@getstrata/core 0.5.17 → 0.5.18

package/dist/entries/queue/createAppQueue.js

@@ -644,9 +644,22 @@ function getBoundDatabaseConnection() {
   return boundConnectionHolder.connection;
 }
 
-// ../../src/core/database/connectionContext.ts
+// ../../src/core/runtime/asyncContextStore.ts
 import { AsyncLocalStorage } from "async_hooks";
-var activeConnection = new AsyncLocalStorage;
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
 function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
@@ -2140,228 +2153,6 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -2471,16 +2262,2608 @@ function getRequiredDependency(dependencies, key) {
 }
 
 // ../../src/bootstrap/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
 var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
+  }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
+  }
+  return activeContext;
+}
 function requireActiveApplicationContext() {
-  if (!activeContext) {
+  const context = readStoredApplicationContext();
+  if (!context) {
     throw new Error("The application context has not been bootstrapped.");
   }
-  return activeContext;
+  return context;
 }
 function resolveApplicationCache() {
   return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
 }
+// ../../src/core/admin/registry.ts
+class AdminResourceRegistry {
+  resources = new Map;
+  constructor() {}
+  register(resource) {
+    if (this.resources.has(resource.name)) {
+      throw new Error(`Admin resource "${resource.name}" is already registered.`);
+    }
+    this.resources.set(resource.name, resource);
+  }
+  get(name) {
+    return this.resources.get(name);
+  }
+  list() {
+    const definitions = [];
+    for (const resource of this.resources.values()) {
+      const { handlers: _handlers, ...definition } = resource;
+      definitions.push(definition);
+    }
+    return definitions;
+  }
+  all() {
+    return [...this.resources.values()];
+  }
+  clear() {
+    this.resources.clear();
+  }
+}
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/core/auth/oauth/oidcProvider.ts
+class OidcProvider {
+  options;
+  name;
+  constructor(options) {
+    this.options = options;
+    this.name = options.name;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      response_type: "code",
+      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
+      state
+    });
+    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.options.redirectUri,
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("OIDC token exchange failed.");
+    }
+    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
+      headers: { authorization: `Bearer ${tokenBody.access_token}` }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: profile.sub,
+      email: profile.email ?? `${profile.sub}@oidc.local`,
+      name: profile.name ?? profile.sub
+    };
+  }
+}
+
+// ../../src/core/auth/oauth/providers.ts
+class GitHubOAuthProvider {
+  options;
+  name = "github";
+  constructor(options) {
+    this.options = options;
+  }
+  getAuthorizationUrl(state) {
+    const params = new URLSearchParams({
+      client_id: this.options.clientId,
+      redirect_uri: this.options.redirectUri,
+      scope: "read:user user:email",
+      state
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+  async exchangeCode(code) {
+    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: this.options.clientId,
+        client_secret: this.options.clientSecret,
+        code,
+        redirect_uri: this.options.redirectUri
+      })
+    });
+    const tokenBody = await tokenResponse.json();
+    if (!tokenBody.access_token) {
+      throw new Error("GitHub OAuth token exchange failed.");
+    }
+    const profileResponse = await fetch("https://api.github.com/user", {
+      headers: {
+        authorization: `Bearer ${tokenBody.access_token}`,
+        accept: "application/json",
+        "user-agent": "workhub"
+      }
+    });
+    const profile = await profileResponse.json();
+    return {
+      providerUserId: String(profile.id),
+      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
+      name: profile.name ?? profile.login
+    };
+  }
+}
+
+class MockOAuthProvider {
+  profile;
+  name = "mock";
+  constructor(profile) {
+    this.profile = profile;
+  }
+  getAuthorizationUrl(state) {
+    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (code !== "valid-code") {
+      throw new Error("Invalid OAuth code.");
+    }
+    return this.profile;
+  }
+}
+
+// ../../src/core/auth/oauth/samlProvider.ts
+class SamlProvider {
+  loginUrl;
+  name = "saml";
+  constructor(loginUrl) {
+    this.loginUrl = loginUrl;
+  }
+  getAuthorizationUrl(state) {
+    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
+  }
+  async exchangeCode(code) {
+    if (!code.startsWith("saml:")) {
+      throw new Error("Invalid SAML assertion reference.");
+    }
+    const [, email, name] = code.split(":");
+    return {
+      providerUserId: email ?? "saml-user",
+      email: email ?? "saml-user@workhub.test",
+      name: name ?? "SAML User"
+    };
+  }
+}
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection2(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/modules/user/apiTokenTable.ts
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/crypto/fieldEncryption.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
+var ENCRYPTION_PREFIX = "enc:v1:";
+var IV_LENGTH = 12;
+var TAG_LENGTH = 16;
+function resolveEncryptionKey() {
+  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
+  if (!raw) {
+    return null;
+  }
+  if (/^[0-9a-f]{64}$/i.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  const decoded = Buffer.from(raw, "base64");
+  if (decoded.length === 32) {
+    return decoded;
+  }
+  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
+}
+function isFieldEncryptionEnabled() {
+  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
+  if (featureFlag === "false") {
+    return false;
+  }
+  if (featureFlag === "true") {
+    return true;
+  }
+  return (process.env.APP_ENV ?? "local") === "production";
+}
+function encryptField(plaintext, key) {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
+  return `${ENCRYPTION_PREFIX}${payload}`;
+}
+function decryptField(value, key) {
+  if (!value.startsWith(ENCRYPTION_PREFIX)) {
+    return value;
+  }
+  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+  const iv = payload.subarray(0, IV_LENGTH);
+  const tag = payload.subarray(payload.length - TAG_LENGTH);
+  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+function hashLookupValue(normalizedValue, key) {
+  return createHmac("sha256", key).update(normalizedValue).digest("hex");
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function protectEmail(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return { storedEmail: normalized, emailLookup: normalized };
+  }
+  return {
+    storedEmail: encryptField(normalized, key),
+    emailLookup: hashLookupValue(normalized, key)
+  };
+}
+function revealEmail(storedEmail) {
+  const key = resolveEncryptionKey();
+  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
+    return storedEmail;
+  }
+  return decryptField(storedEmail, key);
+}
+function emailLookupForQuery(email) {
+  const normalized = normalizeEmail(email);
+  const key = resolveEncryptionKey();
+  if (!key || !isFieldEncryptionEnabled()) {
+    return normalized;
+  }
+  return hashLookupValue(normalized, key);
+}
+
+// ../../src/core/crypto/mfaSecret.ts
+function protectMfaSecret(secret) {
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key) {
+    return secret;
+  }
+  return encryptField(secret, key);
+}
+function revealMfaSecret(stored) {
+  if (!stored) {
+    return null;
+  }
+  const key = resolveEncryptionKey();
+  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
+    return stored;
+  }
+  return decryptField(stored, key);
+}
+
+// ../../src/core/http/requestMetaContext.ts
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/security/securityEvents.ts
+function logSecurityEvent(event, details = {}) {
+  const meta = currentRequestMeta();
+  const user = currentAuthUser();
+  console.log(JSON.stringify({
+    level: "security",
+    event,
+    timestamp: new Date().toISOString(),
+    ip_address: meta.ipAddress ?? null,
+    user_agent: meta.userAgent ?? null,
+    user_id: user?.id ?? null,
+    ...details
+  }));
+}
+
+// ../../src/core/security/tokenExpiry.ts
+function resolveDefaultTokenExpiryDays() {
+  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
+  if (!raw) {
+    return null;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return null;
+  }
+  return parsed;
+}
+
+// ../../src/core/security/totp.ts
+import { createHmac as createHmac2 } from "crypto";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.replace(/=+$/u, "").toUpperCase();
+  let bits = "";
+  for (const char of normalized) {
+    const value = alphabet.indexOf(char);
+    if (value === -1) {
+      throw new Error("Invalid base32 character in MFA secret.");
+    }
+    bits += value.toString(2).padStart(5, "0");
+  }
+  const bytes = [];
+  for (let index = 0;index + 8 <= bits.length; index += 8) {
+    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
+  }
+  return Buffer.from(bytes);
+}
+function generateTotp(secret, counter, digits = 6) {
+  const key = decodeBase32(secret);
+  const buffer = Buffer.alloc(8);
+  buffer.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac2("sha1", key).update(buffer).digest();
+  const lastByte = digest[digest.length - 1] ?? 0;
+  const offset = lastByte & 15;
+  const b0 = digest[offset] ?? 0;
+  const b1 = digest[offset + 1] ?? 0;
+  const b2 = digest[offset + 2] ?? 0;
+  const b3 = digest[offset + 3] ?? 0;
+  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
+  return String(code % 10 ** digits).padStart(digits, "0");
+}
+function verifyTotp(secret, token, window = 1) {
+  const normalized = token.trim();
+  if (!/^\d{6}$/u.test(normalized)) {
+    return false;
+  }
+  const timestep = Math.floor(Date.now() / 30000);
+  for (let offset = -window;offset <= window; offset += 1) {
+    if (generateTotp(secret, timestep + offset) === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationTable.ts
+var notificationTable = defineTable({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+var oauthIdentityTable = defineTable({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/table.ts
+var userTable = defineTable({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/core/auth/tokenHash.ts
+import { createHash, createHmac as createHmac3 } from "crypto";
+function resolveTokenPepper() {
+  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
+}
+function hashApiToken(token) {
+  const pepper = resolveTokenPepper();
+  if (pepper && pepper !== "workhub-dev-token-pepper") {
+    return createHmac3("sha256", pepper).update(token).digest("hex");
+  }
+  return createHash("sha256").update(token).digest("hex");
+}
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
+var membershipRepository = new memberRepository_default;
+// ../../src/core/auth/policy.ts
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
+
+class PolicyGate {
+  constructor() {}
+  policies = new Map;
+  register(resource, policy) {
+    this.policies.set(resource, policy);
+  }
+  allows(resource, action, user, model) {
+    const policy = this.policies.get(resource);
+    if (!policy) {
+      return false;
+    }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
+    const handler = policy[action];
+    if (typeof handler !== "function") {
+      return false;
+    }
+    const resolvedUser = user === undefined ? currentAuthUser() : user;
+    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
+  }
+  authorize(resource, action, user, model) {
+    if (!this.allows(resource, action, user, model)) {
+      throw new ForbiddenError;
+    }
+  }
+}
+// ../../src/core/cache/redisCacheStore.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+var KEY_PREFIX = "workhub:cache:";
+var TAG_PREFIX = "workhub:cache:tag:";
+
+class RedisCacheStore {
+  ttlMs;
+  maxEntries;
+  client;
+  inflight = new Map;
+  keyTags = new Map;
+  constructor(redisUrl, ttlMs, maxEntries) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    this.client = new RedisClient2(redisUrl);
+  }
+  async get(key) {
+    const raw = await this.client.get(this.storageKey(key));
+    if (raw === null) {
+      return;
+    }
+    return JSON.parse(raw);
+  }
+  async set(key, value, ttlMs) {
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    const payload = JSON.stringify(value);
+    if (resolvedTtlMs > 0) {
+      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
+    } else {
+      await this.client.set(this.storageKey(key), payload);
+    }
+    await this.enforceMaxEntries();
+  }
+  async getOrSet(key, loader, ttlMs) {
+    const cached = await this.get(key);
+    if (cached !== undefined) {
+      return cached;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then(async (value) => {
+      await this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
+  }
+  async attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      await this.client.sadd(this.tagKey(tag), key);
+    }
+  }
+  async flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const members = await this.client.smembers(this.tagKey(tag));
+      for (const member of members) {
+        keysToRemove.add(member);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (await this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      await this.client.del(this.tagKey(tag));
+    }
+    return removed;
+  }
+  async invalidate(key) {
+    const deleted = await this.client.del(this.storageKey(key));
+    await this.detachKeyFromTags(key);
+    return deleted > 0;
+  }
+  async invalidateByPrefix(prefix) {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    let removed = 0;
+    for (const storageKey of keys) {
+      const key = storageKey.slice(KEY_PREFIX.length);
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (await this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
+  }
+  async clear() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length > 0) {
+      await this.client.del(...keys);
+    }
+    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
+    if (tagKeys.length > 0) {
+      await this.client.del(...tagKeys);
+    }
+    this.inflight.clear();
+    this.keyTags.clear();
+  }
+  async size() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    return keys.length;
+  }
+  storageKey(key) {
+    return `${KEY_PREFIX}${key}`;
+  }
+  tagKey(tag) {
+    return `${TAG_PREFIX}${tag}`;
+  }
+  async detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
+    }
+    for (const tag of tags) {
+      await this.client.srem(this.tagKey(tag), key);
+    }
+    this.keyTags.delete(key);
+  }
+  async enforceMaxEntries() {
+    const keys = await this.client.keys(`${KEY_PREFIX}*`);
+    if (keys.length <= this.maxEntries) {
+      return;
+    }
+    const overflow = keys.length - this.maxEntries;
+    const keysToRemove = keys.slice(0, overflow);
+    if (keysToRemove.length > 0) {
+      await this.client.del(...keysToRemove);
+    }
+  }
+}
+var redisCacheStore_default = RedisCacheStore;
+
+// ../../src/core/cache/simpleCache.ts
+class SimpleCache {
+  ttlMs;
+  maxEntries;
+  cache = new Map;
+  inflight = new Map;
+  tagIndex = new Map;
+  keyTags = new Map;
+  constructor(ttlMs = 3600000, maxEntries = 100) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
+      throw new RangeError("ttlMs must be a non-negative number.");
+    }
+    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
+      throw new RangeError("maxEntries must be a positive integer.");
+    }
+  }
+  get(key) {
+    return this.getFreshEntry(key)?.value;
+  }
+  set(key, value, ttlMs) {
+    const now = Date.now();
+    const resolvedTtlMs = ttlMs ?? this.ttlMs;
+    this.cache.set(key, {
+      value,
+      expiresAt: now + resolvedTtlMs,
+      lastAccessedAt: now
+    });
+    this.evictOverflow();
+  }
+  async getOrSet(key, loader, ttlMs) {
+    this.pruneExpired();
+    const cachedEntry = this.getFreshEntry(key);
+    if (cachedEntry) {
+      return cachedEntry.value;
+    }
+    const inflightRequest = this.inflight.get(key);
+    if (inflightRequest) {
+      return inflightRequest;
+    }
+    const pendingRequest = loader().then((value) => {
+      this.set(key, value, ttlMs);
+      return value;
+    }).finally(() => {
+      this.inflight.delete(key);
+    });
+    this.inflight.set(key, pendingRequest);
+    return pendingRequest;
+  }
+  attachTags(key, tags) {
+    if (tags.length === 0) {
+      return;
+    }
+    let tagsForKey = this.keyTags.get(key);
+    if (!tagsForKey) {
+      tagsForKey = new Set;
+      this.keyTags.set(key, tagsForKey);
+    }
+    for (const tag of tags) {
+      tagsForKey.add(tag);
+      let keysForTag = this.tagIndex.get(tag);
+      if (!keysForTag) {
+        keysForTag = new Set;
+        this.tagIndex.set(tag, keysForTag);
+      }
+      keysForTag.add(key);
+    }
+  }
+  flushTags(tags) {
+    const keysToRemove = new Set;
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      for (const key of keys) {
+        keysToRemove.add(key);
+      }
+    }
+    let removed = 0;
+    for (const key of keysToRemove) {
+      if (this.invalidate(key)) {
+        removed += 1;
+      }
+    }
+    for (const tag of tags) {
+      this.tagIndex.delete(tag);
+    }
+    return removed;
+  }
+  invalidate(key) {
+    const removed = this.cache.delete(key);
+    if (removed) {
+      this.detachKeyFromTags(key);
+    }
+    return removed;
+  }
+  invalidateByPrefix(prefix) {
+    let removed = 0;
+    for (const key of [...this.cache.keys()]) {
+      if (key === prefix || key.startsWith(`${prefix}?`)) {
+        if (this.invalidate(key)) {
+          removed += 1;
+        }
+      }
+    }
+    return removed;
+  }
+  clear() {
+    this.cache.clear();
+    this.inflight.clear();
+    this.tagIndex.clear();
+    this.keyTags.clear();
+  }
+  size() {
+    this.pruneExpired();
+    return this.cache.size;
+  }
+  detachKeyFromTags(key) {
+    const tags = this.keyTags.get(key);
+    if (!tags) {
+      return;
+    }
+    for (const tag of tags) {
+      const keys = this.tagIndex.get(tag);
+      if (!keys) {
+        continue;
+      }
+      keys.delete(key);
+      if (keys.size === 0) {
+        this.tagIndex.delete(tag);
+      }
+    }
+    this.keyTags.delete(key);
+  }
+  getFreshEntry(key) {
+    const entry = this.cache.get(key);
+    if (!entry) {
+      return;
+    }
+    if (entry.expiresAt <= Date.now()) {
+      this.invalidate(key);
+      return;
+    }
+    entry.lastAccessedAt = Date.now();
+    return entry;
+  }
+  pruneExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.cache.entries()) {
+      if (entry.expiresAt <= now) {
+        this.invalidate(key);
+      }
+    }
+  }
+  evictOverflow() {
+    while (this.cache.size > this.maxEntries) {
+      let oldestKey;
+      let oldestAccessTime = Number.POSITIVE_INFINITY;
+      for (const [key, entry] of this.cache.entries()) {
+        if (entry.lastAccessedAt < oldestAccessTime) {
+          oldestAccessTime = entry.lastAccessedAt;
+          oldestKey = key;
+        }
+      }
+      if (!oldestKey) {
+        return;
+      }
+      this.invalidate(oldestKey);
+    }
+  }
+}
+var simpleCache_default = SimpleCache;
+
+// ../../src/core/cache/simpleCacheStore.ts
+class SimpleCacheStore {
+  cache;
+  constructor(cache) {
+    this.cache = cache;
+  }
+  get(key) {
+    return Promise.resolve(this.cache.get(key));
+  }
+  set(key, value, ttlMs) {
+    this.cache.set(key, value, ttlMs);
+    return Promise.resolve();
+  }
+  getOrSet(key, loader, ttlMs) {
+    return this.cache.getOrSet(key, loader, ttlMs);
+  }
+  attachTags(key, tags) {
+    this.cache.attachTags(key, tags);
+    return Promise.resolve();
+  }
+  flushTags(tags) {
+    return Promise.resolve(this.cache.flushTags(tags));
+  }
+  invalidate(key) {
+    return Promise.resolve(this.cache.invalidate(key));
+  }
+  invalidateByPrefix(prefix) {
+    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
+  }
+  clear() {
+    this.cache.clear();
+    return Promise.resolve();
+  }
+  size() {
+    return Promise.resolve(this.cache.size());
+  }
+}
+var simpleCacheStore_default = SimpleCacheStore;
+
+// ../../src/core/cache/createCacheStore.ts
+function createCacheStore(options) {
+  if (options.driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
+  }
+  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
+}
+// ../../src/core/cache/tags.ts
+var CACHE_TAGS = {
+  organizations: "organizations",
+  projects: "projects",
+  tasks: "tasks",
+  comments: "comments",
+  attachments: "attachments",
+  reports: "reports"
+};
+// ../../src/core/database/seeders/runner.ts
+import { readdir } from "fs/promises";
+import { join } from "path";
+import { pathToFileURL } from "url";
+async function loadSeedersFromDirectory(directory) {
+  const entries = await readdir(directory);
+  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
+    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
+    const module = await import(moduleUrl);
+    return module.default;
+  }));
+  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
+}
+async function runSeedersFromDirectory(directory, db2, options) {
+  const seeders = await loadSeedersFromDirectory(directory);
+  if (seeders.length === 0) {
+    return 0;
+  }
+  for (const seeder of seeders) {
+    options?.onSeeder?.(seeder.name);
+    await seeder.run(db2);
+  }
+  return seeders.length;
+}
+// ../../src/core/mail/mailer.ts
+function resolveSmtpConfig() {
+  const host = process.env.MAIL_HOST?.trim();
+  if (!host) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_HOST to be set.');
+  }
+  const from = process.env.MAIL_FROM?.trim();
+  if (!from) {
+    throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
+  }
+  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
+  }
+  return {
+    host,
+    port,
+    from,
+    secure: (process.env.MAIL_SECURE ?? "false") === "true",
+    ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
+    ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
+  };
+}
+function encodeBase64(value) {
+  return Buffer.from(value, "utf8").toString("base64");
+}
+function parseSmtpResponses(buffer) {
+  const responses = [];
+  let remainder = buffer;
+  while (remainder.includes(`\r
+`)) {
+    const index = remainder.indexOf(`\r
+`);
+    const line = remainder.slice(0, index);
+    remainder = remainder.slice(index + 2);
+    if (line.length >= 4 && line[3] === "-") {
+      continue;
+    }
+    responses.push(line);
+  }
+  return { responses, remainder };
+}
+async function waitForSmtpResponse(readResponse, expectedCodes) {
+  const response = await readResponse();
+  const code = response.slice(0, 3);
+  if (!expectedCodes.includes(code)) {
+    throw new Error(`Unexpected SMTP response: ${response}`);
+  }
+  return response;
+}
+async function openSmtpConnection(config) {
+  let buffer = "";
+  const waiters = [];
+  const readResponse = () => new Promise((resolve, reject) => {
+    const parsed = parseSmtpResponses(buffer);
+    if (parsed.responses.length > 0) {
+      buffer = parsed.remainder;
+      resolve(parsed.responses.shift());
+      return;
+    }
+    waiters.push({ resolve, reject });
+  });
+  const socket = await Bun.connect({
+    hostname: config.host,
+    port: config.port,
+    socket: {
+      open() {},
+      data(_socket, chunk) {
+        buffer += Buffer.from(chunk).toString("utf8");
+        const parsed = parseSmtpResponses(buffer);
+        buffer = parsed.remainder;
+        while (parsed.responses.length > 0 && waiters.length > 0) {
+          const response = parsed.responses.shift();
+          waiters.shift()?.resolve(response);
+        }
+      },
+      error(_socket, error) {
+        const pending = waiters.splice(0);
+        for (const waiter of pending) {
+          waiter.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+      }
+    }
+  });
+  return { socket, readResponse };
+}
+async function defaultSmtpTransport(config, message) {
+  const { socket, readResponse } = await openSmtpConnection(config);
+  try {
+    await waitForSmtpResponse(readResponse, ["220"]);
+    await socket.write(`EHLO workhub.local\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    if (config.username && config.password) {
+      await socket.write(`AUTH LOGIN\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.username)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["334"]);
+      await socket.write(`${encodeBase64(config.password)}\r
+`);
+      await waitForSmtpResponse(readResponse, ["235"]);
+    }
+    await socket.write(`MAIL FROM:<${config.from}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`RCPT TO:<${message.to}>\r
+`);
+    await waitForSmtpResponse(readResponse, ["250", "251"]);
+    await socket.write(`DATA\r
+`);
+    await waitForSmtpResponse(readResponse, ["354"]);
+    const payload = buildSmtpPayload(config.from, message);
+    await socket.write(payload);
+    await waitForSmtpResponse(readResponse, ["250"]);
+    await socket.write(`QUIT\r
+`);
+    await waitForSmtpResponse(readResponse, ["221"]);
+  } finally {
+    socket.end();
+  }
+}
+function buildSmtpPayload(from, message) {
+  const headers = [
+    `From: ${from}`,
+    `To: ${message.to}`,
+    `Subject: ${message.subject}`,
+    "MIME-Version: 1.0"
+  ];
+  if (message.html) {
+    const boundary = `strata-${Date.now().toString(36)}`;
+    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+    const parts = [
+      `--${boundary}`,
+      "Content-Type: text/plain; charset=utf-8",
+      "",
+      message.body,
+      `--${boundary}`,
+      "Content-Type: text/html; charset=utf-8",
+      "",
+      message.html,
+      `--${boundary}--`,
+      ""
+    ];
+    return [...headers, "", ...parts, ".", ""].join(`\r
+`);
+  }
+  headers.push("Content-Type: text/plain; charset=utf-8");
+  return [...headers, "", message.body, ".", ""].join(`\r
+`);
+}
+
+class LogMailDriver {
+  async send(message) {
+    console.log(JSON.stringify({
+      level: "info",
+      channel: "mail",
+      to: message.to,
+      subject: message.subject,
+      body: message.body,
+      ...message.html ? { html: message.html } : {}
+    }));
+  }
+}
+
+class SmtpMailDriver {
+  config;
+  transport;
+  constructor(config, transport = defaultSmtpTransport) {
+    this.config = config;
+    this.transport = transport;
+  }
+  send(message) {
+    return this.transport(this.config, message);
+  }
+}
+
+class Mailer {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  send(message) {
+    return this.driver.send(message);
+  }
+}
+function createMailDriver() {
+  const driver = process.env.MAIL_DRIVER ?? "log";
+  if (driver === "smtp") {
+    return new SmtpMailDriver(resolveSmtpConfig());
+  }
+  return new LogMailDriver;
+}
+var appMailer = new Mailer(createMailDriver());
+
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join2 } from "path";
+var {S3Client } = globalThis.Bun;
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
+  resolvePath(path) {
+    return join2(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver;
+}
+var defaultStorage = { current: null };
+function storage() {
+  if (!defaultStorage.current) {
+    defaultStorage.current = new StorageManager(createStorageDriver());
+  }
+  return defaultStorage.current;
+}
+function resetDefaultStorage() {
+  defaultStorage.current = null;
+}
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function computeEtagFromJson(data) {
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+// ../../src/config/cors.ts
+var corsConfig = {
+  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
+  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+  allowedHeaders: [
+    "Authorization",
+    "Content-Type",
+    "X-Request-Id",
+    "X-Tenant-Id",
+    "X-Authenticated-User-Id",
+    "X-Authenticated-User-Role",
+    "If-Match",
+    "If-None-Match"
+  ],
+  maxAgeSeconds: 86400
+};
+// ../../src/core/http/csrfToken.ts
+import { timingSafeEqual } from "crypto";
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+}
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
+  }
+  return createCsrfTokenCookie();
+}
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
+  }
+  return null;
+}
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
+  }
+  return null;
+}
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
+  }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (!cookieValue) {
+    return false;
+  }
+  if (!tokensMatch(submittedToken, cookieValue)) {
+    return false;
+  }
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+// ../../src/core/http/flashSession.ts
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function createFlashCookie(message) {
+  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
+  const issuedAt = Date.now();
+  const value = signFlashPayload(payload, issuedAt);
+  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+}
+function clearFlashCookie() {
+  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+function flashResponse(response, message) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", createFlashCookie(message));
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+// ../../src/core/http/validation.ts
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/core/view/etaViewEngine.ts
+import { join as join3 } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
+}
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
+}
+
+// ../../src/core/http/webErrorResponse.ts
+function normalizeFieldErrors(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return {};
+  }
+  const errors = {};
+  for (const [field, messages] of Object.entries(details)) {
+    if (Array.isArray(messages)) {
+      errors[field] = messages.map(String);
+      continue;
+    }
+    if (typeof messages === "string") {
+      errors[field] = [messages];
+    }
+  }
+  return errors;
+}
+function webErrorResponse(error, request) {
+  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
+    return null;
+  }
+  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
+  if (mappedError instanceof UnauthorizedError) {
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+  }
+  if (mappedError instanceof ValidationError) {
+    const errors = normalizeFieldErrors(mappedError.details);
+    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
+`);
+    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
+  }
+  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
+    status: mappedError.status
+  });
+}
+// ../../src/core/http/resources.ts
+function serializeDate(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function toResourceCollection(items, transformer) {
+  return items.map(transformer);
+}
+function toPaginatedResourceCollection(items, meta, transformer) {
+  return {
+    data: toResourceCollection(items, transformer),
+    meta
+  };
+}
+// ../../src/config/uploads.ts
+var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var ALLOWED_UPLOAD_MIME_TYPES = new Set([
+  "application/pdf",
+  "application/json",
+  "application/zip",
+  "application/x-zip-compressed",
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "text/plain",
+  "text/csv"
+]);
+// ../../src/core/http/memoryThrottleMiddleware.ts
+var buckets = new Map;
+// ../../src/core/metrics/prometheus.ts
+class PrometheusRegistry {
+  httpRequestsTotal = new Map;
+  httpRequestDurationMs = new Map;
+  incrementHttpRequest(labels) {
+    const key = this.metricKey(labels);
+    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
+  }
+  observeHttpDuration(labels, durationMs) {
+    const key = this.metricKey(labels);
+    const samples = this.httpRequestDurationMs.get(key) ?? [];
+    samples.push(durationMs);
+    this.httpRequestDurationMs.set(key, samples);
+  }
+  renderMetrics() {
+    const lines = [
+      "# HELP http_requests_total Total HTTP requests processed.",
+      "# TYPE http_requests_total counter"
+    ];
+    for (const [key, value] of this.httpRequestsTotal) {
+      lines.push(`http_requests_total{${key}} ${value}`);
+    }
+    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
+    for (const [key, samples] of this.httpRequestDurationMs) {
+      const sum = samples.reduce((total, sample) => total + sample, 0);
+      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    }
+    return `${lines.join(`
+`)}
+`;
+  }
+  resetForTests() {
+    this.httpRequestsTotal.clear();
+    this.httpRequestDurationMs.clear();
+  }
+  getHttpRequestSummary() {
+    const byStatus = {};
+    const pathCounts = new Map;
+    let totalRequests = 0;
+    for (const [key, count] of this.httpRequestsTotal) {
+      totalRequests += count;
+      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
+      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
+      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      byStatus[status] = (byStatus[status] ?? 0) + count;
+      const pathKey = `${method} ${path}`;
+      const existing = pathCounts.get(pathKey);
+      if (existing) {
+        existing.count += count;
+      } else {
+        pathCounts.set(pathKey, { method, path, count });
+      }
+    }
+    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
+    return {
+      totalRequests,
+      byStatus,
+      topPaths
+    };
+  }
+  metricKey(labels) {
+    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+  }
+}
+var prometheusRegistry = new PrometheusRegistry;
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+// ../../src/core/http/parseFormBody.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected a form submission.");
+  }
+  return formDataToRecord(await request.formData());
+}
+function formDataToRecord(formData) {
+  const values = {};
+  for (const [key, value] of formData.entries()) {
+    if (typeof value === "string") {
+      values[key] = value;
+    }
+  }
+  return values;
+}
+
+// ../../src/core/http/webFormRequest.ts
+class WebFormRequest {
+  authorize(_request) {
+    return true;
+  }
+  validatePayload(payload) {
+    return this.parse(payload);
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    const payload = requestPrefersJson(request) ? await parseJsonBody(request, (body) => body) : await parseFormBody(request);
+    try {
+      return this.validatePayload(payload);
+    } catch (error) {
+      if (error instanceof ValidationError) {
+        throw error;
+      }
+      throw error;
+    }
+  }
+}
+// ../../src/core/lifecycle/gracefulShutdown.ts
+var shutdownHandlers = new Map;
+var shutdownInstalled = false;
+var shuttingDown = false;
+function registerShutdownHandler(name, handler) {
+  shutdownHandlers.set(name, handler);
+  return () => {
+    shutdownHandlers.delete(name);
+  };
+}
+async function runGracefulShutdown(signal) {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
+  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
+  for (const [name, handler] of shutdownHandlers) {
+    try {
+      await handler();
+      console.log(`[shutdown] Completed ${name}`);
+    } catch (error) {
+      console.error(`[shutdown] Failed ${name}:`, error);
+    }
+  }
+}
+function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
+  if (shutdownInstalled) {
+    return;
+  }
+  shutdownInstalled = true;
+  for (const signal of signals) {
+    process.on(signal, () => {
+      runGracefulShutdown(signal).finally(() => {
+        process.exit(0);
+      });
+    });
+  }
+}
+function resetGracefulShutdownForTests() {
+  shutdownHandlers.clear();
+  shutdownInstalled = false;
+  shuttingDown = false;
+}
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+// ../../src/core/queue/queueMetrics.ts
+var {RedisClient: RedisClient3 } = globalThis.Bun;
+async function readRedisQueueDepth(redisUrl) {
+  const client = new RedisClient3(redisUrl);
+  const [high, defaultQueue, low] = await Promise.all([
+    client.llen(QUEUE_HIGH_KEY),
+    client.llen(QUEUE_LIST_KEY),
+    client.llen(QUEUE_LOW_KEY)
+  ]);
+  return {
+    high: Number(high ?? 0),
+    default: Number(defaultQueue ?? 0),
+    low: Number(low ?? 0),
+    total: Number(high ?? 0) + Number(defaultQueue ?? 0) + Number(low ?? 0)
+  };
+}
+async function collectQueueMetrics() {
+  const driver = queueConfig.driver;
+  const failedJobs = createFailedJobService();
+  const failedCount = (await failedJobs.listRecent(1000)).length;
+  if (driver !== "redis") {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  const redisUrl = process.env.REDIS_URL;
+  if (!redisUrl) {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  return {
+    driver,
+    pending: await readRedisQueueDepth(redisUrl),
+    failedCount
+  };
+}
+// ../../src/core/scheduler/schedule.ts
+class Schedule {
+  tasks = [];
+  command(expression, name, run) {
+    this.tasks.push({ expression, name, run });
+    return this;
+  }
+  dueTasks(now = new Date) {
+    const minute = now.getMinutes();
+    return this.tasks.filter((task) => {
+      if (task.expression === "* * * * *") {
+        return true;
+      }
+      if (task.expression.startsWith("*/")) {
+        const interval = Number.parseInt(task.expression.slice(2), 10);
+        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
+      }
+      return false;
+    });
+  }
+  tasksList() {
+    return [...this.tasks];
+  }
+}
+var appSchedule = new Schedule;
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+// ../../src/core/tracing/traceContext.ts
+var traceContextStorage = createAsyncContextStore("@getstrata/traceContext");
+// ../../src/core/validation/rules.ts
+function required() {
+  return (field, value) => {
+    if (value === undefined || value === null || typeof value === "string" && value.trim() === "") {
+      return `"${field}" is required.`;
+    }
+    return;
+  };
+}
+function stringRule() {
+  return (field, value) => {
+    if (value === undefined || value === null) {
+      return;
+    }
+    if (typeof value !== "string") {
+      return `"${field}" must be a string.`;
+    }
+    return;
+  };
+}
+function minLength(minimum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length < minimum) {
+      return `"${field}" must be at least ${minimum} characters.`;
+    }
+    return;
+  };
+}
+function maxLength(maximum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length > maximum) {
+      return `"${field}" must be at most ${maximum} characters.`;
+    }
+    return;
+  };
+}
+function pattern(expression) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!expression.test(value.trim())) {
+      return `"${field}" has an invalid format.`;
+    }
+    return;
+  };
+}
+function enumRule(allowedValues) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (!allowedValues.includes(value)) {
+      return `"${field}" must be one of: ${allowedValues.join(", ")}.`;
+    }
+    return;
+  };
+}
+function optional() {
+  return () => {
+    return;
+  };
+}
+function integerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed)) {
+      return `"${field}" must be an integer.`;
+    }
+    return;
+  };
+}
+function emailRule() {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    const normalized = value.trim();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
+      return `"${field}" must be a valid email address.`;
+    }
+    return;
+  };
+}
+function confirmed(fieldName) {
+  return (field, value, payload) => {
+    const confirmationKey = `${fieldName}_confirmation`;
+    const confirmation = payload[confirmationKey];
+    if (value !== confirmation) {
+      return `"${field}" confirmation does not match.`;
+    }
+    return;
+  };
+}
+function positiveIntegerRule() {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      return `"${field}" must be a positive integer.`;
+    }
+    return;
+  };
+}
+function integerRange(minimum, maximum) {
+  return (field, value) => {
+    if (value === undefined || value === null || value === "") {
+      return;
+    }
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
+    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
+      return `"${field}" must be an integer between ${minimum} and ${maximum}.`;
+    }
+    return;
+  };
+}
+function validateObject(payload, schema) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new ValidationError("Request body must be a JSON object.");
+  }
+  const body = payload;
+  const errors = {};
+  const output = {};
+  for (const [field, rules] of Object.entries(schema)) {
+    const messages = rules.map((rule) => rule(field, body[field], body)).filter((message) => message !== undefined);
+    if (messages.length > 0) {
+      errors[field] = messages;
+      continue;
+    }
+    if (field in body && body[field] !== undefined) {
+      const rawValue = body[field];
+      output[field] = typeof rawValue === "string" ? rawValue.trim() : rawValue;
+    }
+  }
+  if (Object.keys(errors).length > 0) {
+    throw new ValidationError("The given data was invalid.", errors);
+  }
+  return output;
+}
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac as createHmac5 } from "crypto";
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+class DispatchWebhookJob extends Job {
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await repositoryConnection`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac5("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      }, { allowHttp: appConfig.env !== "production" });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await repositoryConnection`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await repositoryConnection`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
+  }
+}
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/core/jobs/invalidateCacheTagsJob.ts
+class InvalidateCacheTagsJob extends Job {
+  cache;
+  constructor(cache2) {
+    super();
+    this.cache = cache2;
+  }
+  async handle(payload) {
+    await this.cache.tags(...payload.tags).flush();
+  }
+}
+var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
 
 // ../../src/bootstrap/queue/defaultJobs.ts
 function registerDefaultJobs() {