@getstrata/core 0.5.18 → 0.5.21

package/dist/entries/queue/createAppQueue.js

@@ -1937,8 +1937,9 @@ class JobRegistry {
 }
 var jobRegistry = new JobRegistry;
 
-// ../../src/bootstrap/config.ts
+// ../../src/core/contracts/serviceTokens.ts
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+// ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";
 
 // ../../src/config/queue.ts
@@ -2153,6 +2154,237 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 
+// ../../src/core/jobs/dispatchWebhookJob.ts
+import { createHmac } from "crypto";
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/jobs/dispatchWebhookJob.ts
+class DispatchWebhookJob extends Job {
+  maxAttempts = 3;
+  backoffMs = 2000;
+  async handle(payload) {
+    const rows = await repositoryConnection`
+      SELECT id, url, secret
+      FROM webhook
+      WHERE id = ${payload.webhookId} AND active = TRUE
+      LIMIT 1
+    `;
+    const webhook = rows[0];
+    if (!webhook) {
+      return;
+    }
+    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
+    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
+    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
+    let responseStatus = null;
+    let errorMessage = null;
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-workhub-signature": signature
+        },
+        body
+      }, { allowHttp: appConfig.env !== "production" });
+      responseStatus = response.status;
+      if (!response.ok) {
+        throw new Error(`Webhook delivery failed with status ${response.status}.`);
+      }
+    } catch (error) {
+      errorMessage = error instanceof Error ? error.message : String(error);
+      await repositoryConnection`
+        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
+        VALUES (
+          ${webhook.id},
+          ${payload.event},
+          ${JSON.stringify(payload.payload)}::jsonb,
+          ${responseStatus},
+          ${errorMessage}
+        )
+      `;
+      throw error instanceof Error ? error : new Error(errorMessage);
+    }
+    await repositoryConnection`
+      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
+      VALUES (
+        ${webhook.id},
+        ${payload.event},
+        ${JSON.stringify(payload.payload)}::jsonb,
+        ${responseStatus}
+      )
+    `;
+  }
+}
+var dispatchWebhookJob_default = DispatchWebhookJob;
+
+// ../../src/core/jobs/invalidateCacheTagsJob.ts
+class InvalidateCacheTagsJob extends Job {
+  cache;
+  constructor(cache) {
+    super();
+    this.cache = cache;
+  }
+  async handle(payload) {
+    await this.cache.tags(...payload.tags).flush();
+  }
+}
+var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
+
+// ../../src/core/contracts/applicationContext.ts
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${String(key)}" is not registered.`);
+  }
+  return dependency;
+}
+
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -2189,79 +2421,7 @@ class Logger {
 }
 var appLogger = new Logger("app");
 
-// ../../src/bootstrap/contracts.ts
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
-  }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
-  }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
-  }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
-    }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
-    }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
-    }
-    throw new Error(`Service "${key}" is not registered.`);
-  }
-  resolve(key) {
-    return this.get(key);
-  }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
-  }
-}
-
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
-  }
-  get(key) {
-    return this.values.get(key);
-  }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
-    }
-    return this.values.get(key);
-  }
-  has(key) {
-    return this.values.has(key);
-  }
-}
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/bootstrap/applicationRegistry.ts
+// ../../src/core/runtime/applicationRegistry.ts
 var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
 var activeContext;
 function readStoredApplicationContext() {
@@ -2284,2587 +2444,6 @@ function requireActiveApplicationContext() {
 function resolveApplicationCache() {
   return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
 }
-// ../../src/core/admin/registry.ts
-class AdminResourceRegistry {
-  resources = new Map;
-  constructor() {}
-  register(resource) {
-    if (this.resources.has(resource.name)) {
-      throw new Error(`Admin resource "${resource.name}" is already registered.`);
-    }
-    this.resources.set(resource.name, resource);
-  }
-  get(name) {
-    return this.resources.get(name);
-  }
-  list() {
-    const definitions = [];
-    for (const resource of this.resources.values()) {
-      const { handlers: _handlers, ...definition } = resource;
-      definitions.push(definition);
-    }
-    return definitions;
-  }
-  all() {
-    return [...this.resources.values()];
-  }
-  clear() {
-    this.resources.clear();
-  }
-}
-// ../../src/core/auth/authContext.ts
-var authContext = createAsyncContextStore("@getstrata/authContext");
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-// ../../src/domain/abilities.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
-  "auth:tokens:read",
-  "auth:tokens:write"
-];
-var ADMIN_ABILITIES = [
-  ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
-  "webhooks:read",
-  "webhooks:write",
-  "audit:read"
-];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-// ../../src/core/auth/oauth/oidcProvider.ts
-class OidcProvider {
-  options;
-  name;
-  constructor(options) {
-    this.options = options;
-    this.name = options.name;
-  }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      response_type: "code",
-      scope: (this.options.scopes ?? ["openid", "email", "profile"]).join(" "),
-      state
-    });
-    return `${this.options.issuer.replace(/\/$/, "")}/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/token`, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.options.redirectUri,
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("OIDC token exchange failed.");
-    }
-    const profileResponse = await fetch(`${this.options.issuer.replace(/\/$/, "")}/userinfo`, {
-      headers: { authorization: `Bearer ${tokenBody.access_token}` }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: profile.sub,
-      email: profile.email ?? `${profile.sub}@oidc.local`,
-      name: profile.name ?? profile.sub
-    };
-  }
-}
-
-// ../../src/core/auth/oauth/providers.ts
-class GitHubOAuthProvider {
-  options;
-  name = "github";
-  constructor(options) {
-    this.options = options;
-  }
-  getAuthorizationUrl(state) {
-    const params = new URLSearchParams({
-      client_id: this.options.clientId,
-      redirect_uri: this.options.redirectUri,
-      scope: "read:user user:email",
-      state
-    });
-    return `https://github.com/login/oauth/authorize?${params.toString()}`;
-  }
-  async exchangeCode(code) {
-    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: this.options.clientId,
-        client_secret: this.options.clientSecret,
-        code,
-        redirect_uri: this.options.redirectUri
-      })
-    });
-    const tokenBody = await tokenResponse.json();
-    if (!tokenBody.access_token) {
-      throw new Error("GitHub OAuth token exchange failed.");
-    }
-    const profileResponse = await fetch("https://api.github.com/user", {
-      headers: {
-        authorization: `Bearer ${tokenBody.access_token}`,
-        accept: "application/json",
-        "user-agent": "workhub"
-      }
-    });
-    const profile = await profileResponse.json();
-    return {
-      providerUserId: String(profile.id),
-      email: profile.email ?? `${profile.login}@users.noreply.github.com`,
-      name: profile.name ?? profile.login
-    };
-  }
-}
-
-class MockOAuthProvider {
-  profile;
-  name = "mock";
-  constructor(profile) {
-    this.profile = profile;
-  }
-  getAuthorizationUrl(state) {
-    return `https://mock.oauth/authorize?state=${encodeURIComponent(state)}`;
-  }
-  async exchangeCode(code) {
-    if (code !== "valid-code") {
-      throw new Error("Invalid OAuth code.");
-    }
-    return this.profile;
-  }
-}
-
-// ../../src/core/auth/oauth/samlProvider.ts
-class SamlProvider {
-  loginUrl;
-  name = "saml";
-  constructor(loginUrl) {
-    this.loginUrl = loginUrl;
-  }
-  getAuthorizationUrl(state) {
-    return `${this.loginUrl}?state=${encodeURIComponent(state)}`;
-  }
-  async exchangeCode(code) {
-    if (!code.startsWith("saml:")) {
-      throw new Error("Invalid SAML assertion reference.");
-    }
-    const [, email, name] = code.split(":");
-    return {
-      providerUserId: email ?? "saml-user",
-      email: email ?? "saml-user@workhub.test",
-      name: name ?? "SAML User"
-    };
-  }
-}
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection2(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection2(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/user/apiTokenTable.ts
-var apiTokenTable = defineTable({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/core/auth/password.ts
-async function hashPassword(password) {
-  return await Bun.password.hash(password, {
-    algorithm: "bcrypt",
-    cost: 10
-  });
-}
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
-  }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
-  }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
-}
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
-  }
-  if (featureFlag === "true") {
-    return true;
-  }
-  return (process.env.APP_ENV ?? "local") === "production";
-}
-function encryptField(plaintext, key) {
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  const payload = Buffer.concat([iv, encrypted, tag]).toString("base64");
-  return `${ENCRYPTION_PREFIX}${payload}`;
-}
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
-  }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-function hashLookupValue(normalizedValue, key) {
-  return createHmac("sha256", key).update(normalizedValue).digest("hex");
-}
-function normalizeEmail(email) {
-  return email.trim().toLowerCase();
-}
-function protectEmail(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return { storedEmail: normalized, emailLookup: normalized };
-  }
-  return {
-    storedEmail: encryptField(normalized, key),
-    emailLookup: hashLookupValue(normalized, key)
-  };
-}
-function revealEmail(storedEmail) {
-  const key = resolveEncryptionKey();
-  if (!key || !storedEmail.startsWith(ENCRYPTION_PREFIX)) {
-    return storedEmail;
-  }
-  return decryptField(storedEmail, key);
-}
-function emailLookupForQuery(email) {
-  const normalized = normalizeEmail(email);
-  const key = resolveEncryptionKey();
-  if (!key || !isFieldEncryptionEnabled()) {
-    return normalized;
-  }
-  return hashLookupValue(normalized, key);
-}
-
-// ../../src/core/crypto/mfaSecret.ts
-function protectMfaSecret(secret) {
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key) {
-    return secret;
-  }
-  return encryptField(secret, key);
-}
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
-  }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
-  }
-  return decryptField(stored, key);
-}
-
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
-  }
-  return parsed;
-}
-
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
-    }
-    bits += value.toString(2).padStart(5, "0");
-  }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
-  }
-  return Buffer.from(bytes);
-}
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
-}
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
-  }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// ../../src/core/tenant/tenantContext.ts
-var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function currentTenantId() {
-  return currentTenant()?.id ?? 1;
-}
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
-// ../../src/modules/user/notificationTable.ts
-var notificationTable = defineTable({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
-
-// ../../src/modules/user/oauthIdentityRepository.ts
-var oauthIdentityTable = defineTable({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/table.ts
-var userTable = defineTable({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac as createHmac3 } from "crypto";
-function resolveTokenPepper() {
-  return process.env.TOKEN_HASH_PEPPER?.trim() ?? "workhub-dev-token-pepper";
-}
-function hashApiToken(token) {
-  const pepper = resolveTokenPepper();
-  if (pepper && pepper !== "workhub-dev-token-pepper") {
-    return createHmac3("sha256", pepper).update(token).digest("hex");
-  }
-  return createHash("sha256").update(token).digest("hex");
-}
-
-// ../../src/modules/user/provider.ts
-var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var membershipRepository = new memberRepository_default;
-// ../../src/core/auth/policy.ts
-var BLOCKED_POLICY_ACTIONS = new Set([
-  "constructor",
-  "toString",
-  "valueOf",
-  "hasOwnProperty",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "__proto__"
-]);
-
-class PolicyGate {
-  constructor() {}
-  policies = new Map;
-  register(resource, policy) {
-    this.policies.set(resource, policy);
-  }
-  allows(resource, action, user, model) {
-    const policy = this.policies.get(resource);
-    if (!policy) {
-      return false;
-    }
-    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
-      return false;
-    }
-    const handler = policy[action];
-    if (typeof handler !== "function") {
-      return false;
-    }
-    const resolvedUser = user === undefined ? currentAuthUser() : user;
-    return model === undefined ? handler.call(policy, resolvedUser) : handler.call(policy, resolvedUser, model);
-  }
-  authorize(resource, action, user, model) {
-    if (!this.allows(resource, action, user, model)) {
-      throw new ForbiddenError;
-    }
-  }
-}
-// ../../src/core/cache/redisCacheStore.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
-var KEY_PREFIX = "workhub:cache:";
-var TAG_PREFIX = "workhub:cache:tag:";
-
-class RedisCacheStore {
-  ttlMs;
-  maxEntries;
-  client;
-  inflight = new Map;
-  keyTags = new Map;
-  constructor(redisUrl, ttlMs, maxEntries) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    this.client = new RedisClient2(redisUrl);
-  }
-  async get(key) {
-    const raw = await this.client.get(this.storageKey(key));
-    if (raw === null) {
-      return;
-    }
-    return JSON.parse(raw);
-  }
-  async set(key, value, ttlMs) {
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    const payload = JSON.stringify(value);
-    if (resolvedTtlMs > 0) {
-      await this.client.psetex(this.storageKey(key), resolvedTtlMs, payload);
-    } else {
-      await this.client.set(this.storageKey(key), payload);
-    }
-    await this.enforceMaxEntries();
-  }
-  async getOrSet(key, loader, ttlMs) {
-    const cached = await this.get(key);
-    if (cached !== undefined) {
-      return cached;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then(async (value) => {
-      await this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
-  }
-  async attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      await this.client.sadd(this.tagKey(tag), key);
-    }
-  }
-  async flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const members = await this.client.smembers(this.tagKey(tag));
-      for (const member of members) {
-        keysToRemove.add(member);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (await this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      await this.client.del(this.tagKey(tag));
-    }
-    return removed;
-  }
-  async invalidate(key) {
-    const deleted = await this.client.del(this.storageKey(key));
-    await this.detachKeyFromTags(key);
-    return deleted > 0;
-  }
-  async invalidateByPrefix(prefix) {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    let removed = 0;
-    for (const storageKey of keys) {
-      const key = storageKey.slice(KEY_PREFIX.length);
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (await this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
-  }
-  async clear() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length > 0) {
-      await this.client.del(...keys);
-    }
-    const tagKeys = await this.client.keys(`${TAG_PREFIX}*`);
-    if (tagKeys.length > 0) {
-      await this.client.del(...tagKeys);
-    }
-    this.inflight.clear();
-    this.keyTags.clear();
-  }
-  async size() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    return keys.length;
-  }
-  storageKey(key) {
-    return `${KEY_PREFIX}${key}`;
-  }
-  tagKey(tag) {
-    return `${TAG_PREFIX}${tag}`;
-  }
-  async detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      await this.client.srem(this.tagKey(tag), key);
-    }
-    this.keyTags.delete(key);
-  }
-  async enforceMaxEntries() {
-    const keys = await this.client.keys(`${KEY_PREFIX}*`);
-    if (keys.length <= this.maxEntries) {
-      return;
-    }
-    const overflow = keys.length - this.maxEntries;
-    const keysToRemove = keys.slice(0, overflow);
-    if (keysToRemove.length > 0) {
-      await this.client.del(...keysToRemove);
-    }
-  }
-}
-var redisCacheStore_default = RedisCacheStore;
-
-// ../../src/core/cache/simpleCache.ts
-class SimpleCache {
-  ttlMs;
-  maxEntries;
-  cache = new Map;
-  inflight = new Map;
-  tagIndex = new Map;
-  keyTags = new Map;
-  constructor(ttlMs = 3600000, maxEntries = 100) {
-    this.ttlMs = ttlMs;
-    this.maxEntries = maxEntries;
-    if (!Number.isFinite(ttlMs) || ttlMs < 0) {
-      throw new RangeError("ttlMs must be a non-negative number.");
-    }
-    if (!Number.isInteger(maxEntries) || maxEntries < 1) {
-      throw new RangeError("maxEntries must be a positive integer.");
-    }
-  }
-  get(key) {
-    return this.getFreshEntry(key)?.value;
-  }
-  set(key, value, ttlMs) {
-    const now = Date.now();
-    const resolvedTtlMs = ttlMs ?? this.ttlMs;
-    this.cache.set(key, {
-      value,
-      expiresAt: now + resolvedTtlMs,
-      lastAccessedAt: now
-    });
-    this.evictOverflow();
-  }
-  async getOrSet(key, loader, ttlMs) {
-    this.pruneExpired();
-    const cachedEntry = this.getFreshEntry(key);
-    if (cachedEntry) {
-      return cachedEntry.value;
-    }
-    const inflightRequest = this.inflight.get(key);
-    if (inflightRequest) {
-      return inflightRequest;
-    }
-    const pendingRequest = loader().then((value) => {
-      this.set(key, value, ttlMs);
-      return value;
-    }).finally(() => {
-      this.inflight.delete(key);
-    });
-    this.inflight.set(key, pendingRequest);
-    return pendingRequest;
-  }
-  attachTags(key, tags) {
-    if (tags.length === 0) {
-      return;
-    }
-    let tagsForKey = this.keyTags.get(key);
-    if (!tagsForKey) {
-      tagsForKey = new Set;
-      this.keyTags.set(key, tagsForKey);
-    }
-    for (const tag of tags) {
-      tagsForKey.add(tag);
-      let keysForTag = this.tagIndex.get(tag);
-      if (!keysForTag) {
-        keysForTag = new Set;
-        this.tagIndex.set(tag, keysForTag);
-      }
-      keysForTag.add(key);
-    }
-  }
-  flushTags(tags) {
-    const keysToRemove = new Set;
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      for (const key of keys) {
-        keysToRemove.add(key);
-      }
-    }
-    let removed = 0;
-    for (const key of keysToRemove) {
-      if (this.invalidate(key)) {
-        removed += 1;
-      }
-    }
-    for (const tag of tags) {
-      this.tagIndex.delete(tag);
-    }
-    return removed;
-  }
-  invalidate(key) {
-    const removed = this.cache.delete(key);
-    if (removed) {
-      this.detachKeyFromTags(key);
-    }
-    return removed;
-  }
-  invalidateByPrefix(prefix) {
-    let removed = 0;
-    for (const key of [...this.cache.keys()]) {
-      if (key === prefix || key.startsWith(`${prefix}?`)) {
-        if (this.invalidate(key)) {
-          removed += 1;
-        }
-      }
-    }
-    return removed;
-  }
-  clear() {
-    this.cache.clear();
-    this.inflight.clear();
-    this.tagIndex.clear();
-    this.keyTags.clear();
-  }
-  size() {
-    this.pruneExpired();
-    return this.cache.size;
-  }
-  detachKeyFromTags(key) {
-    const tags = this.keyTags.get(key);
-    if (!tags) {
-      return;
-    }
-    for (const tag of tags) {
-      const keys = this.tagIndex.get(tag);
-      if (!keys) {
-        continue;
-      }
-      keys.delete(key);
-      if (keys.size === 0) {
-        this.tagIndex.delete(tag);
-      }
-    }
-    this.keyTags.delete(key);
-  }
-  getFreshEntry(key) {
-    const entry = this.cache.get(key);
-    if (!entry) {
-      return;
-    }
-    if (entry.expiresAt <= Date.now()) {
-      this.invalidate(key);
-      return;
-    }
-    entry.lastAccessedAt = Date.now();
-    return entry;
-  }
-  pruneExpired() {
-    const now = Date.now();
-    for (const [key, entry] of this.cache.entries()) {
-      if (entry.expiresAt <= now) {
-        this.invalidate(key);
-      }
-    }
-  }
-  evictOverflow() {
-    while (this.cache.size > this.maxEntries) {
-      let oldestKey;
-      let oldestAccessTime = Number.POSITIVE_INFINITY;
-      for (const [key, entry] of this.cache.entries()) {
-        if (entry.lastAccessedAt < oldestAccessTime) {
-          oldestAccessTime = entry.lastAccessedAt;
-          oldestKey = key;
-        }
-      }
-      if (!oldestKey) {
-        return;
-      }
-      this.invalidate(oldestKey);
-    }
-  }
-}
-var simpleCache_default = SimpleCache;
-
-// ../../src/core/cache/simpleCacheStore.ts
-class SimpleCacheStore {
-  cache;
-  constructor(cache) {
-    this.cache = cache;
-  }
-  get(key) {
-    return Promise.resolve(this.cache.get(key));
-  }
-  set(key, value, ttlMs) {
-    this.cache.set(key, value, ttlMs);
-    return Promise.resolve();
-  }
-  getOrSet(key, loader, ttlMs) {
-    return this.cache.getOrSet(key, loader, ttlMs);
-  }
-  attachTags(key, tags) {
-    this.cache.attachTags(key, tags);
-    return Promise.resolve();
-  }
-  flushTags(tags) {
-    return Promise.resolve(this.cache.flushTags(tags));
-  }
-  invalidate(key) {
-    return Promise.resolve(this.cache.invalidate(key));
-  }
-  invalidateByPrefix(prefix) {
-    return Promise.resolve(this.cache.invalidateByPrefix(prefix));
-  }
-  clear() {
-    this.cache.clear();
-    return Promise.resolve();
-  }
-  size() {
-    return Promise.resolve(this.cache.size());
-  }
-}
-var simpleCacheStore_default = SimpleCacheStore;
-
-// ../../src/core/cache/createCacheStore.ts
-function createCacheStore(options) {
-  if (options.driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('CACHE_DRIVER="redis" requires REDIS_URL to be set.');
-    }
-    return new redisCacheStore_default(options.redisUrl, options.ttlMs, options.maxEntries);
-  }
-  return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
-}
-// ../../src/core/cache/tags.ts
-var CACHE_TAGS = {
-  organizations: "organizations",
-  projects: "projects",
-  tasks: "tasks",
-  comments: "comments",
-  attachments: "attachments",
-  reports: "reports"
-};
-// ../../src/core/database/seeders/runner.ts
-import { readdir } from "fs/promises";
-import { join } from "path";
-import { pathToFileURL } from "url";
-async function loadSeedersFromDirectory(directory) {
-  const entries = await readdir(directory);
-  const seederFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
-  const loadedSeeders = await Promise.all(seederFiles.map(async (fileName) => {
-    const moduleUrl = pathToFileURL(join(directory, fileName)).href;
-    const module = await import(moduleUrl);
-    return module.default;
-  }));
-  return loadedSeeders.filter((seeder) => seeder?.name !== undefined);
-}
-async function runSeedersFromDirectory(directory, db2, options) {
-  const seeders = await loadSeedersFromDirectory(directory);
-  if (seeders.length === 0) {
-    return 0;
-  }
-  for (const seeder of seeders) {
-    options?.onSeeder?.(seeder.name);
-    await seeder.run(db2);
-  }
-  return seeders.length;
-}
-// ../../src/core/mail/mailer.ts
-function resolveSmtpConfig() {
-  const host = process.env.MAIL_HOST?.trim();
-  if (!host) {
-    throw new Error('MAIL_DRIVER="smtp" requires MAIL_HOST to be set.');
-  }
-  const from = process.env.MAIL_FROM?.trim();
-  if (!from) {
-    throw new Error('MAIL_DRIVER="smtp" requires MAIL_FROM to be set.');
-  }
-  const port = Number.parseInt(process.env.MAIL_PORT ?? "587", 10);
-  if (!Number.isInteger(port) || port <= 0) {
-    throw new Error('Environment variable "MAIL_PORT" must be a positive integer.');
-  }
-  return {
-    host,
-    port,
-    from,
-    secure: (process.env.MAIL_SECURE ?? "false") === "true",
-    ...process.env.MAIL_USERNAME?.trim() ? { username: process.env.MAIL_USERNAME.trim() } : {},
-    ...process.env.MAIL_PASSWORD?.trim() ? { password: process.env.MAIL_PASSWORD.trim() } : {}
-  };
-}
-function encodeBase64(value) {
-  return Buffer.from(value, "utf8").toString("base64");
-}
-function parseSmtpResponses(buffer) {
-  const responses = [];
-  let remainder = buffer;
-  while (remainder.includes(`\r
-`)) {
-    const index = remainder.indexOf(`\r
-`);
-    const line = remainder.slice(0, index);
-    remainder = remainder.slice(index + 2);
-    if (line.length >= 4 && line[3] === "-") {
-      continue;
-    }
-    responses.push(line);
-  }
-  return { responses, remainder };
-}
-async function waitForSmtpResponse(readResponse, expectedCodes) {
-  const response = await readResponse();
-  const code = response.slice(0, 3);
-  if (!expectedCodes.includes(code)) {
-    throw new Error(`Unexpected SMTP response: ${response}`);
-  }
-  return response;
-}
-async function openSmtpConnection(config) {
-  let buffer = "";
-  const waiters = [];
-  const readResponse = () => new Promise((resolve, reject) => {
-    const parsed = parseSmtpResponses(buffer);
-    if (parsed.responses.length > 0) {
-      buffer = parsed.remainder;
-      resolve(parsed.responses.shift());
-      return;
-    }
-    waiters.push({ resolve, reject });
-  });
-  const socket = await Bun.connect({
-    hostname: config.host,
-    port: config.port,
-    socket: {
-      open() {},
-      data(_socket, chunk) {
-        buffer += Buffer.from(chunk).toString("utf8");
-        const parsed = parseSmtpResponses(buffer);
-        buffer = parsed.remainder;
-        while (parsed.responses.length > 0 && waiters.length > 0) {
-          const response = parsed.responses.shift();
-          waiters.shift()?.resolve(response);
-        }
-      },
-      error(_socket, error) {
-        const pending = waiters.splice(0);
-        for (const waiter of pending) {
-          waiter.reject(error instanceof Error ? error : new Error(String(error)));
-        }
-      }
-    }
-  });
-  return { socket, readResponse };
-}
-async function defaultSmtpTransport(config, message) {
-  const { socket, readResponse } = await openSmtpConnection(config);
-  try {
-    await waitForSmtpResponse(readResponse, ["220"]);
-    await socket.write(`EHLO workhub.local\r
-`);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    if (config.username && config.password) {
-      await socket.write(`AUTH LOGIN\r
-`);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.username)}\r
-`);
-      await waitForSmtpResponse(readResponse, ["334"]);
-      await socket.write(`${encodeBase64(config.password)}\r
-`);
-      await waitForSmtpResponse(readResponse, ["235"]);
-    }
-    await socket.write(`MAIL FROM:<${config.from}>\r
-`);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`RCPT TO:<${message.to}>\r
-`);
-    await waitForSmtpResponse(readResponse, ["250", "251"]);
-    await socket.write(`DATA\r
-`);
-    await waitForSmtpResponse(readResponse, ["354"]);
-    const payload = buildSmtpPayload(config.from, message);
-    await socket.write(payload);
-    await waitForSmtpResponse(readResponse, ["250"]);
-    await socket.write(`QUIT\r
-`);
-    await waitForSmtpResponse(readResponse, ["221"]);
-  } finally {
-    socket.end();
-  }
-}
-function buildSmtpPayload(from, message) {
-  const headers = [
-    `From: ${from}`,
-    `To: ${message.to}`,
-    `Subject: ${message.subject}`,
-    "MIME-Version: 1.0"
-  ];
-  if (message.html) {
-    const boundary = `strata-${Date.now().toString(36)}`;
-    headers.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
-    const parts = [
-      `--${boundary}`,
-      "Content-Type: text/plain; charset=utf-8",
-      "",
-      message.body,
-      `--${boundary}`,
-      "Content-Type: text/html; charset=utf-8",
-      "",
-      message.html,
-      `--${boundary}--`,
-      ""
-    ];
-    return [...headers, "", ...parts, ".", ""].join(`\r
-`);
-  }
-  headers.push("Content-Type: text/plain; charset=utf-8");
-  return [...headers, "", message.body, ".", ""].join(`\r
-`);
-}
-
-class LogMailDriver {
-  async send(message) {
-    console.log(JSON.stringify({
-      level: "info",
-      channel: "mail",
-      to: message.to,
-      subject: message.subject,
-      body: message.body,
-      ...message.html ? { html: message.html } : {}
-    }));
-  }
-}
-
-class SmtpMailDriver {
-  config;
-  transport;
-  constructor(config, transport = defaultSmtpTransport) {
-    this.config = config;
-    this.transport = transport;
-  }
-  send(message) {
-    return this.transport(this.config, message);
-  }
-}
-
-class Mailer {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
-  }
-  send(message) {
-    return this.driver.send(message);
-  }
-}
-function createMailDriver() {
-  const driver = process.env.MAIL_DRIVER ?? "log";
-  if (driver === "smtp") {
-    return new SmtpMailDriver(resolveSmtpConfig());
-  }
-  return new LogMailDriver;
-}
-var appMailer = new Mailer(createMailDriver());
-
-// ../../src/core/storage/storage.ts
-import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join2 } from "path";
-var {S3Client } = globalThis.Bun;
-
-class LocalStorageDriver {
-  rootDirectory;
-  constructor(rootDirectory) {
-    this.rootDirectory = rootDirectory;
-  }
-  resolveRootDirectory() {
-    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
-  }
-  resolvePath(path) {
-    return join2(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
-  }
-  async put(path, contents) {
-    const absolutePath = this.resolvePath(path);
-    await mkdir(dirname(absolutePath), { recursive: true });
-    await writeFile(absolutePath, contents);
-    return path;
-  }
-  async get(path) {
-    try {
-      return await readFile(this.resolvePath(path));
-    } catch {
-      return null;
-    }
-  }
-  async delete(path) {
-    try {
-      await unlink(this.resolvePath(path));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-
-class S3StorageDriver {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async put(path, contents) {
-    await this.client.write(path.replace(/^\/+/, ""), contents);
-    return path;
-  }
-  async get(path) {
-    const normalizedPath = path.replace(/^\/+/, "");
-    const file = this.client.file(normalizedPath);
-    if (!await file.exists()) {
-      return null;
-    }
-    return new Uint8Array(await file.arrayBuffer());
-  }
-  async delete(path) {
-    try {
-      await this.client.unlink(path.replace(/^\/+/, ""));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-
-class StorageManager {
-  driver;
-  constructor(driver) {
-    this.driver = driver;
-  }
-  put(path, contents) {
-    return this.driver.put(path, contents);
-  }
-  get(path) {
-    return this.driver.get(path);
-  }
-  delete(path) {
-    return this.driver.delete(path);
-  }
-}
-function resolveS3Config() {
-  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
-  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
-  const bucket = process.env.AWS_BUCKET?.trim();
-  if (!accessKeyId || !secretAccessKey || !bucket) {
-    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
-  }
-  return {
-    accessKeyId,
-    secretAccessKey,
-    bucket,
-    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
-    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
-  };
-}
-function createS3Client(config = resolveS3Config()) {
-  return new S3Client({
-    accessKeyId: config.accessKeyId,
-    secretAccessKey: config.secretAccessKey,
-    bucket: config.bucket,
-    ...config.region ? { region: config.region } : {},
-    ...config.endpoint ? { endpoint: config.endpoint } : {}
-  });
-}
-function createStorageDriver() {
-  const driver = process.env.STORAGE_DRIVER ?? "local";
-  if (driver === "s3") {
-    return new S3StorageDriver(createS3Client());
-  }
-  return new LocalStorageDriver;
-}
-var defaultStorage = { current: null };
-function storage() {
-  if (!defaultStorage.current) {
-    defaultStorage.current = new StorageManager(createStorageDriver());
-  }
-  return defaultStorage.current;
-}
-function resetDefaultStorage() {
-  defaultStorage.current = null;
-}
-// ../../src/core/crypto/nonCryptographicHash.ts
-function nonCryptographicDigest(input) {
-  return Bun.hash(input).toString(16);
-}
-
-// ../../src/core/http/etag.ts
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
-}
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
-}
-function computeEtagFromJson(data) {
-  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
-  return formatWeakEtag(digest);
-}
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
-  return formatWeakEtag(digest);
-}
-function normalizeEtag(value) {
-  return value.trim();
-}
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
-}
-function parseEtagList(header) {
-  if (!header) {
-    return [];
-  }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
-}
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
-}
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
-    }
-    return;
-  }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
-  }
-}
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
-}
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
-  });
-}
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
-  }
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
-  }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
-    }
-  }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
-  }
-  return null;
-}
-// ../../src/config/cors.ts
-var corsConfig = {
-  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
-  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  allowedHeaders: [
-    "Authorization",
-    "Content-Type",
-    "X-Request-Id",
-    "X-Tenant-Id",
-    "X-Authenticated-User-Id",
-    "X-Authenticated-User-Role",
-    "If-Match",
-    "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual } from "crypto";
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(leftBuffer, rightBuffer);
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
-  }
-  return createCsrfTokenCookie();
-}
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
-  }
-  return null;
-}
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (!cookieValue) {
-    return false;
-  }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
-  }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
-  }
-  return resolveCsrfToken(request).token;
-}
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-// ../../src/core/http/csrfProtection.ts
-var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function createFlashCookie(message) {
-  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
-  const issuedAt = Date.now();
-  const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
-}
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-function flashResponse(response, message) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", createFlashCookie(message));
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-// ../../src/core/http/validation.ts
-async function parseJsonBody(request, validator) {
-  let payload;
-  try {
-    payload = await request.json();
-  } catch {
-    throw new BadRequestError("Request body must be valid JSON.");
-  }
-  return validator(payload);
-}
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
-  }
-  return "api";
-}
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
-}
-
-// ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-// ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return { authUser: null, csrfToken, flash };
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
-  }
-  if (!container.has(tokenServiceToken)) {
-    return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  }
-  const tokenService = container.resolve(tokenServiceToken);
-  try {
-    const user = await tokenService.findByIdOrThrow(userId);
-    return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  } catch {
-    return { authUser: null, csrfToken, flash };
-  }
-}
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
-  }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
-    }
-  }
-  return errors;
-}
-function webErrorResponse(error, request) {
-  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
-  }
-  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
-  if (mappedError instanceof UnauthorizedError) {
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  }
-  if (mappedError instanceof ValidationError) {
-    const errors = normalizeFieldErrors(mappedError.details);
-    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
-`);
-    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
-  }
-  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
-    status: mappedError.status
-  });
-}
-// ../../src/core/http/resources.ts
-function serializeDate(value) {
-  return value instanceof Date ? value.toISOString() : value;
-}
-function toResourceCollection(items, transformer) {
-  return items.map(transformer);
-}
-function toPaginatedResourceCollection(items, meta, transformer) {
-  return {
-    data: toResourceCollection(items, transformer),
-    meta
-  };
-}
-// ../../src/config/uploads.ts
-var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
-var ALLOWED_UPLOAD_MIME_TYPES = new Set([
-  "application/pdf",
-  "application/json",
-  "application/zip",
-  "application/x-zip-compressed",
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "text/plain",
-  "text/csv"
-]);
-// ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
-// ../../src/core/metrics/prometheus.ts
-class PrometheusRegistry {
-  httpRequestsTotal = new Map;
-  httpRequestDurationMs = new Map;
-  incrementHttpRequest(labels) {
-    const key = this.metricKey(labels);
-    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
-  }
-  observeHttpDuration(labels, durationMs) {
-    const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
-  }
-  renderMetrics() {
-    const lines = [
-      "# HELP http_requests_total Total HTTP requests processed.",
-      "# TYPE http_requests_total counter"
-    ];
-    for (const [key, value] of this.httpRequestsTotal) {
-      lines.push(`http_requests_total{${key}} ${value}`);
-    }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
-    }
-    return `${lines.join(`
-`)}
-`;
-  }
-  resetForTests() {
-    this.httpRequestsTotal.clear();
-    this.httpRequestDurationMs.clear();
-  }
-  getHttpRequestSummary() {
-    const byStatus = {};
-    const pathCounts = new Map;
-    let totalRequests = 0;
-    for (const [key, count] of this.httpRequestsTotal) {
-      totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
-      byStatus[status] = (byStatus[status] ?? 0) + count;
-      const pathKey = `${method} ${path}`;
-      const existing = pathCounts.get(pathKey);
-      if (existing) {
-        existing.count += count;
-      } else {
-        pathCounts.set(pathKey, { method, path, count });
-      }
-    }
-    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
-    return {
-      totalRequests,
-      byStatus,
-      topPaths
-    };
-  }
-  metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
-  }
-}
-var prometheusRegistry = new PrometheusRegistry;
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-// ../../src/core/http/parseFormBody.ts
-async function parseFormBody(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
-    throw new BadRequestError("Expected a form submission.");
-  }
-  return formDataToRecord(await request.formData());
-}
-function formDataToRecord(formData) {
-  const values = {};
-  for (const [key, value] of formData.entries()) {
-    if (typeof value === "string") {
-      values[key] = value;
-    }
-  }
-  return values;
-}
-
-// ../../src/core/http/webFormRequest.ts
-class WebFormRequest {
-  authorize(_request) {
-    return true;
-  }
-  validatePayload(payload) {
-    return this.parse(payload);
-  }
-  async validate(request) {
-    if (!await this.authorize(request)) {
-      throw new ForbiddenError;
-    }
-    const payload = requestPrefersJson(request) ? await parseJsonBody(request, (body) => body) : await parseFormBody(request);
-    try {
-      return this.validatePayload(payload);
-    } catch (error) {
-      if (error instanceof ValidationError) {
-        throw error;
-      }
-      throw error;
-    }
-  }
-}
-// ../../src/core/lifecycle/gracefulShutdown.ts
-var shutdownHandlers = new Map;
-var shutdownInstalled = false;
-var shuttingDown = false;
-function registerShutdownHandler(name, handler) {
-  shutdownHandlers.set(name, handler);
-  return () => {
-    shutdownHandlers.delete(name);
-  };
-}
-async function runGracefulShutdown(signal) {
-  if (shuttingDown) {
-    return;
-  }
-  shuttingDown = true;
-  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
-  for (const [name, handler] of shutdownHandlers) {
-    try {
-      await handler();
-      console.log(`[shutdown] Completed ${name}`);
-    } catch (error) {
-      console.error(`[shutdown] Failed ${name}:`, error);
-    }
-  }
-}
-function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
-  if (shutdownInstalled) {
-    return;
-  }
-  shutdownInstalled = true;
-  for (const signal of signals) {
-    process.on(signal, () => {
-      runGracefulShutdown(signal).finally(() => {
-        process.exit(0);
-      });
-    });
-  }
-}
-function resetGracefulShutdownForTests() {
-  shutdownHandlers.clear();
-  shutdownInstalled = false;
-  shuttingDown = false;
-}
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-// ../../src/core/queue/queueMetrics.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-async function readRedisQueueDepth(redisUrl) {
-  const client = new RedisClient3(redisUrl);
-  const [high, defaultQueue, low] = await Promise.all([
-    client.llen(QUEUE_HIGH_KEY),
-    client.llen(QUEUE_LIST_KEY),
-    client.llen(QUEUE_LOW_KEY)
-  ]);
-  return {
-    high: Number(high ?? 0),
-    default: Number(defaultQueue ?? 0),
-    low: Number(low ?? 0),
-    total: Number(high ?? 0) + Number(defaultQueue ?? 0) + Number(low ?? 0)
-  };
-}
-async function collectQueueMetrics() {
-  const driver = queueConfig.driver;
-  const failedJobs = createFailedJobService();
-  const failedCount = (await failedJobs.listRecent(1000)).length;
-  if (driver !== "redis") {
-    return {
-      driver,
-      pending: {
-        high: 0,
-        default: 0,
-        low: 0,
-        total: 0
-      },
-      failedCount
-    };
-  }
-  const redisUrl = process.env.REDIS_URL;
-  if (!redisUrl) {
-    return {
-      driver,
-      pending: {
-        high: 0,
-        default: 0,
-        low: 0,
-        total: 0
-      },
-      failedCount
-    };
-  }
-  return {
-    driver,
-    pending: await readRedisQueueDepth(redisUrl),
-    failedCount
-  };
-}
-// ../../src/core/scheduler/schedule.ts
-class Schedule {
-  tasks = [];
-  command(expression, name, run) {
-    this.tasks.push({ expression, name, run });
-    return this;
-  }
-  dueTasks(now = new Date) {
-    const minute = now.getMinutes();
-    return this.tasks.filter((task) => {
-      if (task.expression === "* * * * *") {
-        return true;
-      }
-      if (task.expression.startsWith("*/")) {
-        const interval = Number.parseInt(task.expression.slice(2), 10);
-        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
-      }
-      return false;
-    });
-  }
-  tasksList() {
-    return [...this.tasks];
-  }
-}
-var appSchedule = new Schedule;
-// ../../src/core/security/publicReads.ts
-function isPublicReadsEnabled() {
-  return isFeatureEnabled("publicReads");
-}
-function guestCanViewResource() {
-  return isPublicReadsEnabled();
-}
-// ../../src/core/tracing/traceContext.ts
-var traceContextStorage = createAsyncContextStore("@getstrata/traceContext");
-// ../../src/core/validation/rules.ts
-function required() {
-  return (field, value) => {
-    if (value === undefined || value === null || typeof value === "string" && value.trim() === "") {
-      return `"${field}" is required.`;
-    }
-    return;
-  };
-}
-function stringRule() {
-  return (field, value) => {
-    if (value === undefined || value === null) {
-      return;
-    }
-    if (typeof value !== "string") {
-      return `"${field}" must be a string.`;
-    }
-    return;
-  };
-}
-function minLength(minimum) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (value.trim().length < minimum) {
-      return `"${field}" must be at least ${minimum} characters.`;
-    }
-    return;
-  };
-}
-function maxLength(maximum) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (value.trim().length > maximum) {
-      return `"${field}" must be at most ${maximum} characters.`;
-    }
-    return;
-  };
-}
-function pattern(expression) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (!expression.test(value.trim())) {
-      return `"${field}" has an invalid format.`;
-    }
-    return;
-  };
-}
-function enumRule(allowedValues) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    if (!allowedValues.includes(value)) {
-      return `"${field}" must be one of: ${allowedValues.join(", ")}.`;
-    }
-    return;
-  };
-}
-function optional() {
-  return () => {
-    return;
-  };
-}
-function integerRule() {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed)) {
-      return `"${field}" must be an integer.`;
-    }
-    return;
-  };
-}
-function emailRule() {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
-    }
-    const normalized = value.trim();
-    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
-      return `"${field}" must be a valid email address.`;
-    }
-    return;
-  };
-}
-function confirmed(fieldName) {
-  return (field, value, payload) => {
-    const confirmationKey = `${fieldName}_confirmation`;
-    const confirmation = payload[confirmationKey];
-    if (value !== confirmation) {
-      return `"${field}" confirmation does not match.`;
-    }
-    return;
-  };
-}
-function positiveIntegerRule() {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed) || parsed <= 0) {
-      return `"${field}" must be a positive integer.`;
-    }
-    return;
-  };
-}
-function integerRange(minimum, maximum) {
-  return (field, value) => {
-    if (value === undefined || value === null || value === "") {
-      return;
-    }
-    const parsed = typeof value === "number" ? value : Number.parseInt(String(value), 10);
-    if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {
-      return `"${field}" must be an integer between ${minimum} and ${maximum}.`;
-    }
-    return;
-  };
-}
-function validateObject(payload, schema) {
-  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new ValidationError("Request body must be a JSON object.");
-  }
-  const body = payload;
-  const errors = {};
-  const output = {};
-  for (const [field, rules] of Object.entries(schema)) {
-    const messages = rules.map((rule) => rule(field, body[field], body)).filter((message) => message !== undefined);
-    if (messages.length > 0) {
-      errors[field] = messages;
-      continue;
-    }
-    if (field in body && body[field] !== undefined) {
-      const rawValue = body[field];
-      output[field] = typeof rawValue === "string" ? rawValue.trim() : rawValue;
-    }
-  }
-  if (Object.keys(errors).length > 0) {
-    throw new ValidationError("The given data was invalid.", errors);
-  }
-  return output;
-}
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac as createHmac5 } from "crypto";
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac5("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache2) {
-    super();
-    this.cache = cache2;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
 // ../../src/bootstrap/queue/defaultJobs.ts
 function registerDefaultJobs() {
   jobRegistry.register("cache.invalidate-tags", () => {