes(requestedProjectId) ? requestedProjectId : -1
+    };
   }
-  return timingSafeEqual(leftBuffer, rightBuffer);
+  return {
+    ...where,
+    project_id: accessibleProjectIds
+  };
 }
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+function emptyPaginateResult(page, perPage) {
   return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+    data: [],
+    meta: {
+      page,
+      per_page: perPage,
+      total: 0,
+      last_page: 1
+    }
   };
 }
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
+function assertResourceInCurrentTenant(resourceTenantId, resourceLabel, resourceId) {
+  if (resourceTenantId !== currentTenantId()) {
+    throw new NotFoundError(`${resourceLabel} ${resourceId} not found.`);
   }
-  return createCsrfTokenCookie();
 }
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
+function assertOrganizationReadable(organizationId) {
+  const user = currentAuthUser();
+  if (!user || isGlobalAdmin(user)) {
+    return;
+  }
+  const organizationIds = scopedOrganizationIds();
+  if (organizationIds !== null && !organizationIds.includes(organizationId)) {
+    throw new NotFoundError(`Organization ${organizationId} not found.`);
   }
-  return null;
 }
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
+// ../../src/core/auth/membershipService.ts
+class MembershipService {
+  members;
+  constructor(members = membershipRepository) {
+    this.members = members;
   }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
+  async listOrganizationIdsForUser(userId) {
+    const memberships = await this.members.listForUser(userId);
+    return memberships.map((membership) => membership.organization_id);
+  }
+  async getOrgRole(userId, organizationId) {
+    const membership = await this.members.findMembership(userId, organizationId);
+    return membership?.role ?? null;
+  }
+  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
+    if (!user) {
+      throw new ForbiddenError("Authentication required.");
     }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
+    if (isGlobalAdmin(user)) {
+      return "owner";
     }
+    const role = await this.getOrgRole(resolveUserId(user), organizationId);
+    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
+      throw new ForbiddenError("Organization membership required.");
+    }
+    return role;
+  }
+  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
+    if (!user) {
+      return [];
+    }
+    if (isGlobalAdmin(user)) {
+      return organizationIds;
+    }
+    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
+    return organizationIds.filter((organizationId) => allowed.has(organizationId));
+  }
+  async addOwnerOnOrganizationCreate(organizationId, userId) {
+    await this.members.addMember({
+      organizationId,
+      userId,
+      role: "owner"
+    });
+  }
+  listMembersForOrganization(organizationId) {
+    return this.members.listForOrganization(organizationId);
+  }
+  addMember(input) {
+    return this.members.addMember(input);
+  }
+  removeMember(organizationId, userId) {
+    return this.members.removeMember(organizationId, userId);
   }
-  return null;
 }
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
+function resolveMembershipService() {
+  const dependencies = resolveApplicationDependencies();
+  if (dependencies.container.has("core.membership")) {
+    return dependencies.container.resolve("core.membership");
+  }
+  return new MembershipService;
+}
+var membershipService_default = MembershipService;
+// ../../src/core/auth/policy.ts
+class Policy {
+  constructor() {}
+  view(_user, _resource) {
     return false;
   }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (!cookieValue) {
+  create(_user) {
     return false;
   }
-  if (!tokensMatch(submittedToken, cookieValue)) {
+  update(_user, _resource) {
     return false;
   }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
+  delete(_user, _resource) {
+    return false;
   }
-  return resolveCsrfToken(request).token;
 }
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
 
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function appendSetCookie(response, cookie) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function createCsrfMiddleware() {
-  return async (request, next) => {
-    const method = request.method.toUpperCase();
-    if (!MUTATING_METHODS.has(method)) {
-      const csrf = resolveCsrfToken(request);
-      const meta = currentRequestMeta();
-      meta.csrfToken = csrf.token;
-      const response = await next();
-      if (!csrf.cookie) {
-        return response;
-      }
-      return appendSetCookie(response, csrf.cookie);
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
     }
-    const submitted = await readSubmittedCsrfTokenFromBody(request);
-    if (!verifyCsrfToken(request, submitted)) {
-      throw new ForbiddenError("Invalid or missing CSRF token.");
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
     }
-    return await next();
-  };
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
+  }
 }
-// ../../src/core/http/csrfProtection.ts
-var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
-function createCsrfProtection(secret, options = {}) {
-  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
-  const maxAge = options.maxAge ?? expiresIn;
-  return {
-    generate(_sessionKey) {
-      return Bun.CSRF.generate(secret, { expiresIn });
-    },
-    verify(token, _sessionKey) {
-      if (!token) {
-        return false;
-      }
-      return Bun.CSRF.verify(token, { secret, maxAge });
-    },
-    secret
-  };
+// ../../src/core/database/bindConnection.ts
+function bindDatabaseConnection2(connection) {
+  bindDatabaseConnection(connection);
 }
-// ../../src/core/crypto/nonCryptographicHash.ts
-function nonCryptographicDigest(input) {
-  return Bun.hash(input).toString(16);
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
 }
 
-// ../../src/core/http/etag.ts
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+// ../../src/core/security/scimTenantTokens.ts
+function parseScimTenantTokens(raw) {
+  const tokens = new Map;
+  if (!raw?.trim()) {
+    return tokens;
+  }
+  for (const entry of raw.split(",")) {
+    const [tenantPart, tokenPart] = entry.split(":");
+    if (!tenantPart || !tokenPart) {
+      continue;
+    }
+    const tenantId = Number.parseInt(tenantPart.trim(), 10);
+    const token = tokenPart.trim();
+    if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
+      tokens.set(tenantId, token);
+    }
+  }
+  return tokens;
 }
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
+function resolveScimTenantFromToken(token) {
+  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
+  for (const [tenantId, expectedToken] of tenantTokens) {
+    if (timingSafeCompareString(token, expectedToken)) {
+      return tenantId;
+    }
+  }
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
+  if (timingSafeCompareString(token, fallbackToken)) {
+    return 1;
+  }
+  return null;
 }
-function computeEtagFromJson(data) {
-  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
-  return formatWeakEtag(digest);
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await repositoryConnection`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
 }
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
-  return formatWeakEtag(digest);
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    return await runWithTenant(tenant, callback);
+  }
+  return await getDefaultDatabasePool().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
 }
-function normalizeEtag(value) {
-  return value.trim();
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
+
+// ../../src/core/auth/scimAuthMiddleware.ts
+function createScimAuthMiddleware() {
+  return async (request, next) => {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return jsonScimError("SCIM bearer token required.", 401);
+    }
+    const token = authorization.slice("Bearer ".length).trim();
+    const tenantId = resolveScimTenantFromToken(token);
+    if (tenantId === null) {
+      return jsonScimError("Invalid SCIM bearer token.", 401);
+    }
+    const tenant = await resolveTenant(tenantId);
+    if (!tenant) {
+      return jsonScimError("SCIM tenant not found.", 401);
+    }
+    return await runWithTenantDatabase(tenant, async () => {
+      bindDatabaseConnection2(getActiveDatabaseConnection(getDefaultDatabasePool()));
+      try {
+        return await next();
+      } finally {
+        resetBoundDatabaseConnection();
+      }
+    });
+  };
 }
-function parseEtagList(header) {
-  if (!header) {
-    return [];
-  }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+function jsonScimError(detail, status) {
+  return Response.json({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    detail,
+    status: String(status)
+  }, {
+    status,
+    headers: { "content-type": "application/scim+json" }
+  });
 }
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
+// ../../src/core/cache/taggedCache.ts
+class TaggedCache {
+  store;
+  tags;
+  constructor(store, tags) {
+    this.store = store;
+    this.tags = tags;
   }
-  if (header.trim() === "*") {
-    return true;
+  async remember(key, callback, ttlMs) {
+    const value = await this.store.getOrSet(key, callback, ttlMs);
+    await this.store.attachTags(key, this.tags);
+    return value;
+  }
+  async flush() {
+    return this.store.flushTags(this.tags);
   }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
+var taggedCache_default = TaggedCache;
+
+// ../../src/core/cache/repository.ts
+class CacheRepository {
+  store;
+  constructor(store) {
+    this.store = store;
   }
-  if (header.trim() === "*") {
-    return true;
+  async get(key) {
+    return this.store.get(key);
+  }
+  async remember(key, callback, ttlMs) {
+    return this.store.getOrSet(key, callback, ttlMs);
+  }
+  async forget(key) {
+    return this.store.invalidate(key);
+  }
+  async flush() {
+    await this.store.clear();
+  }
+  tags(...names) {
+    return new taggedCache_default(this.store, names);
+  }
+  async getOrSet(key, loader, ttlMs) {
+    return this.remember(key, loader, ttlMs);
+  }
+  async invalidate(key) {
+    return this.forget(key);
+  }
+  async invalidateByPrefix(prefix) {
+    return this.store.invalidateByPrefix(prefix);
   }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
-    }
-    return;
+  async clear() {
+    await this.flush();
   }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  async size() {
+    return this.store.size();
   }
 }
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
-}
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
-  });
-}
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
-  }
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
+var repository_default2 = CacheRepository;
+// ../../src/core/cache/tags.ts
+var CACHE_TAGS = {
+  organizations: "organizations",
+  projects: "projects",
+  tasks: "tasks",
+  comments: "comments",
+  attachments: "attachments",
+  reports: "reports"
+};
+// ../../src/core/database/migrations/advisoryLock.ts
+var MIGRATION_LOCK_KEY = 42424242;
+async function withMigrationLock(db2, callback, lockKey = MIGRATION_LOCK_KEY) {
+  await db2.unsafe("SELECT pg_advisory_lock($1)", [lockKey]);
+  try {
+    return await callback();
+  } finally {
+    await db2.unsafe("SELECT pg_advisory_unlock($1)", [lockKey]);
   }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
 }
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage4;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
+// ../../src/core/database/migrations/runner.ts
+import { readdir } from "fs/promises";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var MIGRATIONS_TABLE = "framework_migrations";
+async function ensureMigrationsTable(db2) {
+  await db2.unsafe(`
+    CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
+      name TEXT PRIMARY KEY,
+      batch INTEGER NOT NULL,
+      run_on TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `);
 }
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
+async function getAppliedMigrations(db2) {
+  await ensureMigrationsTable(db2);
+  return await db2.unsafe(`
+    SELECT name, batch
+    FROM ${MIGRATIONS_TABLE}
+    ORDER BY batch ASC, name ASC
+  `);
 }
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
+async function loadMigrationsFromDirectory(directory) {
+  const entries = await readdir(directory);
+  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedMigrations.filter((migration) => migration?.name !== undefined);
 }
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
+async function getMigrationStatus(db2, migrations) {
+  const applied = await getAppliedMigrations(db2);
+  const appliedByName = new Map(applied.map(({ name, batch }) => [name, Number(batch)]));
+  return migrations.map(({ name }) => ({
+    name,
+    status: appliedByName.has(name) ? "up" : "pending",
+    batch: appliedByName.get(name) ?? null
+  }));
 }
-
-// ../../src/core/http/validation.ts
-function buildRequestCacheKey(fallbackPath, request) {
-  if (!request) {
-    return fallbackPath;
+async function runPendingMigrations(db2, migrations, options = {}) {
+  const applied = await getAppliedMigrations(db2);
+  const appliedNames = new Set(applied.map(({ name }) => name));
+  const nextBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0) + 1;
+  const pendingMigrations = migrations.filter(({ name }) => !appliedNames.has(name));
+  for (const migration of pendingMigrations) {
+    options.onMigration?.(migration.name);
+    await migration.up(db2);
+    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
+    if (inserted.length === 0) {
+      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
+    }
   }
-  const url = new URL(request.url);
-  const user = currentAuthUser();
-  const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenantId()}`;
-  return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
+  return pendingMigrations.length;
 }
-function getQueryParams(request) {
-  if (!request) {
-    return new URLSearchParams;
+async function migrateDatabase(db2, migrations, options = {}) {
+  const { advisoryLock = false, onMigration } = options;
+  if (advisoryLock) {
+    return withMigrationLock(db2, () => runPendingMigrations(db2, migrations, { onMigration }));
   }
-  return new URL(request.url).searchParams;
+  return runPendingMigrations(db2, migrations, { onMigration });
 }
-function parseOptionalPositiveIntQueryParam(params, name) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    return;
+async function rollbackDatabase(db2, migrations, options = {}) {
+  const applied = await getAppliedMigrations(db2);
+  if (applied.length === 0) {
+    return 0;
   }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  const lastBatch = applied.reduce((currentMax, { batch }) => Math.max(currentMax, Number(batch)), 0);
+  const migrationsToRollback = new Set(applied.filter(({ batch }) => Number(batch) === lastBatch).map(({ name }) => name));
+  let rolledBack = 0;
+  for (const migration of [...migrations].reverse()) {
+    if (!migrationsToRollback.has(migration.name)) {
+      continue;
+    }
+    options.onMigration?.(migration.name);
+    await migration.down(db2);
+    await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE} WHERE name = $1`, [migration.name]);
+    rolledBack += 1;
   }
-  return parsed;
+  return rolledBack;
 }
-function parseOptionalBooleanQueryParam(params, name) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
+async function freshDatabase(db2, migrations, options = {}) {
+  const runFresh = async () => {
+    const applied = await getAppliedMigrations(db2);
+    const appliedNames = new Set(applied.map(({ name }) => name));
+    const appliedMigrations = migrations.filter(({ name }) => appliedNames.has(name));
+    for (const migration of [...appliedMigrations].reverse()) {
+      options.onMigration?.(migration.name);
+      await migration.down(db2);
+    }
+    if (appliedMigrations.length > 0) {
+      await db2.unsafe(`DELETE FROM ${MIGRATIONS_TABLE}`);
+    }
+    await runPendingMigrations(db2, migrations, options);
+  };
+  if (options.advisoryLock) {
+    await withMigrationLock(db2, runFresh);
     return;
   }
-  switch (value.toLowerCase()) {
-    case "true":
-    case "1":
-      return true;
-    case "false":
-    case "0":
-      return false;
-    default:
-      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
-  }
+  await runFresh();
 }
-function parseOptionalEnumQueryParam(params, name, allowedValues) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    return;
-  }
-  if (!allowedValues.includes(value)) {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
-  }
-  return value;
+// ../../src/core/database/seeders/runner.ts
+import { readdir as readdir2 } from "fs/promises";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadSeedersFromDirectory(directory) {
+  const entries = await readdir2(directory);
+  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL2(join2(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
 }
-function expectObject(value, label = "request body") {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new BadRequestError(`${label} must be a JSON object.`);
+async function runSeedersFromDirectory(directory, db2, options) {
+  const seeders = await loadSeedersFromDirectory(directory);
+  if (seeders.length === 0) {
+    return 0;
   }
-  return value;
-}
-async function parseJsonBody(request, validator) {
-  let payload;
-  try {
-    payload = await request.json();
-  } catch {
-    throw new BadRequestError("Request body must be valid JSON.");
+  for (const seeder of seeders) {
+    options?.onSeeder?.(seeder.name);
+    await seeder.run(db2);
   }
-  return validator(payload);
+  return seeders.length;
 }
-function readRequiredString(payload, field, options = {}) {
-  const value = payload[field];
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new BadRequestError(`"${field}" is required and must be a string.`);
-  }
-  const trimmed = value.trim();
-  if (options.minLength !== undefined && trimmed.length < options.minLength) {
-    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
+// ../../src/core/mail/mailer.ts
+function resolveSmtpConfig() {
+  const host = process.env.MAIL_HOST?.trim();
+  if (!host) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_HOST to be set.');
   }
-  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
-    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
+  const from = process.env.MAIL_FROM?.trim();
+  if (!from) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
   }
-  if (options.pattern && !options.pattern.test(trimmed)) {
-    throw new BadRequestError(`"${field}" has an invalid format.`);
+  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
   }
-  return trimmed;
+  return {
+    host,
+    port,
+    from,
+    secure: (process.env.MAIL_SECURE ?? "false") === "true",
+    ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
+    ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
+  };
 }
-function readOptionalString(payload, field, options = {}) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
+function encodeBase64(value) {
+  return Buffer.from(value, "utf8").toString("base64");
+}
+function parseSmtpResponses(buffer) {
+  const responses = [];
+  let remainder = buffer;
+  while (remainder.includes(`\r
+`)) {
+    const index = remainder.indexOf(`\r
+`);
+    const line = remainder.slice(0, index);
+    remainder = remainder.slice(index + 2);
+    if (line.length >= 4 && line[3] === "-") {
+      continue;
+    }
+    responses.push(line);
   }
-  return readRequiredString(payload, field, options);
+  return { responses, remainder };
 }
-function readRequiredEnum(payload, field, allowedValues) {
-  const value = readRequiredString(payload, field);
-  if (!allowedValues.includes(value)) {
-    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+async function waitForSmtpResponse(readResponse, expectedCodes) {
+  const response = await readResponse();
+  const code = response.slice(0, 3);
+  if (!expectedCodes.includes(code)) {
+    throw new Error(`Unexpected SMTP response: ${response}`);
   }
-  return value;
+  return response;
 }
-function readOptionalEnum(payload, field, allowedValues) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
-  }
-  return readRequiredEnum(payload, field, allowedValues);
+async function openSmtpConnection(config) {
+  let buffer = "";
+  const waiters = [];
+  const readResponse = () => new Promise((resolve, reject) => {
+    const parsed = parseSmtpResponses(buffer);
+    if (parsed.responses.length > 0) {
+      buffer = parsed.remainder;
+      resolve(parsed.responses.shift());
+      return;
+    }
+    waiters.push({ resolve, reject });
+  });
+  const socket = await Bun.connect({
+    hostname: config.host,
+    port: config.port,
+    socket: {
+      open() {},
+      data(_socket, chunk) {
+        buffer += Buffer.from(chunk).toString("utf8");
+        const parsed = parseSmtpResponses(buffer);
+        buffer = parsed.remainder;
+        while (parsed.responses.length > 0 && waiters.length > 0) {
+          const response = parsed.responses.shift();
+          waiters.shift()?.resolve(response);
+        }
+      },
+      error(_socket, error) {
+        const pending = waiters.splice(0);
+        for (const waiter of pending) {
+          waiter.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+      }
+    }
+  });
+  return { socket, readResponse };
 }
-function readRequiredPositiveInt(payload, field) {
-  const value = payload[field];
-  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
+async function defaultSmtpTransport(config, message) {
+  const { socket, readResponse } = await openSmtpConnection(config);
+  try {
+    await waitForSmtpResponse(readResponse, ["220"]);
+    await socket.write(`EHLO workhub.local\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    if (config.username && config.password) {
+      await socket.write(`AUTH LOGIN\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.username)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.password)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["235"]);
+    }
+    await socket.write(`MAIL FROM:<${config.from}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`RCPT TO:<${message.to}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250", "251"]);
+    await socket.write(`DATA\r
+`);
+    await waitForSmtpResponse(readResponse, ["354"]);
+    const payload = buildSmtpPayload(config.from, message);
+    await socket.write(payload);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`QUIT\r
+`);
+    await waitForSmtpResponse(readResponse, ["221"]);
+  } finally {
+    socket.end();
   }
-  return value;
 }
-function readOptionalPositiveInt(payload, field) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
+function buildSmtpPayload(from, message) {
+  const headers = [
+    `From: ${from}`,
+    `To: ${message.to}`,
+    `Subject: ${message.subject}`,
+    "MIME-Version: 1.0"
+  ];
+  if (message.html) {
+    const boundary = `strata-${Date.now().toString(36)}`;
+    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+    const parts = [
+      `--${boundary}`,
+      "Content-Type: text/plain; charset=utf-8",
+      "",
+      message.body,
+      `--${boundary}`,
+      "Content-Type: text/html; charset=utf-8",
+      "",
+      message.html,
+      `--${boundary}--`,
+      ""
+    ];
+    return [...headers, "", ...parts, ".", ""].join(`\r
+`);
   }
-  return readRequiredPositiveInt(payload, field);
+  headers.push("Content-Type: text/plain; charset=utf-8");
+  return [...headers, "", message.body, ".", ""].join(`\r
+`);
 }
-function parsePositiveIntParam(value, name = "id") {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+
+class LogMailDriver {
+  async send(message) {
+    console.log(JSON.stringify({
+      level: "info",
+      channel: "mail",
+      to: message.to,
+      subject: message.subject,
+      body: message.body,
+      ...message.html ? { html: message.html } : {}
+    }));
   }
-  return parsed;
 }
 
-// ../../src/core/http/formRequest.ts
-class FormRequest {
-  authorize(_request) {
-    return true;
+class SmtpMailDriver {
+  config;
+  transport;
+  constructor(config, transport = defaultSmtpTransport) {
+    this.config = config;
+    this.transport = transport;
   }
-  async validate(request) {
-    if (!await this.authorize(request)) {
-      throw new ForbiddenError;
-    }
-    return await parseJsonBody(request, (payload) => this.parse(payload));
+  send(message) {
+    return this.transport(this.config, message);
   }
 }
 
-class QueryFormRequest {
-  validate(request) {
-    return this.parseQuery(request);
+class Mailer {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
   }
-}
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
+  send(message) {
+    return this.driver.send(message);
   }
-  if (mode === "spa-react") {
-    return "spa-react";
+}
+function createMailDriver() {
+  const driver = process.env.MAIL_DRIVER ?? "log";
+  if (driver === "smtp") {
+    return new SmtpMailDriver(resolveSmtpConfig());
   }
-  return "api";
+  return new LogMailDriver;
 }
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
+var appMailer = new Mailer(createMailDriver());
+function mailer() {
+  return appMailer;
 }
 
-// ../../src/core/view/etaViewEngine.ts
-import { join as join4 } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+var {S3Client } = globalThis.Bun;
 
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
   }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
   }
-}
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-// ../../src/core/auth/oauth/oidcProvider.ts
-class OidcProvider {
-  options;
-  name;
-  constructor(options) {
-    this.options = options;
-    this.name = options.name;
-  }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      response_type: "code",
-      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
-      state
-    });
-    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.options.redirectUri,
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("OIDC token exchange failed.");
-    }
-    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
-      headers: { authorization: `Bearer ${tokenBody.access_token}` }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: profile.sub,
-      email: profile.email ?? `${profile.sub}@oidc.local`,
-      name: profile.name ?? profile.sub
-    };
+  resolvePath(path) {
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
-}
-
-// ../../src/core/auth/oauth/providers.ts
-class GitHubOAuthProvider {
-  options;
-  name = "github";
-  constructor(options) {
-    this.options = options;
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
   }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      scope: "read:user user:email",
-      state
-    });
-    return `https://github.com/login/oauth/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret,
-        code,
-        redirect_uri: this.options.redirectUri
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("GitHub OAuth token exchange failed.");
-    }
-    const profileResponse = await fetch("https://api.github.com/user", {
-      headers: {
-        authorization: `Bearer ${tokenBody.access_token}`,
-        accept: "application/json",
-        "user-agent": "workhub"
-      }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: String(profile.id),
-      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
-      name: profile.name ?? profile.login
-    };
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
   }
 }
 
-class MockOAuthProvider {
-  profile;
-  name = "mock";
-  constructor(profile) {
-    this.profile = profile;
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
   }
-  getAuthorizationUrl(state) {
-    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
   }
-  async exchangeCode(code) {
-    if (code !== "valid-code") {
-      throw new Error("Invalid OAuth code.");
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
     }
-    return this.profile;
   }
 }
 
-// ../../src/core/auth/oauth/samlProvider.ts
-class SamlProvider {
-  loginUrl;
-  name = "saml";
-  constructor(loginUrl) {
-    this.loginUrl = loginUrl;
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
   }
-  getAuthorizationUrl(state) {
-    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  put(path, contents) {
+    return this.driver.put(path, contents);
   }
-  async exchangeCode(code) {
-    if (!code.startsWith("saml:")) {
-      throw new Error("Invalid SAML assertion reference.");
-    }
-    const [, email, name] = code.split(":");
-    return {
-      providerUserId: email ?? "saml-user",
-      email: email ?? "saml-user@workhub.test",
-      name: name ?? "SAML User"
-    };
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
   }
 }
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
   return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
   };
 }
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-// ../../src/modules/user/apiTokenTable.ts
-var apiTokenTable = defineTable({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/core/auth/password.ts
-async function hashPassword(password) {
-  return await Bun.password.hash(password, {
-    algorithm: "bcrypt",
-    cost: 10
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
   });
 }
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
-  }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
   }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+  return new LocalStorageDriver;
 }
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
-  }
-  if (featureFlag === "true") {
-    return true;
+var defaultStorage = { current: null };
+function storage() {
+  if (!defaultStorage.current) {
+    defaultStorage.current = new StorageManager(createStorageDriver());
   }
-  return (process.env.APP_ENV ?? "local") === "production";
+  return defaultStorage.current;
 }
-function encryptField(plaintext, key) {
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
-  return `${ENCRYPTION_PREFIX}${payload}`;
+function resetDefaultStorage() {
+  defaultStorage.current = null;
 }
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
-  }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+
+// ../../src/core/facades/index.ts
+function cache() {
+  return resolveApplicationCache();
 }
-function hashLookupValue(normalizedValue, key) {
-  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+function auth() {
+  return resolveApplicationAuth();
 }
-function normalizeEmail(email) {
-  return email.trim().toLowerCase();
+function policyGate() {
+  return resolveApplicationPolicyGate();
 }
-function protectEmail(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return { storedEmail: normalized, emailLookup: normalized };
-  }
-  return {
-    storedEmail: encryptField(normalized, key),
-    emailLookup: hashLookupValue(normalized, key)
-  };
+function queue() {
+  return resolveApplicationQueue();
 }
-function revealEmail(storedEmail) {
-  const key = resolveEncryptionKey();
-  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
-    return storedEmail;
-  }
-  return decryptField(storedEmail, key);
+function events() {
+  return eventBus;
 }
-function emailLookupForQuery(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return normalized;
-  }
-  return hashLookupValue(normalized, key);
+function config(key) {
+  return resolveApplicationConfig().get(key);
 }
-
-// ../../src/core/crypto/mfaSecret.ts
-function protectMfaSecret(secret) {
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key) {
-    return secret;
-  }
-  return encryptField(secret, key);
+function log() {
+  return resolveApplicationLogger();
 }
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
+function mail() {
+  return mailer();
+}
+function storageFacade() {
+  return storage();
+}
+// ../../src/core/http/bodySizeLimitMiddleware.ts
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+function resolveMaxBodyBytes() {
+  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_BODY_BYTES;
   }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_BODY_BYTES;
   }
-  return decryptField(stored, key);
+  return parsed;
+}
+function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
+  return async (request, next) => {
+    const contentLength = request.headers.get("content-length");
+    if (contentLength) {
+      const bytes = Number.parseInt(contentLength, 10);
+      if (Number.isInteger(bytes) && bytes > maxBytes) {
+        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+    }
+    return await next();
+  };
+}
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
 }
 
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function computeEtagFromJson(data) {
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
   }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
+  if (header.trim() === "*") {
+    return true;
   }
-  return parsed;
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
     }
-    bits += value.toString(2).padStart(5, "0");
+    return;
   }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
   }
-  return Buffer.from(bytes);
 }
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
 }
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
   }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
-    }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
   }
-  return false;
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 
-// ../../src/domain/abilities.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
-  "auth:tokens:read",
-  "auth:tokens:write"
-];
-var ADMIN_ABILITIES = [
-  ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
-  "webhooks:read",
-  "webhooks:write",
-  "audit:read"
-];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
+// ../../src/core/http/conditionalResponse.ts
+function jsonResponse(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
+  });
+}
+function conditionalJsonResponse(request, data, init = {}) {
+  if (!request || !isEtagEnabled()) {
+    return jsonResponse(data, init);
   }
-  return [...MEMBER_ABILITIES];
+  const etag = computeEtagFromJson(data);
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const response = jsonResponse(data, init);
+  const headers = new Headers(response.headers);
+  headers.set("ETag", etag);
+  headers.set("Cache-Control", "private, must-revalidate");
+  headers.append("Vary", "Authorization");
+  headers.append("Vary", "X-Tenant-Id");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
   }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
   }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
   }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+// ../../src/config/cors.ts
+var corsConfig = {
+  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+  allowedHeaders: [
+    "Authorization",
+    "Content-Type",
+    "X-Request-Id",
+    "X-Tenant-Id",
+    "X-Authenticated-User-Id",
+    "X-Authenticated-User-Role",
+    "If-Match",
+    "If-None-Match"
+  ],
+  maxAgeSeconds: 86400
+};
+
+// ../../src/core/http/corsMiddleware.ts
+function createCorsMiddleware() {
+  return async (request, next) => {
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request)
+      });
     }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request)) {
+      headers.set(key, value);
     }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
     });
+  };
+}
+function buildCorsHeaders(request) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const allowedOrigins = corsConfig.allowedOrigins;
+  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  headers.set("Vary", "Origin");
+  return headers;
+}
+// ../../src/core/http/csrfToken.ts
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+}
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual2(leftBuffer, rightBuffer);
+}
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
   }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
   }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
     }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
   }
+  return null;
 }
-
-// ../../src/modules/user/notificationTable.ts
-var notificationTable = defineTable({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
-
-// ../../src/modules/user/oauthIdentityRepository.ts
-var oauthIdentityTable = defineTable({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/table.ts
-var userTable = defineTable({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac as createHmac3 } from "crypto";
-function resolveTokenPepper() {
-  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (!cookieValue) {
+    return false;
+  }
+  if (!tokensMatch(submittedToken, cookieValue)) {
+    return false;
+  }
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
-function hashApiToken(token) {
-  const pepper = resolveTokenPepper();
-  if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac3("sha256", pepper).update(token).digest("hex");
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
   }
-  return createHash("sha256").update(token).digest("hex");
+  return resolveCsrfToken(request).token;
 }
 
-// ../../src/modules/user/provider.ts
-var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
-
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function appendSetCookie(response, cookie) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", cookie);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function createCsrfMiddleware() {
+  return async (request, next) => {
+    const method = request.method.toUpperCase();
+    if (!MUTATING_METHODS.has(method)) {
+      const csrf = resolveCsrfToken(request);
+      const meta = currentRequestMeta();
+      meta.csrfToken = csrf.token;
+      const response = await next();
+      if (!csrf.cookie) {
+        return response;
+      }
+      return appendSetCookie(response, csrf.cookie);
+    }
+    const submitted = await readSubmittedCsrfTokenFromBody(request);
+    if (!verifyCsrfToken(request, submitted)) {
+      throw new ForbiddenError("Invalid or missing CSRF token.");
+    }
+    return await next();
+  };
+}
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -4252,7 +4480,7 @@ function parseFlashCookie(cookieValue) {
   if (expectedBuffer.length !== actualBuffer.length) {
     return null;
   }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
     return null;
   }
   try {
@@ -4268,41 +4496,146 @@ function parseFlashCookie(cookieValue) {
     return null;
   }
 }
-function createFlashCookie(message) {
-  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
-  const issuedAt = Date.now();
-  const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/http/flashMiddleware.ts
+function createFlashMiddleware() {
+  return async (request, next) => {
+    const flash = pullFlash(request);
+    const meta = currentRequestMeta();
+    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
+      const response = await next();
+      if (flash) {
+        return withFlashClear(response);
+      }
+      return response;
+    });
+  };
+}
+// ../../src/core/http/validation.ts
+function buildRequestCacheKey(fallbackPath, request) {
+  if (!request) {
+    return fallbackPath;
+  }
+  const url = new URL(request.url);
+  const user = currentAuthUser();
+  const authScope = user ? `u:${user.id}` : "guest";
+  const tenantScope = `t:${currentTenantId()}`;
+  return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
+}
+function getQueryParams(request) {
+  if (!request) {
+    return new URLSearchParams;
+  }
+  return new URL(request.url).searchParams;
+}
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/formRequest.ts
+class FormRequest {
+  authorize(_request) {
+    return true;
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    return await parseJsonBody(request, (payload) => this.parse(payload));
+  }
+}
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
 }
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
+
+// ../../src/core/view/etaViewEngine.ts
+import { join as join4 } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
   }
-  return parseFlashCookie(cookieValue);
 }
-function flashResponse(response, message) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", createFlashCookie(message));
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
   });
 }
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
 }
-
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
@@ -4423,7 +4756,7 @@ function createAuthMiddleware(auth2) {
 // ../../src/core/http/authorizeMiddleware.ts
 function createAuthorizeMiddleware(gate, auth2, resource, action) {
   return async (request, next) => {
-    const user = await auth2.resolve(request);
+    const user = currentAuthUser() ?? await auth2.resolve(request);
     if (!gate.allows(resource, action, user)) {
       const error = new ForbiddenError;
       return Response.json({ error: error.message }, { status: error.status });
@@ -4431,33 +4764,6 @@ function createAuthorizeMiddleware(gate, auth2, resource, action) {
     return await next();
   };
 }
-// ../../src/core/http/conditionalResponse.ts
-function jsonResponse(data, init = {}) {
-  return Response.json(data, {
-    status: init.status ?? 200,
-    headers: init.headers
-  });
-}
-function conditionalJsonResponse(request, data, init = {}) {
-  if (!request || !isEtagEnabled()) {
-    return jsonResponse(data, init);
-  }
-  const etag = computeEtagFromJson(data);
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
-  }
-  const response = jsonResponse(data, init);
-  const headers = new Headers(response.headers);
-  headers.set("ETag", etag);
-  headers.set("Cache-Control", "private, must-revalidate");
-  headers.append("Vary", "Authorization");
-  headers.append("Vary", "X-Tenant-Id");
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 // ../../src/core/http/middleware.ts
 function isRouteHandler(value) {
   return typeof value === "function";
@@ -4598,7 +4904,8 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
     const model = await resolver(id, request);
     const gate = resolveApplicationPolicyGate();
     const auth2 = resolveApplicationAuth();
-    gate.authorize(authorization.resource, authorization.action, await auth2.resolve(request), model);
+    const user = currentAuthUser() ?? await auth2.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
       assertIfMatch(request, etagFromResource(model), {
         required: authorization.requireIfMatch ?? true
@@ -4620,7 +4927,8 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     const model = await resolver(key, request);
     const gate = resolveApplicationPolicyGate();
     const auth2 = resolveApplicationAuth();
-    gate.authorize(authorization.resource, authorization.action, await auth2.resolve(request), model);
+    const user = currentAuthUser() ?? await auth2.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
       assertIfMatch(request, etagFromResource(model), {
         required: authorization.requireIfMatch ?? true
@@ -4706,10 +5014,6 @@ async function parseMultipartUpload(request, fieldName = "file") {
     contents: new Uint8Array(await value.arrayBuffer())
   };
 }
-// ../../src/core/http/route.ts
-function getRouteParams(request) {
-  return request.params;
-}
 
 // ../../src/core/http/index.ts
 function jsonResponse2(data, init = {}) {
@@ -4898,6 +5202,38 @@ function createMetricsMiddleware() {
     return response;
   };
 }
+// ../../src/core/http/requireAbilityMiddleware.ts
+function createRequireAbilityMiddleware(abilityChecker) {
+  return (ability) => {
+    return async (_request, next) => {
+      const user = currentAuthUser();
+      try {
+        abilityChecker.requireAbility(user, ability);
+      } catch (error) {
+        if (error instanceof ForbiddenError) {
+          return Response.json({ error: error.message }, { status: error.status });
+        }
+        throw error;
+      }
+      return await next();
+    };
+  };
+}
+// ../../src/core/http/requireGlobalAdminMiddleware.ts
+function createRequireGlobalAdminMiddleware() {
+  return async (_request, next) => {
+    const user = currentAuthUser();
+    if (!isGlobalAdmin(user)) {
+      logSecurityEvent("privilege_escalation_blocked", {
+        required_role: "platform_admin",
+        path: new URL(_request.url).pathname
+      });
+      const error = new ForbiddenError("Platform admin access required.");
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
+}
 // ../../src/core/http/requireWebAuthMiddleware.ts
 function createRequireWebAuthMiddleware(auth2) {
   return async (request, next) => {
@@ -4912,6 +5248,25 @@ function createRequireWebAuthMiddleware(auth2) {
     return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
   };
 }
+// ../../src/core/http/scimThrottleMiddleware.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+function createScimThrottleMiddleware(options) {
+  const client = options.redisUrl ? new RedisClient2(options.redisUrl) : null;
+  return async (request, next) => {
+    const identity = request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+    const key = `workhub:scim-throttle:${identity}`;
+    if (client) {
+      const attempts = Number(await client.incr(key));
+      if (attempts === 1) {
+        await client.expire(key, options.decaySeconds);
+      }
+      if (attempts > options.maxAttempts) {
+        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
+      }
+    }
+    return await next();
+  };
+}
 // ../../src/config/app.ts
 var appConfig = {
   name: "WorkHub",
@@ -4986,7 +5341,7 @@ function createSecurityHeadersMiddleware() {
   };
 }
 // ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
+var {RedisClient: RedisClient3 } = globalThis.Bun;
 function resolveThrottleIdentity(request) {
   const user = currentAuthUser();
   if (user?.tokenId !== undefined) {
@@ -4998,7 +5353,7 @@ function resolveThrottleIdentity(request) {
   return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
 }
 function createThrottleMiddleware(options) {
-  const client = new RedisClient2(options.redisUrl);
+  const client = new RedisClient3(options.redisUrl);
   const prefix = options.keyPrefix ?? "workhub:throttle:";
   return async (request, next) => {
     const identity = resolveThrottleIdentity(request);
@@ -5099,10 +5454,28 @@ function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
     });
   }
 }
-function resetGracefulShutdownForTests() {
-  shutdownHandlers.clear();
-  shutdownInstalled = false;
-  shuttingDown = false;
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
+  };
 }
 // ../../src/core/mail/markdownMail.ts
 function escapeHtml(value) {
@@ -5399,7 +5772,7 @@ async function runQueueJob(envelope, failedJobs) {
 }
 
 // ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
+var {RedisClient: RedisClient4 } = globalThis.Bun;
 var QUEUE_LIST_KEY = "workhub:queue:default";
 var QUEUE_HIGH_KEY = "workhub:queue:high";
 var QUEUE_LOW_KEY = "workhub:queue:low";
@@ -5449,7 +5822,7 @@ function parseQueueJobEnvelope(rawPayload) {
 class RedisQueue {
   client;
   constructor(redisUrl) {
-    this.client = new RedisClient3(redisUrl);
+    this.client = new RedisClient4(redisUrl);
   }
   async dispatch(job, payload) {
     const name = jobRegistry.resolveName(job);
@@ -5475,7 +5848,7 @@ class QueueWorker {
   constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
     this.failedJobs = failedJobs;
     this.timeoutSeconds = timeoutSeconds;
-    this.client = new RedisClient3(redisUrl);
+    this.client = new RedisClient4(redisUrl);
   }
   requestStop() {
     this.stopping = true;
@@ -5572,6 +5945,68 @@ function createProductionQueue(driver, options = {}) {
 function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
+// ../../src/core/queue/queueMetrics.ts
+var {RedisClient: RedisClient5 } = globalThis.Bun;
+
+// ../../src/core/security/safeUrl.ts
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+
+// ../../src/core/queue/queueMetrics.ts
+async function readRedisQueueDepth(redisUrl) {
+  const client = new RedisClient5(redisUrl);
+  const [high, defaultQueue, low] = await Promise.all([
+    client.llen(QUEUE_HIGH_KEY),
+    client.llen(QUEUE_LIST_KEY),
+    client.llen(QUEUE_LOW_KEY)
+  ]);
+  return {
+    high: Number(high ?? 0),
+    default: Number(defaultQueue ?? 0),
+    low: Number(low ?? 0),
+    total: Number(high ?? 0) + Number(defaultQueue ?? 0) + Number(low ?? 0)
+  };
+}
+async function collectQueueMetrics() {
+  const driver = queueConfig.driver;
+  const failedJobs = createFailedJobService();
+  const failedCount = (await failedJobs.listRecent(1000)).length;
+  if (driver !== "redis") {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  const redisUrl = process.env.REDIS_URL;
+  if (!redisUrl) {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  return {
+    driver,
+    pending: await readRedisQueueDepth(redisUrl),
+    failedCount
+  };
+}
 // ../../src/core/scheduler/schedule.ts
 class Schedule {
   tasks = [];
@@ -5604,6 +6039,185 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   }
   return due.length;
 }
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash } from "crypto";
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await repositoryConnection`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+function auditChecksum(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    const pathname = new URL(request.url).pathname;
+    if (pathname.startsWith("/scim/")) {
+      return await next();
+    }
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+// ../../src/core/tracing/traceContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
+var traceContextStorage = new AsyncLocalStorage6;
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+function currentTraceId() {
+  return traceContextStorage.getStore()?.traceId ?? null;
+}
+// ../../src/core/tracing/otel.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function randomHex(bytes) {
+  return randomBytes2(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
 // ../../src/core/validation/rules.ts
 function required() {
   return (field, value) => {
@@ -5646,45 +6260,6 @@ function maxLength(maximum) {
     return;
   };
 }
-function pattern(expression) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (!expression.test(value.trim())) {
-      return `"${field}" has an invalid format.`;
-    }
-    return;
-  };
-}
-function enumRule(allowedValues) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (!allowedValues.includes(value)) {
-      return `"${field}" must be one of: ${allowedValues.join(", ")}.`;
-    }
-    return;
-  };
-}
-function optional() {
-  return () => {
-    return;
-  };
-}
-function integerRule() {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed)) {
-      return `"${field}" must be an integer.`;
-    }
-    return;
-  };
-}
 function emailRule() {
   return (field, value) => {
     if (typeof value !== "string") {
@@ -5697,40 +6272,6 @@ function emailRule() {
     return;
   };
 }
-function confirmed(fieldName) {
-  return (field, value, payload) => {
-    const confirmationKey = `${fieldName}_confirmation`;
-    const confirmation = payload[confirmationKey];
-    if (value !== confirmation) {
-      return `"${field}" confirmation does not match.`;
-    }
-    return;
-  };
-}
-function positiveIntegerRule() {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed) || parsed <= 0) {
-      return `"${field}" must be a positive integer.`;
-    }
-    return;
-  };
-}
-function integerRange(minimum, maximum) {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
-      return `"${field}" must be an integer between ${minimum} and ${maximum}.`;
-    }
-    return;
-  };
-}
 function validateObject(payload, schema) {
   if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
     throw new ValidationError("Request body must be a JSON object.");
@@ -5755,6 +6296,7 @@ function validateObject(payload, schema) {
   return output;
 }
 export {
+  wrapRouteHandler,
   wrapMarkdownMailLayout,
   withMigrationLock,
   withMiddleware,
@@ -5771,6 +6313,11 @@ export {
   sendMarkdownMail,
   securedBindRouteModelByKey,
   securedBindRouteModel,
+  scopedOrganizationIds,
+  runWithTraceContext,
+  runWithTenantDatabase,
+  runWithTenant,
+  runWithRequestMeta,
   runWithDatabaseConnection,
   runWithAuthUser,
   runSeedersFromDirectory,
@@ -5780,7 +6327,12 @@ export {
   runDueScheduledTasks,
   rollbackDatabase,
   resolveWebLayoutData,
+  resolveUserTenantId,
+  resolveUserId,
   resolveService,
+  resolveRepositoryConnection,
+  resolveOrganizationScope,
+  resolveMembershipService,
   resolveDatabaseDriver,
   resolveCsrfTokenForRequest,
   resolveCsrfToken,
@@ -5791,10 +6343,14 @@ export {
   resolveApplicationConfig,
   resolveApplicationCache,
   resolveApplicationAuth,
+  resetDefaultStorage,
   required,
+  requestIdMiddleware,
+  repositoryConnection,
   renderMarkdownMail,
   registerShutdownHandler,
   registerModelRepository,
+  registerDefaultDatabasePool,
   readSubmittedCsrfTokenFromBody,
   readSubmittedCsrfToken,
   readRequestCookie,
@@ -5802,7 +6358,9 @@ export {
   queue,
   prometheusRegistry,
   policyGate,
+  parsePositiveIntParam,
   parsePaginationQuery,
+  parseMultipartUpload,
   paginatedResponse,
   normalizeMetricPath,
   noContentResponse,
@@ -5815,12 +6373,16 @@ export {
   markdownToHtml,
   mailer,
   mail,
+  logSecurityEvent,
   log,
   loadSeedersFromDirectory,
   loadMigrationsFromDirectory,
   jsonResponse2 as jsonResponse,
   jobRegistry,
+  isPublicReadsEnabled,
+  isInsideTenantDatabaseScope,
   isHtmxRequest,
+  isGlobalAdmin,
   isEtagEnabled,
   installGracefulShutdownSignals,
   inferReferencedTable,
@@ -5833,55 +6395,90 @@ export {
   indexBelongsToManyRelation,
   hydrateValue,
   htmlResponse,
+  hasOrgMembership,
   hasOne,
+  hasMinimumOrgRole2 as hasMinimumOrgRole,
   hasMany,
+  guestCanViewResource,
   grammarForDriver,
   getMigrationStatus,
+  getDefaultDatabaseQuery,
+  getDefaultDatabasePool,
   getActiveDatabaseConnection,
   freshDatabase,
   formatAdminValue,
   filterMassAssignable,
   events,
   etagFromResource,
+  emptyPaginateResult,
   emailRule,
   dehydrateValue,
   defineTable,
+  currentTraceId,
+  currentTenantId,
+  currentTenant,
+  currentRequestMeta,
+  currentOrganizationIds,
+  currentOrgRole,
   currentAuthUser,
   createdResponse,
   createTrackedJob,
+  createTracingMiddleware,
   createThrottleMiddleware,
+  createTenantMiddleware,
+  createStorageDriver,
   createSecurityHeadersMiddleware,
+  createScimThrottleMiddleware,
+  createScimAuthMiddleware,
   createSchemaBuilder,
   createRequireWebAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
   createRequireAuthMiddleware,
+  createRequireAbilityMiddleware,
+  createRequestLoggingMiddleware,
   createQueueWorker,
   createQueue,
   createProductionQueue,
   createNotificationDispatcher,
   createMetricsMiddleware,
   createMemoryThrottleMiddleware,
+  createMembershipMiddleware,
   createLoginThrottleMiddleware,
+  createFlashMiddleware,
   createFailedJobService,
-  createDatabaseConnection2 as createDatabaseConnection,
+  createDatabaseQueryProxy,
+  createDatabaseConnection,
   createCsrfTokenCookie,
   createCsrfProtection,
   createCsrfMiddleware,
+  createCorsMiddleware,
   createBodySizeLimitMiddleware,
   createAuthorizeMiddleware,
   createAuthMiddleware,
   config,
+  conditionalJsonResponse,
   composeMiddleware,
   compileBlueprint,
+  collectQueueMetrics,
   cache,
   buildSmtpPayload,
+  buildRequestCacheKey,
   buildMarkdownMailMessage,
+  bindRouteModel,
   bindDatabaseConnection2 as bindDatabaseConnection,
   belongsToMany,
   belongsTo,
+  authContext,
   auth,
+  auditChecksum,
+  assertResourceInCurrentTenant,
+  assertOrganizationReadable,
   assertIfMatch,
   applyMiddlewareToRoutes,
+  applyConditionalGet,
   applyCasts,
+  appendProjectScope,
+  appendOrganizationScope,
   appSchedule,
   WhereBuilder,
   WebFormRequest,
@@ -5909,10 +6506,12 @@ export {
   NotFoundError,
   MySqlGrammar,
   Model,
+  membershipService_default as MembershipService,
   Mailer,
   LogMailDriver,
   LocalStorageDriver,
   Job,
+  GuestGuard,
   FormRequest,
   ForeignIdColumnDefinition,
   ForbiddenError,
@@ -5920,15 +6519,20 @@ export {
   failedJobRepository_default as FailedJobRepository,
   EventBus,
   EtaViewEngine,
+  DatabaseTokenGuard,
   DEFAULT_VIEWS_DIRECTORY,
+  DEFAULT_TENANT,
   ConflictError,
   ConfigStore,
+  CompositeGuard,
   ColumnDefinition,
-  repository_default as CacheRepository,
+  repository_default2 as CacheRepository,
   CACHE_TAGS,
   Blueprint,
   baseRepository_default as BaseRepository,
   BadRequestError,
+  AuthManager,
   AsyncQueue,
+  ApiTokenGuard,
   AdminResourceRegistry
 };