@getstrata/core 0.5.16 → 0.5.17

package/dist/entries/queue/queueMetrics.js

@@ -13,220 +13,49 @@ var queueConfig = {
   backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
 };
 
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  listeners = new Map;
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
     };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
-}
-var appLogger = new Logger("app");
-
-// ../../src/bootstrap/contracts.ts
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
-  }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
-  }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
-  }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
-    }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
-    }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
-    }
-    throw new Error(`Service "${key}" is not registered.`);
-  }
-  resolve(key) {
-    return this.get(key);
-  }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
-  }
-}
-
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
-  }
-  get(key) {
-    return this.values.get(key);
-  }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
-    }
-    return this.values.get(key);
-  }
-  has(key) {
-    return this.values.has(key);
-  }
-}
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/bootstrap/applicationRegistry.ts
-var activeContext;
-function requireActiveApplicationContext() {
-  if (!activeContext) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return activeContext;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage } from "async_hooks";
-var activeConnection = new AsyncLocalStorage;
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
   }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
     }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
+    for (const handler of handlers) {
+      await handler(payload);
     }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return defaultQuery.connection;
 }
+var eventBus = new EventBus;
 
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+// ../../src/core/events/index.ts
+function modelEventName(tableName, action) {
+  return `${tableName}.${action}`;
 }
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveRepositoryConnection()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
 
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
+// ../../src/core/pagination/index.ts
+function buildPaginationMeta(input) {
+  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
+  return {
+    page: input.page,
+    per_page: input.perPage,
+    total: input.total,
+    last_page: lastPage
+  };
 }
 
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
   status;
@@ -293,563 +122,290 @@ class PreconditionFailedError extends HttpError {
   }
 }
 
-// ../../src/core/security/safeUrl.ts
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
+// ../../src/core/database/errors.ts
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
   }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
   }
-  if (a === 127) {
-    return true;
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
   }
-  if (a === 0) {
-    return true;
+  return;
+}
+function mapDatabaseError(error) {
+  if (error instanceof HttpError) {
+    return error;
   }
-  if (a === 169 && b === 254) {
-    return true;
+  if (!isPostgresError(error)) {
+    const message = error instanceof Error ? error.message : "Database operation failed.";
+    return new BadRequestError(message);
   }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      return new ConflictError(error.detail ?? "A record with these values already exists.", {
+        constraint: error.constraint
+      });
+    case "23503":
+      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
+        constraint: error.constraint
+      });
+    case "23502":
+      return new BadRequestError(error.detail ?? "Required field is missing.", {
+        constraint: error.constraint
+      });
+    case "23514":
+      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
+        constraint: error.constraint
+      });
+    default:
+      return new BadRequestError(error.message ?? "Database operation failed.", {
+        code: error.code,
+        sqlState
+      });
   }
-  if (a === 192 && b === 168) {
-    return true;
+}
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
   }
-  return false;
 }
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
+
+// ../../src/core/database/query.ts
+function quoteIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
   }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
+  return `"${identifier}"`;
+}
+function qualifyColumn(tableName, column) {
+  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
+}
+function resolveQualifiedColumn(defaultTable, columnName) {
+  if (columnName.includes(".")) {
+    const [table, column] = columnName.split(".", 2);
+    if (!table || !column) {
+      throw new Error(`Invalid qualified column: ${columnName}`);
+    }
+    return qualifyColumn(table, column);
   }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
+  return qualifyColumn(defaultTable, columnName);
+}
+function parseQualifiedColumn(reference) {
+  const [table, column] = reference.split(".", 2);
+  if (!table || !column) {
+    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
   }
-  if (normalized.includes(":")) {
-    return true;
+  return { table, column };
+}
+function normalizeDirection(direction = "ASC") {
+  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
+}
+function isQueryOperator(value) {
+  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
+}
+function pushParam(values, value) {
+  values.push(value);
+  return `$${values.length}`;
+}
+function buildInClause(column, values, params) {
+  if (values.length === 0) {
+    return "1 = 0";
   }
-  return isPrivateIpv4(normalized);
+  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
+  return `${column} IN (${placeholders})`;
 }
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
+function buildOperatorClauses(column, operator, params) {
+  const clauses = [];
+  if (operator.isNull === true) {
+    clauses.push(`${column} IS NULL`);
   }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
+  if (operator.isNull === false) {
+    clauses.push(`${column} IS NOT NULL`);
   }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
+  if (operator.eq !== undefined) {
+    if (operator.eq === null) {
+      clauses.push(`${column} IS NULL`);
+    } else {
+      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
+    }
   }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
+  if (operator.in !== undefined) {
+    clauses.push(buildInClause(column, operator.in, params));
   }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
+  if (operator.gt !== undefined) {
+    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
+  if (operator.gte !== undefined) {
+    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
   }
-  return parsed;
+  if (operator.lt !== undefined) {
+    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
+  }
+  if (operator.lte !== undefined) {
+    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
+  }
+  if (operator.ilike !== undefined) {
+    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
+  }
+  if (operator.tsMatch !== undefined) {
+    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
+  }
+  return clauses;
 }
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
+function appendWhereParts(tableName, where, params) {
+  const clauses = [];
+  for (const [columnName, filterValue] of Object.entries(where)) {
+    if (filterValue === undefined) {
+      continue;
+    }
+    const column = resolveQualifiedColumn(tableName, columnName);
+    if (Array.isArray(filterValue)) {
+      clauses.push(buildInClause(column, filterValue, params));
+      continue;
+    }
+    if (isQueryOperator(filterValue)) {
+      clauses.push(...buildOperatorClauses(column, filterValue, params));
+      continue;
+    }
+    if (filterValue === null) {
+      clauses.push(`${column} IS NULL`);
+      continue;
+    }
+    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
+  }
+  return clauses.join(" AND ");
 }
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
+function buildWhereNodeClause(tableName, node, params) {
+  if ("where" in node) {
+    return appendWhereParts(tableName, node.where, params);
+  }
+  const grouped = buildWhereGroupClause(tableName, node.group, params);
+  if (!grouped) {
+    return "";
+  }
+  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
 }
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
+function buildWhereGroupClause(tableName, nodes, params) {
+  let result = "";
+  for (const node of nodes) {
+    const part = buildWhereNodeClause(tableName, node, params);
+    if (!part) {
+      continue;
     }
-  } finally {
-    clearTimeout(timeout);
+    if (!result) {
+      result = part;
+      continue;
+    }
+    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
+  }
+  if (!result) {
+    return "";
   }
+  return result;
 }
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
+function buildAdvancedWhereClause(tableName, where = {}, whereNodes = [], params = []) {
+  const nodes = [];
+  if (Object.keys(where).length > 0) {
+    nodes.push({ kind: "and", where });
   }
+  nodes.push(...whereNodes);
+  const combined = buildWhereGroupClause(tableName, nodes, params);
+  return {
+    clause: combined ? ` WHERE ${combined}` : "",
+    params
+  };
 }
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
+function resolveSoftDeleteColumn(table) {
+  if (!table.softDeletes) {
+    return null;
   }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
+  if (table.softDeletes === true) {
+    return "deleted_at";
   }
+  return table.softDeletes.column ?? "deleted_at";
 }
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  constructor() {}
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
+function appendSoftDeleteScope(table, options, clauses) {
+  const column = resolveSoftDeleteColumn(table);
+  if (!column) {
+    return;
   }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
+  const qualifiedColumn = qualifyColumn(table.name, column);
+  if (options.onlyTrashed) {
+    clauses.push(`${qualifiedColumn} IS NOT NULL`);
+    return;
   }
-  names() {
-    return [...this.factories.keys()];
+  if (!options.withTrashed) {
+    clauses.push(`${qualifiedColumn} IS NULL`);
   }
 }
-var jobRegistry = new JobRegistry;
-
-// ../../src/core/events/eventBus.ts
-class EventBus {
-  constructor() {}
-  listeners = new Map;
-  listen(event, listener) {
-    const handlers = this.listeners.get(event) ?? new Set;
-    handlers.add(listener);
-    this.listeners.set(event, handlers);
-    return () => {
-      handlers.delete(listener);
-      if (handlers.size === 0) {
-        this.listeners.delete(event);
-      }
-    };
-  }
-  async dispatch(event, payload) {
-    const handlers = this.listeners.get(event);
-    if (!handlers || handlers.size === 0) {
-      return;
-    }
-    for (const handler of handlers) {
-      await handler(payload);
-    }
+function buildQueryWhereClause(table, options = {}, whereNodes = [], params = []) {
+  const { clause, params: whereParams } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes, params);
+  const softDeleteClauses = [];
+  appendSoftDeleteScope(table, options, softDeleteClauses);
+  if (softDeleteClauses.length === 0) {
+    return { clause, params: whereParams };
   }
-}
-var eventBus = new EventBus;
-
-// ../../src/core/events/index.ts
-function modelEventName(tableName, action) {
-  return `${tableName}.${action}`;
-}
-
-// ../../src/core/pagination/index.ts
-function buildPaginationMeta(input) {
-  const lastPage = Math.max(1, Math.ceil(input.total / input.perPage));
+  const base = clause.replace(/^ WHERE /, "");
+  const scope = softDeleteClauses.join(" AND ");
   return {
-    page: input.page,
-    per_page: input.perPage,
-    total: input.total,
-    last_page: lastPage
+    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
+    params: whereParams
   };
 }
-
-// ../../src/core/database/errors.ts
-function isPostgresError(error) {
-  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+function isQueryOrder(value) {
+  return "column" in value;
 }
-function getPostgresSqlState(error) {
-  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
-    return error.errno;
+function normalizeOrderBy(orderBy) {
+  if (!orderBy) {
+    return [];
   }
-  if (typeof error.errno === "number") {
-    return String(error.errno).padStart(5, "0");
+  if (Array.isArray(orderBy)) {
+    return orderBy;
   }
-  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
-    return error.code;
+  if (isQueryOrder(orderBy)) {
+    return [orderBy];
   }
-  return;
+  return Object.entries(orderBy).map(([column, direction]) => ({
+    column,
+    direction
+  }));
 }
-function mapDatabaseError(error) {
-  if (error instanceof HttpError) {
-    return error;
-  }
-  if (!isPostgresError(error)) {
-    const message = error instanceof Error ? error.message : "Database operation failed.";
-    return new BadRequestError(message);
-  }
-  const sqlState = getPostgresSqlState(error);
-  switch (sqlState) {
-    case "23505":
-      return new ConflictError(error.detail ?? "A record with these values already exists.", {
-        constraint: error.constraint
-      });
-    case "23503":
-      return new UnprocessableEntityError(error.detail ?? "Referenced record does not exist.", {
-        constraint: error.constraint
-      });
-    case "23502":
-      return new BadRequestError(error.detail ?? "Required field is missing.", {
-        constraint: error.constraint
-      });
-    case "23514":
-      return new BadRequestError(error.detail ?? "Value violates a database constraint.", {
-        constraint: error.constraint
-      });
-    default:
-      return new BadRequestError(error.message ?? "Database operation failed.", {
-        code: error.code,
-        sqlState
-      });
-  }
+function buildOrderByClause(tableName, orderBy) {
+  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
+    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
+  });
+  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
 }
-async function withDatabaseErrorHandling(operation) {
-  try {
-    return await operation();
-  } catch (error) {
-    throw mapDatabaseError(error);
+function buildGroupByClause(tableName, groupBy) {
+  if (!groupBy) {
+    return "";
   }
+  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
+  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
+  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
 }
-
-// ../../src/core/database/query.ts
-function quoteIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
+function buildHavingClause(tableName, having, params) {
+  if (!having) {
+    return "";
   }
-  return `"${identifier}"`;
+  const body = appendWhereParts(tableName, having, params);
+  return body.length > 0 ? ` HAVING ${body}` : "";
 }
-function qualifyColumn(tableName, column) {
-  return `${quoteIdentifier(tableName)}.${quoteIdentifier(column)}`;
-}
-function resolveQualifiedColumn(defaultTable, columnName) {
-  if (columnName.includes(".")) {
-    const [table, column] = columnName.split(".", 2);
-    if (!table || !column) {
-      throw new Error(`Invalid qualified column: ${columnName}`);
-    }
-    return qualifyColumn(table, column);
-  }
-  return qualifyColumn(defaultTable, columnName);
-}
-function parseQualifiedColumn(reference) {
-  const [table, column] = reference.split(".", 2);
-  if (!table || !column) {
-    throw new Error(`Join columns must be qualified as table.column: ${reference}`);
-  }
-  return { table, column };
-}
-function normalizeDirection(direction = "ASC") {
-  return direction.toUpperCase() === "DESC" ? "DESC" : "ASC";
-}
-function isQueryOperator(value) {
-  return value !== null && !Array.isArray(value) && !(value instanceof Date) && typeof value === "object";
-}
-function pushParam(values, value) {
-  values.push(value);
-  return `$${values.length}`;
-}
-function buildInClause(column, values, params) {
-  if (values.length === 0) {
-    return "1 = 0";
-  }
-  const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
-}
-function buildOperatorClauses(column, operator, params) {
-  const clauses = [];
-  if (operator.isNull === true) {
-    clauses.push(`${column} IS NULL`);
-  }
-  if (operator.isNull === false) {
-    clauses.push(`${column} IS NOT NULL`);
-  }
-  if (operator.eq !== undefined) {
-    if (operator.eq === null) {
-      clauses.push(`${column} IS NULL`);
-    } else {
-      clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
-    }
-  }
-  if (operator.in !== undefined) {
-    clauses.push(buildInClause(column, operator.in, params));
-  }
-  if (operator.gt !== undefined) {
-    clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
-  }
-  if (operator.gte !== undefined) {
-    clauses.push(`${column} >= ${pushParam(params, operator.gte)}`);
-  }
-  if (operator.lt !== undefined) {
-    clauses.push(`${column} < ${pushParam(params, operator.lt)}`);
-  }
-  if (operator.lte !== undefined) {
-    clauses.push(`${column} <= ${pushParam(params, operator.lte)}`);
-  }
-  if (operator.ilike !== undefined) {
-    clauses.push(`${column} ILIKE ${pushParam(params, `%${operator.ilike}%`)}`);
-  }
-  if (operator.tsMatch !== undefined) {
-    clauses.push(`${column} @@ plainto_tsquery('english', ${pushParam(params, operator.tsMatch)})`);
-  }
-  return clauses;
-}
-function appendWhereParts(tableName, where, params) {
-  const clauses = [];
-  for (const [columnName, filterValue] of Object.entries(where)) {
-    if (filterValue === undefined) {
-      continue;
-    }
-    const column = resolveQualifiedColumn(tableName, columnName);
-    if (Array.isArray(filterValue)) {
-      clauses.push(buildInClause(column, filterValue, params));
-      continue;
-    }
-    if (isQueryOperator(filterValue)) {
-      clauses.push(...buildOperatorClauses(column, filterValue, params));
-      continue;
-    }
-    if (filterValue === null) {
-      clauses.push(`${column} IS NULL`);
-      continue;
-    }
-    clauses.push(`${column} = ${pushParam(params, filterValue)}`);
-  }
-  return clauses.join(" AND ");
-}
-function buildWhereNodeClause(tableName, node, params) {
-  if ("where" in node) {
-    return appendWhereParts(tableName, node.where, params);
-  }
-  const grouped = buildWhereGroupClause(tableName, node.group, params);
-  if (!grouped) {
-    return "";
-  }
-  return grouped.includes(" OR ") ? `(${grouped})` : grouped;
-}
-function buildWhereGroupClause(tableName, nodes, params) {
-  let result = "";
-  for (const node of nodes) {
-    const part = buildWhereNodeClause(tableName, node, params);
-    if (!part) {
-      continue;
-    }
-    if (!result) {
-      result = part;
-      continue;
-    }
-    result = node.kind === "or" ? `${result} OR ${part}` : `${result} AND ${part}`;
-  }
-  if (!result) {
-    return "";
-  }
-  return result;
-}
-function buildAdvancedWhereClause(tableName, where = {}, whereNodes = [], params = []) {
-  const nodes = [];
-  if (Object.keys(where).length > 0) {
-    nodes.push({ kind: "and", where });
-  }
-  nodes.push(...whereNodes);
-  const combined = buildWhereGroupClause(tableName, nodes, params);
-  return {
-    clause: combined ? ` WHERE ${combined}` : "",
-    params
-  };
-}
-function resolveSoftDeleteColumn(table) {
-  if (!table.softDeletes) {
-    return null;
-  }
-  if (table.softDeletes === true) {
-    return "deleted_at";
-  }
-  return table.softDeletes.column ?? "deleted_at";
-}
-function appendSoftDeleteScope(table, options, clauses) {
-  const column = resolveSoftDeleteColumn(table);
-  if (!column) {
-    return;
-  }
-  const qualifiedColumn = qualifyColumn(table.name, column);
-  if (options.onlyTrashed) {
-    clauses.push(`${qualifiedColumn} IS NOT NULL`);
-    return;
-  }
-  if (!options.withTrashed) {
-    clauses.push(`${qualifiedColumn} IS NULL`);
-  }
-}
-function buildQueryWhereClause(table, options = {}, whereNodes = [], params = []) {
-  const { clause, params: whereParams } = buildAdvancedWhereClause(table.name, options.where ?? {}, whereNodes, params);
-  const softDeleteClauses = [];
-  appendSoftDeleteScope(table, options, softDeleteClauses);
-  if (softDeleteClauses.length === 0) {
-    return { clause, params: whereParams };
-  }
-  const base = clause.replace(/^ WHERE /, "");
-  const scope = softDeleteClauses.join(" AND ");
-  return {
-    clause: base ? ` WHERE (${base}) AND ${scope}` : ` WHERE ${scope}`,
-    params: whereParams
-  };
-}
-function isQueryOrder(value) {
-  return "column" in value;
-}
-function normalizeOrderBy(orderBy) {
-  if (!orderBy) {
-    return [];
-  }
-  if (Array.isArray(orderBy)) {
-    return orderBy;
-  }
-  if (isQueryOrder(orderBy)) {
-    return [orderBy];
-  }
-  return Object.entries(orderBy).map(([column, direction]) => ({
-    column,
-    direction
-  }));
-}
-function buildOrderByClause(tableName, orderBy) {
-  const parts = normalizeOrderBy(orderBy).map(({ column, direction }) => {
-    return `${resolveQualifiedColumn(tableName, column)} ${normalizeDirection(direction)}`;
-  });
-  return parts.length > 0 ? ` ORDER BY ${parts.join(", ")}` : "";
-}
-function buildGroupByClause(tableName, groupBy) {
-  if (!groupBy) {
-    return "";
-  }
-  const columns = (Array.isArray(groupBy) ? groupBy : [groupBy]).map((column) => String(column));
-  const parts = columns.map((column) => resolveQualifiedColumn(tableName, column));
-  return parts.length > 0 ? ` GROUP BY ${parts.join(", ")}` : "";
-}
-function buildHavingClause(tableName, having, params) {
-  if (!having) {
-    return "";
-  }
-  const body = appendWhereParts(tableName, having, params);
-  return body.length > 0 ? ` HAVING ${body}` : "";
-}
-function buildJoinClause(joins = []) {
-  return joins.map((join) => {
-    const joinType = join.type === "left" ? "LEFT JOIN" : "INNER JOIN";
-    const onClause = join.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
-    return ` ${joinType} ${quoteIdentifier(join.table)} ON ${onClause}`;
-  }).join("");
+function buildJoinClause(joins = []) {
+  return joins.map((join) => {
+    const joinType = join.type === "left" ? "LEFT JOIN" : "INNER JOIN";
+    const onClause = join.on.map(({ left, right }) => `${qualifyColumn(left.table, left.column)} = ${qualifyColumn(right.table, right.column)}`).join(" AND ");
+    return ` ${joinType} ${quoteIdentifier(join.table)} ON ${onClause}`;
+  }).join("");
 }
 function buildLimitClause(limit) {
   if (limit === undefined) {
@@ -1094,29 +650,101 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/core/database/whereBuilder.ts
-class WhereBuilder {
-  nodes = [];
-  where(where) {
-    this.nodes.push({ kind: "and", where });
-    return this;
-  }
-  orWhere(where) {
-    this.nodes.push({ kind: "or", where });
-    return this;
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var activeConnection = new AsyncLocalStorage;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  whereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
-      this.nodes.push({ kind: "and", group: nested.nodes });
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
     }
-    return this;
+    return resolveDatabase();
   }
-  orWhereGroup(fn) {
-    const nested = new WhereBuilder;
-    fn(nested);
-    if (nested.nodes.length > 0) {
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveRepositoryConnection()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/database/whereBuilder.ts
+class WhereBuilder {
+  nodes = [];
+  where(where) {
+    this.nodes.push({ kind: "and", where });
+    return this;
+  }
+  orWhere(where) {
+    this.nodes.push({ kind: "or", where });
+    return this;
+  }
+  whereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
+      this.nodes.push({ kind: "and", group: nested.nodes });
+    }
+    return this;
+  }
+  orWhereGroup(fn) {
+    const nested = new WhereBuilder;
+    fn(nested);
+    if (nested.nodes.length > 0) {
       this.nodes.push({ kind: "or", group: nested.nodes });
     }
     return this;
@@ -2282,6 +1910,34 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  constructor() {}
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var jobRegistry = new JobRegistry;
+
 // ../../src/core/queue/jobRunner.ts
 async function runQueueJob(envelope, failedJobs) {
   const job = jobRegistry.create(envelope.name);
@@ -2312,194 +1968,538 @@ async function runQueueJob(envelope, failedJobs) {
   }
 }
 
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
-var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
-function queueKeyForPriority(priority = "default") {
-  switch (priority) {
-    case "high":
-      return QUEUE_HIGH_KEY;
-    case "low":
-      return QUEUE_LOW_KEY;
-    default:
-      return QUEUE_LIST_KEY;
+// ../../src/core/queue/redisQueue.ts
+var {RedisClient } = globalThis.Bun;
+var QUEUE_LIST_KEY = "workhub:queue:default";
+var QUEUE_HIGH_KEY = "workhub:queue:high";
+var QUEUE_LOW_KEY = "workhub:queue:low";
+var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
+function queueKeyForPriority(priority = "default") {
+  switch (priority) {
+    case "high":
+      return QUEUE_HIGH_KEY;
+    case "low":
+      return QUEUE_LOW_KEY;
+    default:
+      return QUEUE_LIST_KEY;
+  }
+}
+function parseQueueJobEnvelope(rawPayload) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    console.error("[QueueWorker] Ignoring malformed queue payload");
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    console.error("[QueueWorker] Ignoring non-object queue payload");
+    return null;
+  }
+  const envelope = parsed;
+  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
+    console.error("[QueueWorker] Ignoring queue payload without job name");
+    return null;
+  }
+  if (!jobRegistry.create(envelope.name)) {
+    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
+    return null;
+  }
+  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
+    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
+    return null;
+  }
+  return {
+    name: envelope.name,
+    payload: envelope.payload ?? {},
+    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
+  };
+}
+
+class RedisQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient(redisUrl);
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    const queueKey = queueKeyForPriority(job.priority);
+    await this.client.lpush(queueKey, JSON.stringify(envelope));
+  }
+}
+
+class QueueWorker {
+  failedJobs;
+  timeoutSeconds;
+  running = false;
+  stopping = false;
+  client;
+  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
+    this.failedJobs = failedJobs;
+    this.timeoutSeconds = timeoutSeconds;
+    this.client = new RedisClient(redisUrl);
+  }
+  requestStop() {
+    this.stopping = true;
+  }
+  isRunning() {
+    return this.running;
+  }
+  async processNext() {
+    let result = null;
+    for (const queueKey of QUEUE_KEYS) {
+      result = await this.client.brpop(queueKey, 1);
+      if (result) {
+        break;
+      }
+    }
+    if (!result) {
+      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
+    }
+    if (!result) {
+      return false;
+    }
+    const [, rawPayload] = result;
+    const envelope = parseQueueJobEnvelope(rawPayload);
+    if (!envelope) {
+      return true;
+    }
+    try {
+      await runQueueJob(envelope, this.failedJobs);
+    } catch (error) {
+      console.error("[QueueWorker] Job failed:", error);
+    }
+    return true;
+  }
+  async run() {
+    this.running = true;
+    while (!this.stopping) {
+      await this.processNext();
+    }
+    this.running = false;
+  }
+  close() {
+    this.client.close();
+  }
+}
+
+// ../../src/core/queue/resilientQueue.ts
+class ResilientQueue {
+  failedJobs;
+  asyncDispatch;
+  constructor(failedJobs, asyncDispatch = false) {
+    this.failedJobs = failedJobs;
+    this.asyncDispatch = asyncDispatch;
+  }
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
+    }
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    if (this.asyncDispatch) {
+      setTimeout(() => {
+        runQueueJob(envelope, this.failedJobs).catch((error) => {
+          console.error("[ResilientQueue] Job failed:", error);
+        });
+      }, 0);
+      return;
+    }
+    await runQueueJob(envelope, this.failedJobs);
+  }
+}
+
+// ../../src/core/queue/publicQueue.ts
+function createFailedJobService() {
+  return new failedJobService_default(new failedJobRepository_default);
+}
+function createTrackedJob(name, job) {
+  return jobRegistry.track(name, job);
+}
+function createProductionQueue(driver, options = {}) {
+  options.registerJobs?.();
+  const failedJobs = options.failedJobs ?? createFailedJobService();
+  if (driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new RedisQueue(options.redisUrl);
+  }
+  return new ResilientQueue(failedJobs, driver === "async");
+}
+function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
+  return new QueueWorker(redisUrl, failedJobs);
+}
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac } from "crypto";
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+class DispatchWebhookJob extends Job {
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await repositoryConnection`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      }, { allowHttp: appConfig.env !== "production" });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await repositoryConnection`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await repositoryConnection`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
+  }
+}
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/core/jobs/invalidateCacheTagsJob.ts
+class InvalidateCacheTagsJob extends Job {
+  cache;
+  constructor(cache) {
+    super();
+    this.cache = cache;
   }
-}
-function parseQueueJobEnvelope(rawPayload) {
-  let parsed;
-  try {
-    parsed = JSON.parse(rawPayload);
-  } catch {
-    console.error("[QueueWorker] Ignoring malformed queue payload");
-    return null;
+  async handle(payload) {
+    await this.cache.tags(...payload.tags).flush();
   }
-  if (!parsed || typeof parsed !== "object") {
-    console.error("[QueueWorker] Ignoring non-object queue payload");
-    return null;
+}
+var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
   }
-  const envelope = parsed;
-  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
-    console.error("[QueueWorker] Ignoring queue payload without job name");
-    return null;
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
   }
-  if (!jobRegistry.create(envelope.name)) {
-    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
-    return null;
+  debug(message, context) {
+    this.write("debug", message, context);
   }
-  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
-    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
-    return null;
+  info(message, context) {
+    this.write("info", message, context);
   }
-  return {
-    name: envelope.name,
-    payload: envelope.payload ?? {},
-    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
-  };
-}
-
-class RedisQueue {
-  client;
-  constructor(redisUrl) {
-    this.client = new RedisClient(redisUrl);
+  warn(message, context) {
+    this.write("warn", message, context);
   }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
-    }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    const queueKey = queueKeyForPriority(job.priority);
-    await this.client.lpush(queueKey, JSON.stringify(envelope));
+  error(message, context) {
+    this.write("error", message, context);
   }
 }
+var appLogger = new Logger("app");
 
-class QueueWorker {
-  failedJobs;
-  timeoutSeconds;
-  running = false;
-  stopping = false;
-  client;
-  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
-    this.failedJobs = failedJobs;
-    this.timeoutSeconds = timeoutSeconds;
-    this.client = new RedisClient(redisUrl);
+// ../../src/bootstrap/contracts.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
   }
-  requestStop() {
-    this.stopping = true;
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
   }
-  isRunning() {
-    return this.running;
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
   }
-  async processNext() {
-    let result = null;
-    for (const queueKey of QUEUE_KEYS) {
-      result = await this.client.brpop(queueKey, 1);
-      if (result) {
-        break;
-      }
-    }
-    if (!result) {
-      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
-    }
-    if (!result) {
-      return false;
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
     }
-    const [, rawPayload] = result;
-    const envelope = parseQueueJobEnvelope(rawPayload);
-    if (!envelope) {
-      return true;
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
     }
-    try {
-      await runQueueJob(envelope, this.failedJobs);
-    } catch (error) {
-      console.error("[QueueWorker] Job failed:", error);
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
     }
-    return true;
+    throw new Error(`Service "${key}" is not registered.`);
   }
-  async run() {
-    this.running = true;
-    while (!this.stopping) {
-      await this.processNext();
-    }
-    this.running = false;
+  resolve(key) {
+    return this.get(key);
   }
-  close() {
-    this.client.close();
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
   }
 }
 
-// ../../src/core/queue/resilientQueue.ts
-class ResilientQueue {
-  failedJobs;
-  asyncDispatch;
-  constructor(failedJobs, asyncDispatch = false) {
-    this.failedJobs = failedJobs;
-    this.asyncDispatch = asyncDispatch;
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
   }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
-    }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    if (this.asyncDispatch) {
-      setTimeout(() => {
-        runQueueJob(envelope, this.failedJobs).catch((error) => {
-          console.error("[ResilientQueue] Job failed:", error);
-        });
-      }, 0);
-      return;
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
     }
-    await runQueueJob(envelope, this.failedJobs);
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
   }
 }
-
-// ../../src/core/queue/publicQueue.ts
-function createFailedJobService() {
-  return new failedJobService_default(new failedJobRepository_default);
-}
-function createTrackedJob(name, job) {
-  return jobRegistry.track(name, job);
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
 }
-function createProductionQueue(driver, options = {}) {
-  options.registerJobs?.();
-  const failedJobs = options.failedJobs ?? createFailedJobService();
-  if (driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
-    }
-    return new RedisQueue(options.redisUrl);
+
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
   }
-  return new ResilientQueue(failedJobs, driver === "async");
+  return activeContext;
 }
-function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
-  return new QueueWorker(redisUrl, failedJobs);
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
 }
 
-// ../../src/core/queue/createAppQueue.ts
-var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+// ../../src/bootstrap/queue/defaultJobs.ts
 function registerDefaultJobs() {
   jobRegistry.register("cache.invalidate-tags", () => {
     return new invalidateCacheTagsJob_default(resolveApplicationCache());
   });
   jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
 }
-function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService()) {
+
+// ../../src/core/queue/createAppQueue.ts
+var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
+function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
   return createProductionQueue(driver, {
     redisUrl,
     failedJobs,
-    registerJobs: registerDefaultJobs
+    registerJobs
   });
 }