@getstrata/core 0.5.54 → 0.5.56

package/dist/index.js

@@ -196,13 +196,6 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
 
 // ../../src/core/contracts/serviceTokens.ts
 var CORE_QUEUE_TOKEN = "core.queue";
@@ -1608,65 +1601,6 @@ var apiTokenTable = defineTable({
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
-// ../../src/core/auth/password.ts
-async function verifyPassword(password, passwordHash) {
-  return await Bun.password.verify(password, passwordHash);
-}
-
-// ../../src/core/crypto/fieldEncryption.ts
-import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "crypto";
-var ENCRYPTION_PREFIX = "enc:v1:";
-var IV_LENGTH = 12;
-var TAG_LENGTH = 16;
-function resolveEncryptionKey() {
-  const raw = process.env.KMS_ENCRYPTION_KEY?.trim();
-  if (!raw) {
-    return null;
-  }
-  if (/^[0-9a-f]{64}$/i.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  const decoded = Buffer.from(raw, "base64");
-  if (decoded.length === 32) {
-    return decoded;
-  }
-  throw new Error("KMS_ENCRYPTION_KEY must be 32 bytes (hex or base64).");
-}
-function isFieldEncryptionEnabled() {
-  const featureFlag = process.env.FEATURE_FIELD_ENCRYPTION;
-  if (featureFlag === "false") {
-    return false;
-  }
-  if (featureFlag === "true") {
-    return true;
-  }
-  return (process.env.APP_ENV ?? "local") === "production";
-}
-function decryptField(value, key) {
-  if (!value.startsWith(ENCRYPTION_PREFIX)) {
-    return value;
-  }
-  const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
-  const iv = payload.subarray(0, IV_LENGTH);
-  const tag = payload.subarray(payload.length - TAG_LENGTH);
-  const ciphertext = payload.subarray(IV_LENGTH, payload.length - TAG_LENGTH);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-}
-
-// ../../src/core/crypto/mfaSecret.ts
-function revealMfaSecret(stored) {
-  if (!stored) {
-    return null;
-  }
-  const key = resolveEncryptionKey();
-  if (!isFieldEncryptionEnabled() || !key || !stored.startsWith("enc:v1:")) {
-    return stored;
-  }
-  return decryptField(stored, key);
-}
-
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
 function runWithRequestMeta(meta, callback) {
@@ -1694,66 +1628,6 @@ function logSecurityEvent(event, details = {}) {
   }));
 }
 
-// ../../src/core/security/tokenExpiry.ts
-function resolveDefaultTokenExpiryDays() {
-  const raw = process.env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim();
-  if (!raw) {
-    return null;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return null;
-  }
-  return parsed;
-}
-
-// ../../src/core/security/totp.ts
-import { createHmac as createHmac2 } from "crypto";
-function decodeBase32(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const normalized = input.replace(/=+$/u, "").toUpperCase();
-  let bits = "";
-  for (const char of normalized) {
-    const value = alphabet.indexOf(char);
-    if (value === -1) {
-      throw new Error("Invalid base32 character in MFA secret.");
-    }
-    bits += value.toString(2).padStart(5, "0");
-  }
-  const bytes = [];
-  for (let index = 0;index + 8 <= bits.length; index += 8) {
-    bytes.push(Number.parseInt(bits.slice(index, index + 8), 2));
-  }
-  return Buffer.from(bytes);
-}
-function generateTotp(secret, counter, digits = 6) {
-  const key = decodeBase32(secret);
-  const buffer = Buffer.alloc(8);
-  buffer.writeBigUInt64BE(BigInt(counter));
-  const digest = createHmac2("sha1", key).update(buffer).digest();
-  const lastByte = digest[digest.length - 1] ?? 0;
-  const offset = lastByte & 15;
-  const b0 = digest[offset] ?? 0;
-  const b1 = digest[offset + 1] ?? 0;
-  const b2 = digest[offset + 2] ?? 0;
-  const b3 = digest[offset + 3] ?? 0;
-  const code = (b0 & 127) << 24 | (b1 & 255) << 16 | (b2 & 255) << 8 | b3 & 255;
-  return String(code % 10 ** digits).padStart(digits, "0");
-}
-function verifyTotp(secret, token, window = 1) {
-  const normalized = token.trim();
-  if (!/^\d{6}$/u.test(normalized)) {
-    return false;
-  }
-  const timestep = Math.floor(Date.now() / 30000);
-  for (let offset = -window;offset <= window; offset += 1) {
-    if (generateTotp(secret, timestep + offset) === normalized) {
-      return true;
-    }
-  }
-  return false;
-}
-
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 function runWithTenant(tenant, callback) {
@@ -1776,99 +1650,6 @@ function rateLimitMultiplierForPlan(plan) {
   }
 }
 
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationTable.ts
 var notificationTable = defineTable({
   name: "notification",
@@ -4840,14 +4621,14 @@ function createCsrfProtection(secret, options = {}) {
   };
 }
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -4983,164 +4764,6 @@ class FormRequest {
     return await parseJsonBody(request, (payload) => this.parse(payload));
   }
 }
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
-  }
-  return "api";
-}
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
-}
-
-// ../../src/core/view/etaViewEngine.ts
-import { join as join4 } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
-}
-// ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return { authUser: null, csrfToken, flash };
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
-  }
-  if (!container.has(tokenServiceToken)) {
-    return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  }
-  const tokenService = container.resolve(tokenServiceToken);
-  try {
-    const user = await tokenService.findByIdOrThrow(userId);
-    return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  } catch {
-    return { authUser: null, csrfToken, flash };
-  }
-}
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
-  }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
-    }
-  }
-  return errors;
-}
-function webErrorResponse(error, request) {
-  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
-  }
-  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
-  if (mappedError instanceof UnauthorizedError) {
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  }
-  if (mappedError instanceof ValidationError) {
-    const errors = normalizeFieldErrors(mappedError.details);
-    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
-`);
-    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
-  }
-  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
-    status: mappedError.status
-  });
-}
 // ../../src/core/http/authMiddleware.ts
 function createAuthMiddleware(auth2) {
   return async (request, next) => {
@@ -5263,118 +4886,33 @@ function parsePaginationQuery(request) {
 function paginatedResponse(data, meta, init = {}) {
   return Response.json({ data, meta }, init);
 }
-// ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth2) {
-  return async (request, next) => {
-    if (!await auth2.check(request)) {
-      const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-// ../../src/core/http/resources.ts
-function serializeDate(value) {
-  return value instanceof Date ? value.toISOString() : value;
+// ../../src/config/uploads.ts
+var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var ALLOWED_UPLOAD_MIME_TYPES = new Set([
+  "application/pdf",
+  "application/json",
+  "application/zip",
+  "application/x-zip-compressed",
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "text/plain",
+  "text/csv"
+]);
+function resolveMaxUploadBytes() {
+  const raw = process.env.MAX_UPLOAD_BYTES?.trim() ?? process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
+  }
+  return parsed;
 }
-function toResourceCollection(items, transformer) {
-  return items.map(transformer);
-}
-function toPaginatedResourceCollection(items, meta, transformer) {
-  return {
-    data: toResourceCollection(items, transformer),
-    meta
-  };
-}
-// ../../src/core/http/routeMiddleware.ts
-function withMiddleware(...middleware) {
-  const wrap = composeMiddleware(...middleware);
-  return (handler) => {
-    return wrap(handler);
-  };
-}
-// ../../src/core/http/routeModelBinding.ts
-function bindRouteModel(param, resolver, handler) {
-  return async (request) => {
-    const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
-    return await handler(request, model);
-  };
-}
-// ../../src/core/http/securedRouteModelBinding.ts
-function isMutatingPolicyAction(action) {
-  return action === "update" || action === "delete";
-}
-function securedBindRouteModel(param, resolver, authorization, handler) {
-  return async (request) => {
-    const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth2 = resolveApplicationAuth();
-    const user = currentAuthUser() ?? await auth2.resolve(request);
-    gate.authorize(authorization.resource, authorization.action, user, model);
-    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
-      assertIfMatch(request, etagFromResource(model), {
-        required: authorization.requireIfMatch ?? true
-      });
-    }
-    const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
-      return applyConditionalGet(request, response, etagFromResource(model));
-    }
-    return response;
-  };
-}
-function securedBindRouteModelByKey(param, resolver, authorization, handler) {
-  return async (request) => {
-    const key = String(request.params[param] ?? "").trim();
-    if (!key) {
-      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
-    }
-    const model = await resolver(key, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth2 = resolveApplicationAuth();
-    const user = currentAuthUser() ?? await auth2.resolve(request);
-    gate.authorize(authorization.resource, authorization.action, user, model);
-    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
-      assertIfMatch(request, etagFromResource(model), {
-        required: authorization.requireIfMatch ?? true
-      });
-    }
-    const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
-      return applyConditionalGet(request, response, etagFromResource(model));
-    }
-    return response;
-  };
-}
-// ../../src/config/uploads.ts
-var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
-var ALLOWED_UPLOAD_MIME_TYPES = new Set([
-  "application/pdf",
-  "application/json",
-  "application/zip",
-  "application/x-zip-compressed",
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "text/plain",
-  "text/csv"
-]);
-function resolveMaxUploadBytes() {
-  const raw = process.env.MAX_UPLOAD_BYTES?.trim() ?? process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_UPLOAD_BYTES;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_UPLOAD_BYTES;
-  }
-  return parsed;
-}
-function normalizeMimeType(mimeType) {
-  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
+function normalizeMimeType(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
 }
 function isAllowedMimeType(mimeType) {
   const normalized = normalizeMimeType(mimeType);
@@ -5421,1529 +4959,1953 @@ async function parseMultipartUpload(request, fieldName = "file") {
     contents: new Uint8Array(await value.arrayBuffer())
   };
 }
-
-// ../../src/core/http/index.ts
-function jsonResponse2(data, init = {}) {
-  return Response.json(data, {
-    status: init.status ?? 200,
-    headers: init.headers
-  });
-}
-function createdResponse(data, init = {}) {
-  return jsonResponse2(data, { ...init, status: init.status ?? 201 });
+// ../../src/core/http/requireAuthMiddleware.ts
+function createRequireAuthMiddleware(auth2) {
+  return async (request, next) => {
+    if (!await auth2.check(request)) {
+      const error = new UnauthorizedError;
+      return Response.json({ error: error.message }, { status: error.status });
+    }
+    return await next();
+  };
 }
-function noContentResponse() {
-  return new Response(null, { status: 204 });
+// ../../src/core/http/resources.ts
+function serializeDate(value) {
+  return value instanceof Date ? value.toISOString() : value;
 }
-function errorResponse(error) {
-  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
-  return Response.json({
-    error: mappedError.message,
-    ...mappedError.details === undefined ? {} : { details: mappedError.details }
-  }, { status: mappedError.status });
+function toResourceCollection(items, transformer) {
+  return items.map(transformer);
 }
-function withErrorHandling(handler) {
-  return async (...args) => {
-    try {
-      return await handler(...args);
-    } catch (error) {
-      const request = args.find((arg) => arg instanceof Request);
-      const webResponse = webErrorResponse(error, request);
-      if (webResponse) {
-        return webResponse;
-      }
-      return errorResponse(error);
-    }
+function toPaginatedResourceCollection(items, meta, transformer) {
+  return {
+    data: toResourceCollection(items, transformer),
+    meta
   };
 }
-// ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
-function resolveLoginIdentity(request) {
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-async function resolveLoginEmail(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  try {
-    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-      const formData = await request.clone().formData();
-      const email = formData.get("email");
-      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
-    }
-    const payload = await request.clone().json();
-    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
-  } catch {
-    return "unknown";
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
   }
+  return "api";
 }
-function createLoginThrottleMiddleware(options) {
-  const client = new RedisClient2(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
 }
-// ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
-function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
-  return async (request, next) => {
-    const path = new URL(request.url).pathname;
-    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
-    const key = `${prefix}${identity}:${path}`;
-    const now = Date.now();
-    const existing = buckets.get(key);
-    if (!existing || existing.resetAt <= now) {
-      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
-      return await next();
-    }
-    existing.count += 1;
-    if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
+
+// ../../src/core/view/etaViewEngine.ts
+import { join as join4, relative } from "path";
+import { Eta } from "eta";
+
+// ../../src/core/view/assertEtaHtmlSource.ts
+var HTML_TAGS = new Set([
+  "a",
+  "abbr",
+  "address",
+  "article",
+  "aside",
+  "audio",
+  "b",
+  "blockquote",
+  "body",
+  "button",
+  "canvas",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "datalist",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "dialog",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "fieldset",
+  "figcaption",
+  "figure",
+  "footer",
+  "form",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "header",
+  "hgroup",
+  "hr",
+  "html",
+  "i",
+  "iframe",
+  "img",
+  "input",
+  "ins",
+  "kbd",
+  "label",
+  "legend",
+  "li",
+  "main",
+  "map",
+  "mark",
+  "menu",
+  "meter",
+  "nav",
+  "object",
+  "ol",
+  "optgroup",
+  "option",
+  "output",
+  "p",
+  "picture",
+  "pre",
+  "progress",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "script",
+  "search",
+  "section",
+  "select",
+  "slot",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "style",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "template",
+  "textarea",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "title",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "wbr"
+]);
+var TAG_PATTERN = "([a-z][a-z0-9]*)";
+var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
+var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
+var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
+var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
+function htmlTagName(match) {
+  const tag = match?.[1];
+  return tag && HTML_TAGS.has(tag) ? tag : undefined;
 }
-// ../../src/core/metrics/prometheus.ts
-class PrometheusRegistry {
-  httpRequestsTotal = new Map;
-  httpRequestDurationMs = new Map;
-  incrementHttpRequest(labels) {
-    const key = this.metricKey(labels);
-    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
+function describePugLikeLine(line) {
+  if (/^\|(?:\s|$)/.test(line)) {
+    return "piped text";
   }
-  observeHttpDuration(labels, durationMs) {
-    const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
+  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
+    return "class/id shorthand";
   }
-  renderMetrics() {
-    const lines = [
-      "# HELP http_requests_total Total HTTP requests processed.",
-      "# TYPE http_requests_total counter"
-    ];
-    for (const [key, value] of this.httpRequestsTotal) {
-      lines.push(`http_requests_total{${key}} ${value}`);
+  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
+    return "attribute shorthand";
+  }
+  if (htmlTagName(line.match(TAG_SHORTHAND))) {
+    return "tag shorthand";
+  }
+  return;
+}
+function updateSkipBlock(lower, skipBlock) {
+  if (skipBlock) {
+    if (skipBlock === "comment" && lower.includes("-->")) {
+      return null;
     }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
+      return null;
     }
-    return `${lines.join(`
-`)}
-`;
+    return skipBlock;
   }
-  resetForTests() {
-    this.httpRequestsTotal.clear();
-    this.httpRequestDurationMs.clear();
+  if (lower.startsWith("<!--") && !lower.includes("-->")) {
+    return "comment";
   }
-  getHttpRequestSummary() {
-    const byStatus = {};
-    const pathCounts = new Map;
-    let totalRequests = 0;
-    for (const [key, count] of this.httpRequestsTotal) {
-      totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
-      byStatus[status] = (byStatus[status] ?? 0) + count;
-      const pathKey = `${method} ${path}`;
-      const existing = pathCounts.get(pathKey);
-      if (existing) {
-        existing.count += count;
-      } else {
-        pathCounts.set(pathKey, { method, path, count });
-      }
-    }
-    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
-    return {
-      totalRequests,
-      byStatus,
-      topPaths
-    };
+  if (lower.startsWith("<script") && !lower.includes("</script")) {
+    return "script";
   }
-  metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+  if (lower.startsWith("<style") && !lower.includes("</style")) {
+    return "style";
   }
+  return null;
 }
-var prometheusRegistry = new PrometheusRegistry;
-
-// ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
-}
-function createMetricsMiddleware() {
-  return async (request, next) => {
-    const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
-  };
-}
-// ../../src/core/http/requireAbilityMiddleware.ts
-function createRequireAbilityMiddleware(abilityChecker) {
-  return (ability) => {
-    return async (_request, next) => {
-      const user = currentAuthUser();
-      try {
-        abilityChecker.requireAbility(user, ability);
-      } catch (error) {
-        if (error instanceof ForbiddenError) {
-          return Response.json({ error: error.message }, { status: error.status });
-        }
-        throw error;
-      }
-      return await next();
-    };
-  };
-}
-// ../../src/core/http/requireGlobalAdminMiddleware.ts
-function createRequireGlobalAdminMiddleware() {
-  return async (_request, next) => {
-    const user = currentAuthUser();
-    if (!isGlobalAdmin(user)) {
-      logSecurityEvent("privilege_escalation_blocked", {
-        required_role: "platform_admin",
-        path: new URL(_request.url).pathname
-      });
-      const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
+function assertEtaHtmlSource(templateName, source) {
+  let skipBlock = null;
+  for (const rawLine of source.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      continue;
     }
-    return await next();
-  };
-}
-// ../../src/core/http/requireWebAuthMiddleware.ts
-function createRequireWebAuthMiddleware(auth2) {
-  return async (request, next) => {
-    const user = await auth2.resolve(request);
-    if (user) {
-      return await next();
+    const lower = trimmed.toLowerCase();
+    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
+    if (skipBlock || nextSkipBlock) {
+      skipBlock = nextSkipBlock;
+      continue;
     }
-    if (requestPrefersJson(request)) {
-      throw new UnauthorizedError;
+    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
+      continue;
     }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  };
-}
-// ../../src/core/http/scimThrottleMiddleware.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-function createScimThrottleMiddleware(options) {
-  const client = options.redisUrl ? new RedisClient3(options.redisUrl) : null;
-  return async (request, next) => {
-    const identity = request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-    const key = `workhub:scim-throttle:${identity}`;
-    if (client) {
-      const attempts = Number(await client.incr(key));
-      if (attempts === 1) {
-        await client.expire(key, options.decaySeconds);
-      }
-      if (attempts > options.maxAttempts) {
-        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
-      }
+    const kind = describePugLikeLine(trimmed);
+    if (kind) {
+      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
     }
-    return await next();
-  };
-}
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
-  }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
-  }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
   }
-  return strictApiContentSecurityPolicy();
 }
 
-// ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
+// ../../src/core/view/etaViewEngine.ts
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
     });
-  };
-}
-// ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient4 } = globalThis.Bun;
-function resolveThrottleIdentity(request) {
-  const user = currentAuthUser();
-  if (user?.tokenId !== undefined) {
-    return `token:${user.tokenId}`;
+    this.resolveLayoutData = resolveLayoutData;
+    const readFile2 = this.eta.readFile?.bind(this.eta);
+    this.eta.readFile = (path) => {
+      const source = readFile2 ? readFile2(path) : "";
+      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      return source;
+    };
   }
-  if (user) {
-    return `user:${user.id}`;
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
   }
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
 }
-function createThrottleMiddleware(options) {
-  const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
-  return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
-    if (attempts > maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
     }
-    return await next();
-  };
+  });
 }
-// ../../src/core/http/parseFormBody.ts
-async function parseFormBody(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
-    throw new BadRequestError("Expected a form submission.");
-  }
-  return formDataToRecord(await request.formData());
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
 }
-function formDataToRecord(formData) {
-  const values = {};
-  for (const [key, value] of formData.entries()) {
-    if (typeof value === "string") {
-      values[key] = value;
-    }
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
   }
-  return values;
 }
-
-// ../../src/core/http/webFormRequest.ts
-class WebFormRequest {
-  authorize(_request) {
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
     return true;
   }
-  validatePayload(payload) {
-    return this.parse(payload);
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
   }
-  async validate(request) {
-    if (!await this.authorize(request)) {
-      throw new ForbiddenError;
-    }
-    const payload = requestPrefersJson(request) ? await parseJsonBody(request, (body) => body) : await parseFormBody(request);
-    try {
-      return this.validatePayload(payload);
-    } catch (error) {
-      if (error instanceof ValidationError) {
-        throw error;
-      }
-      throw error;
-    }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
   }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
 }
-// ../../src/core/lifecycle/gracefulShutdown.ts
-var shutdownHandlers = new Map;
-var shutdownInstalled = false;
-var shuttingDown = false;
-function registerShutdownHandler(name, handler) {
-  shutdownHandlers.set(name, handler);
-  return () => {
-    shutdownHandlers.delete(name);
-  };
-}
-async function runGracefulShutdown(signal) {
-  if (shuttingDown) {
-    return;
+
+// ../../src/core/http/webErrorResponse.ts
+function normalizeFieldErrors(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return {};
   }
-  shuttingDown = true;
-  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
-  for (const [name, handler] of shutdownHandlers) {
-    try {
-      await handler();
-      console.log(`[shutdown] Completed ${name}`);
-    } catch (error) {
-      console.error(`[shutdown] Failed ${name}:`, error);
+  const errors = {};
+  for (const [field, messages] of Object.entries(details)) {
+    if (Array.isArray(messages)) {
+      errors[field] = messages.map(String);
+      continue;
+    }
+    if (typeof messages === "string") {
+      errors[field] = [messages];
     }
   }
+  return errors;
 }
-function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
-  if (shutdownInstalled) {
-    return;
+function webErrorResponse(error, request) {
+  if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
+    return null;
   }
-  shutdownInstalled = true;
-  for (const signal of signals) {
-    process.on(signal, () => {
-      runGracefulShutdown(signal).finally(() => {
-        process.exit(0);
-      });
-    });
+  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
+  if (mappedError instanceof UnauthorizedError) {
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
   }
+  if (mappedError instanceof ValidationError) {
+    const errors = normalizeFieldErrors(mappedError.details);
+    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
+`);
+    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
+  }
+  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
+    status: mappedError.status
+  });
 }
-// ../../src/core/logging/requestLoggingMiddleware.ts
-function createRequestLoggingMiddleware() {
-  return async (request, next) => {
-    return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
-      userAgent: request.headers.get("user-agent"),
-      request
-    }, async () => {
-      const startedAt = performance.now();
-      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-      const response = await next();
-      const durationMs = Math.round(performance.now() - startedAt);
-      appLogger.info("HTTP request completed", {
-        requestId,
-        method: request.method,
-        path: new URL(request.url).pathname,
-        status: response.status,
-        durationMs
-      });
-      return response;
-    });
-  };
-}
-// ../../src/core/mail/markdownMail.ts
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function stripMarkdown(markdown) {
-  return markdown.replace(/^#{1,6}\s+/gm, "").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)").replace(/^[-*]\s+/gm, "\u2022 ").replace(/```[\s\S]*?```/g, "").replace(/\n{3,}/g, `
 
-`).trim();
+// ../../src/core/http/response.ts
+function jsonResponse2(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
+  });
 }
-function markdownToHtml(markdown) {
-  const escaped = markdown.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return escaped.replace(/^### (.+)$/gm, "<h3>$1</h3>").replace(/^## (.+)$/gm, "<h2>$1</h2>").replace(/^# (.+)$/gm, "<h1>$1</h1>").replace(/`([^`]+)`/g, "<code>$1</code>").replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>').replace(/^[-*]\s+(.+)$/gm, "<li>$1</li>").replace(/(<li>[\s\S]*?<\/li>\n?)+/g, (block) => `<ul>${block}</ul>`).replace(/```(\w+)?\n([\s\S]*?)```/g, "<pre><code>$2</code></pre>").split(/\n\n+/).map((block) => {
-    if (block.startsWith("<")) {
-      return block;
-    }
-    return `<p>${block.replace(/\n/g, " ")}</p>`;
-  }).join(`
-`);
+function createdResponse(data, init = {}) {
+  return jsonResponse2(data, { ...init, status: init.status ?? 201 });
 }
-function wrapMarkdownMailLayout(bodyHtml, options = {}) {
-  const title = escapeHtml(options.title ?? "GetStrata");
-  const preview = escapeHtml(options.preview ?? "");
-  const footer = escapeHtml(options.footer ?? "Sent by GetStrata");
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>${title}</title>
-  <style>
-    body { font-family: system-ui, sans-serif; line-height: 1.5; color: #111827; background: #f9fafb; margin: 0; padding: 24px; }
-    .container { max-width: 640px; margin: 0 auto; background: #ffffff; border: 1px solid #e5e7eb; border-radius: 8px; overflow: hidden; }
-    .header { padding: 20px 24px; border-bottom: 1px solid #e5e7eb; font-weight: 600; }
-    .content { padding: 24px; }
-    .footer { padding: 16px 24px; border-top: 1px solid #e5e7eb; color: #6b7280; font-size: 14px; }
-    a { color: #2563eb; }
-    code { background: #f3f4f6; padding: 2px 4px; border-radius: 4px; }
-    pre { background: #111827; color: #f9fafb; padding: 12px; border-radius: 6px; overflow-x: auto; }
-  </style>
-</head>
-<body>
-  ${preview ? `<span style="display:none;max-height:0;overflow:hidden;">${preview}</span>` : ""}
-  <div class="container">
-    <div class="header">${title}</div>
-    <div class="content">${bodyHtml}</div>
-    <div class="footer">${footer}</div>
-  </div>
-</body>
-</html>`;
+function noContentResponse() {
+  return new Response(null, { status: 204 });
 }
-function renderMarkdownMail(markdown, options = {}) {
-  const bodyHtml = markdownToHtml(markdown.trim());
-  const html = wrapMarkdownMailLayout(bodyHtml, options);
-  const text = stripMarkdown(markdown);
-  return { html, text };
+function errorResponse(error) {
+  const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
+  return Response.json({
+    error: mappedError.message,
+    ...mappedError.details === undefined ? {} : { details: mappedError.details }
+  }, { status: mappedError.status });
 }
-// ../../src/core/mail/markdownMailable.ts
-function buildMarkdownMailMessage(input) {
-  const rendered = renderMarkdownMail(input.markdown, {
-    title: input.layout?.title ?? input.subject,
-    ...input.layout
-  });
-  return {
-    to: input.to,
-    subject: input.subject,
-    body: rendered.text,
-    html: rendered.html
+function withErrorHandling(handler) {
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (error) {
+      const request = args.find((arg) => arg instanceof Request);
+      const webResponse = webErrorResponse(error, request);
+      if (webResponse) {
+        return webResponse;
+      }
+      return errorResponse(error);
+    }
   };
 }
-async function sendMarkdownMail(mailer2, input) {
-  await mailer2.send(buildMarkdownMailMessage(input));
-}
-// ../../src/core/notifications/dispatcher.ts
-class NotificationDispatcher {
-  mailer;
-  databaseStore;
-  constructor(mailer2, databaseStore = null) {
-    this.mailer = mailer2;
-    this.databaseStore = databaseStore;
-  }
-  async send(notifiable, notification) {
-    for (const channel of notification.via(notifiable)) {
-      if (channel === "mail") {
-        await this.sendMail(notifiable, notification);
-        continue;
-      }
-      if (channel === "database") {
-        await this.sendDatabase(notifiable, notification);
-      }
-    }
-  }
-  async sendMail(notifiable, notification) {
-    const routed = notifiable.routeNotificationFor("mail");
-    if (routed === null) {
-      return;
+// ../../src/core/http/routeMiddleware.ts
+function withMiddleware(...middleware) {
+  const wrap = composeMiddleware(...middleware);
+  return (handler) => {
+    return wrap(handler);
+  };
+}
+// ../../src/core/http/routeModelBinding.ts
+function bindRouteModel(param, resolver, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    return await handler(request, model);
+  };
+}
+// ../../src/core/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth2 = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth2.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
     }
-    const message = notification.toMail(notifiable);
-    if (!message) {
-      return;
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
     }
-    if (message.markdown) {
-      await this.mailer.send(buildMarkdownMailMessage({
-        to: String(routed),
-        subject: message.subject,
-        markdown: message.markdown
-      }));
-      return;
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
     }
-    await this.mailer.send({
-      to: String(routed),
-      subject: message.subject,
-      body: message.body ?? "",
-      ...message.html ? { html: message.html } : {}
-    });
-  }
-  async sendDatabase(notifiable, notification) {
-    if (!this.databaseStore) {
-      return;
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth2 = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth2.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
     }
-    const payload = notification.toDatabase(notifiable);
-    if (!payload) {
-      return;
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
     }
-    await this.databaseStore.create({
-      userId: Number(notifiable.getNotificationKey()),
-      ...payload
-    });
-  }
-}
-function createNotificationDispatcher(mailer2, databaseStore) {
-  return new NotificationDispatcher(mailer2, databaseStore ?? null);
-}
-// ../../src/core/notifications/notification.ts
-class Notification {
-  via(_notifiable) {
-    throw new Error("Notification subclasses must implement via().");
-  }
-  toMail(_notifiable) {
-    return null;
-  }
-  toDatabase(_notifiable) {
-    return null;
-  }
+    return response;
+  };
 }
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
+// ../../src/core/http/loginThrottleMiddleware.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
+function resolveLoginIdentity(request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
 }
-
-class SyncQueue {
-  async dispatch(job, payload) {
-    await job.handle(payload);
+async function resolveLoginEmail(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  try {
+    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await request.clone().formData();
+      const email = formData.get("email");
+      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
+    }
+    const payload = await request.clone().json();
+    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
+  } catch {
+    return "unknown";
   }
 }
-
-class AsyncQueue {
-  async dispatch(job, payload) {
-    setTimeout(() => {
-      job.handle(payload).catch((error) => {
-        console.error("[AsyncQueue] Job failed:", error);
+function createLoginThrottleMiddleware(options) {
+  const client = new RedisClient2(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    if (attempts > options.maxAttempts) {
+      return Response.json({ error: "Too many login attempts. Try again later." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
       });
-    }, 0);
-  }
+    }
+    return await next();
+  };
 }
-function createQueue(driver) {
-  return driver === "async" ? new AsyncQueue : new SyncQueue;
+// ../../src/core/http/memoryThrottleMiddleware.ts
+var buckets = new Map;
+function createMemoryThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
+  return async (request, next) => {
+    const path = new URL(request.url).pathname;
+    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
+    const key = `${prefix}${identity}:${path}`;
+    const now = Date.now();
+    const existing = buckets.get(key);
+    if (!existing || existing.resetAt <= now) {
+      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
+      return await next();
+    }
+    existing.count += 1;
+    if (existing.count > options.maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
+  };
 }
-// ../../src/core/queue/failedJobTable.ts
-var failedJobTable = defineTable({
-  name: "failed_job",
-  primaryKey: "id",
-  columns: ["id", "job_name", "payload", "exception", "failed_at"],
-  defaultOrderBy: { column: "failed_at", direction: "DESC" }
-});
-
-// ../../src/core/queue/failedJobRepository.ts
-class FailedJobRepository extends BaseRepository {
-  constructor() {
-    super(failedJobTable);
+// ../../src/core/metrics/prometheus.ts
+class PrometheusRegistry {
+  httpRequestsTotal = new Map;
+  httpRequestDurationMs = new Map;
+  incrementHttpRequest(labels) {
+    const key = this.metricKey(labels);
+    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
   }
-}
-var failedJobRepository_default = FailedJobRepository;
-
-// ../../src/core/queue/failedJobService.ts
-class FailedJobService {
-  repository;
-  constructor(repository) {
-    this.repository = repository;
+  observeHttpDuration(labels, durationMs) {
+    const key = this.metricKey(labels);
+    const samples = this.httpRequestDurationMs.get(key) ?? [];
+    samples.push(durationMs);
+    this.httpRequestDurationMs.set(key, samples);
   }
-  async recordFailure(input) {
-    return await this.repository.create({
-      job_name: input.jobName,
-      payload: input.payload,
-      exception: input.exception,
-      failed_at: new Date
-    });
+  renderMetrics() {
+    const lines = [
+      "# HELP http_requests_total Total HTTP requests processed.",
+      "# TYPE http_requests_total counter"
+    ];
+    for (const [key, value] of this.httpRequestsTotal) {
+      lines.push(`http_requests_total{${key}} ${value}`);
+    }
+    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
+    for (const [key, samples] of this.httpRequestDurationMs) {
+      const sum = samples.reduce((total, sample) => total + sample, 0);
+      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    }
+    return `${lines.join(`
+`)}
+`;
   }
-  listRecent(limit = 50) {
-    return this.repository.findAll({
-      limit,
-      orderBy: { column: "failed_at", direction: "DESC" }
-    });
-  }
-  async retry(id) {
-    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
-    await this.repository.deleteById(id);
-    return failedJob;
-  }
-  async delete(id) {
-    const deleted = await this.repository.deleteById(id);
-    if (!deleted) {
-      throw new Error(`Failed job ${id} not found.`);
-    }
+  resetForTests() {
+    this.httpRequestsTotal.clear();
+    this.httpRequestDurationMs.clear();
   }
-  async flush() {
-    const jobs = await this.repository.findAll();
-    let deleted = 0;
-    for (const job of jobs) {
-      if (await this.repository.deleteById(job.id)) {
-        deleted += 1;
+  getHttpRequestSummary() {
+    const byStatus = {};
+    const pathCounts = new Map;
+    let totalRequests = 0;
+    for (const [key, count] of this.httpRequestsTotal) {
+      totalRequests += count;
+      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
+      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
+      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      byStatus[status] = (byStatus[status] ?? 0) + count;
+      const pathKey = `${method} ${path}`;
+      const existing = pathCounts.get(pathKey);
+      if (existing) {
+        existing.count += count;
+      } else {
+        pathCounts.set(pathKey, { method, path, count });
       }
     }
-    return deleted;
+    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
+    return {
+      totalRequests,
+      byStatus,
+      topPaths
+    };
+  }
+  metricKey(labels) {
+    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
   }
 }
-var failedJobService_default = FailedJobService;
+var prometheusRegistry = new PrometheusRegistry;
 
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
+// ../../src/core/http/metricsMiddleware.ts
+function normalizeMetricPath(pathname) {
+  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
+}
+function createMetricsMiddleware() {
+  return async (request, next) => {
+    const startedAt = performance.now();
+    const response = await next();
+    const durationMs = performance.now() - startedAt;
+    const path = normalizeMetricPath(new URL(request.url).pathname);
+    const labels = {
+      method: request.method,
+      path,
+      status: String(response.status)
+    };
+    prometheusRegistry.incrementHttpRequest(labels);
+    prometheusRegistry.observeHttpDuration(labels, durationMs);
+    return response;
+  };
+}
+// ../../src/core/http/requireAbilityMiddleware.ts
+function createRequireAbilityMiddleware(abilityChecker) {
+  return (ability) => {
+    return async (_request, next) => {
+      const user = currentAuthUser();
+      try {
+        abilityChecker.requireAbility(user, ability);
+      } catch (error) {
+        if (error instanceof ForbiddenError) {
+          return Response.json({ error: error.message }, { status: error.status });
+        }
+        throw error;
+      }
+      return await next();
+    };
+  };
+}
+// ../../src/core/http/requireGlobalAdminMiddleware.ts
+function createRequireGlobalAdminMiddleware() {
+  return async (_request, next) => {
+    const user = currentAuthUser();
+    if (!isGlobalAdmin(user)) {
+      logSecurityEvent("privilege_escalation_blocked", {
+        required_role: "platform_admin",
+        path: new URL(_request.url).pathname
+      });
+      const error = new ForbiddenError("Platform admin access required.");
+      return Response.json({ error: error.message }, { status: error.status });
     }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
+    return await next();
+  };
 }
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
+// ../../src/core/http/requireWebAuthMiddleware.ts
+function createRequireWebAuthMiddleware(auth2) {
+  return async (request, next) => {
+    const user = await auth2.resolve(request);
+    if (user) {
+      return await next();
+    }
+    if (requestPrefersJson(request)) {
+      throw new UnauthorizedError;
+    }
+    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
+    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+  };
 }
-var jobRegistry = readSharedJobRegistry();
-
-// ../../src/config/queue.ts
-var queueConfig = {
-  driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
-  maxAttempts: Number(process.env.QUEUE_MAX_ATTEMPTS ?? "3"),
-  backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
+// ../../src/core/http/scimThrottleMiddleware.ts
+var {RedisClient: RedisClient3 } = globalThis.Bun;
+function createScimThrottleMiddleware(options) {
+  const client = options.redisUrl ? new RedisClient3(options.redisUrl) : null;
+  return async (request, next) => {
+    const identity = request.headers.get("authorization")?.slice("Bearer ".length, "Bearer ".length + 16) ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+    const key = `workhub:scim-throttle:${identity}`;
+    if (client) {
+      const attempts = Number(await client.incr(key));
+      if (attempts === 1) {
+        await client.expire(key, options.decaySeconds);
+      }
+      if (attempts > options.maxAttempts) {
+        return Response.json({ error: "Too many SCIM requests." }, { status: 429, headers: { "retry-after": String(options.decaySeconds) } });
+      }
+    }
+    return await next();
+  };
+}
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/core/queue/jobRunner.ts
-async function runQueueJob(envelope, failedJobs) {
-  const job = jobRegistry.create(envelope.name);
-  if (!job) {
-    throw new Error(`Unknown job "${envelope.name}".`);
+// ../../src/config/contentSecurityPolicy.ts
+function strictApiContentSecurityPolicy() {
+  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
+}
+function serverHtmxContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self' https://unpkg.com",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function spaContentSecurityPolicy() {
+  return [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self'",
+    "connect-src 'self'",
+    "img-src 'self'",
+    "font-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'"
+  ].join("; ");
+}
+function resolveContentSecurityPolicy(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
   }
-  const attempts = envelope.attempts ?? 0;
-  try {
-    await job.handle(envelope.payload);
-  } catch (error) {
-    const nextAttempt = attempts + 1;
-    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
-    if (nextAttempt < maxAttempts) {
-      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
-      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
-      await runQueueJob({
-        ...envelope,
-        attempts: nextAttempt
-      }, failedJobs);
-      return;
-    }
-    await failedJobs.recordFailure({
-      jobName: envelope.name,
-      payload: envelope.payload,
-      exception: error instanceof Error ? error.stack ?? error.message : String(error)
-    });
-    throw error;
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return serverHtmxContentSecurityPolicy();
+  }
+  if (frontendMode === "spa-react") {
+    return spaContentSecurityPolicy();
   }
+  return strictApiContentSecurityPolicy();
 }
 
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient5 } = globalThis.Bun;
-var QUEUE_LIST_KEY = "workhub:queue:default";
-var QUEUE_HIGH_KEY = "workhub:queue:high";
-var QUEUE_LOW_KEY = "workhub:queue:low";
-var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
-function queueKeyForPriority(priority = "default") {
-  switch (priority) {
-    case "high":
-      return QUEUE_HIGH_KEY;
-    case "low":
-      return QUEUE_LOW_KEY;
-    default:
-      return QUEUE_LIST_KEY;
-  }
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware() {
+  return async (_request, next) => {
+    const response = await next();
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-XSS-Protection", "0");
+    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
+    if (appConfig.env === "production") {
+      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  };
 }
-function parseQueueJobEnvelope(rawPayload) {
-  let parsed;
-  try {
-    parsed = JSON.parse(rawPayload);
-  } catch {
-    console.error("[QueueWorker] Ignoring malformed queue payload");
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object") {
-    console.error("[QueueWorker] Ignoring non-object queue payload");
-    return null;
-  }
-  const envelope = parsed;
-  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
-    console.error("[QueueWorker] Ignoring queue payload without job name");
-    return null;
-  }
-  if (!jobRegistry.create(envelope.name)) {
-    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
-    return null;
+// ../../src/core/http/throttleMiddleware.ts
+var {RedisClient: RedisClient4 } = globalThis.Bun;
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
   }
-  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
-    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
-    return null;
+  if (user) {
+    return `user:${user.id}`;
   }
-  return {
-    name: envelope.name,
-    payload: envelope.payload ?? {},
-    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+}
+function createThrottleMiddleware(options) {
+  const client = new RedisClient4(options.redisUrl);
+  const prefix = options.keyPrefix ?? "workhub:throttle:";
+  return async (request, next) => {
+    const identity = resolveThrottleIdentity(request);
+    const path = new URL(request.url).pathname;
+    const throttleKey = `${prefix}${identity}:${path}`;
+    const attempts = Number(await client.incr(throttleKey));
+    if (attempts === 1) {
+      await client.expire(throttleKey, options.decaySeconds);
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return Response.json({ error: "Too many requests." }, {
+        status: 429,
+        headers: {
+          "retry-after": String(options.decaySeconds)
+        }
+      });
+    }
+    return await next();
   };
 }
-
-class RedisQueue {
-  client;
-  constructor(redisUrl) {
-    this.client = new RedisClient5(redisUrl);
+// ../../src/core/http/parseFormBody.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected a form submission.");
   }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
+  return formDataToRecord(await request.formData());
+}
+function formDataToRecord(formData) {
+  const values = {};
+  for (const [key, value] of formData.entries()) {
+    if (typeof value === "string") {
+      values[key] = value;
     }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    const queueKey = queueKeyForPriority(job.priority);
-    await this.client.lpush(queueKey, JSON.stringify(envelope));
   }
+  return values;
 }
 
-class QueueWorker {
-  failedJobs;
-  timeoutSeconds;
-  running = false;
-  stopping = false;
-  client;
-  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
-    this.failedJobs = failedJobs;
-    this.timeoutSeconds = timeoutSeconds;
-    this.client = new RedisClient5(redisUrl);
-  }
-  requestStop() {
-    this.stopping = true;
+// ../../src/core/http/webFormRequest.ts
+class WebFormRequest {
+  authorize(_request) {
+    return true;
   }
-  isRunning() {
-    return this.running;
+  validatePayload(payload) {
+    return this.parse(payload);
   }
-  async processNext() {
-    let result = null;
-    for (const queueKey of QUEUE_KEYS) {
-      result = await this.client.brpop(queueKey, 1);
-      if (result) {
-        break;
-      }
-    }
-    if (!result) {
-      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
-    }
-    if (!result) {
-      return false;
-    }
-    const [, rawPayload] = result;
-    const envelope = parseQueueJobEnvelope(rawPayload);
-    if (!envelope) {
-      return true;
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
     }
+    const payload = requestPrefersJson(request) ? await parseJsonBody(request, (body) => body) : await parseFormBody(request);
     try {
-      await runQueueJob(envelope, this.failedJobs);
+      return this.validatePayload(payload);
     } catch (error) {
-      console.error("[QueueWorker] Job failed:", error);
-    }
-    return true;
-  }
-  async run() {
-    this.running = true;
-    while (!this.stopping) {
-      await this.processNext();
+      if (error instanceof ValidationError) {
+        throw error;
+      }
+      throw error;
     }
-    this.running = false;
-  }
-  close() {
-    this.client.close();
   }
 }
-
-// ../../src/core/queue/resilientQueue.ts
-class ResilientQueue {
-  failedJobs;
-  asyncDispatch;
-  constructor(failedJobs, asyncDispatch = false) {
-    this.failedJobs = failedJobs;
-    this.asyncDispatch = asyncDispatch;
+// ../../src/core/lifecycle/gracefulShutdown.ts
+var shutdownHandlers = new Map;
+var shutdownInstalled = false;
+var shuttingDown = false;
+function registerShutdownHandler(name, handler) {
+  shutdownHandlers.set(name, handler);
+  return () => {
+    shutdownHandlers.delete(name);
+  };
+}
+async function runGracefulShutdown(signal) {
+  if (shuttingDown) {
+    return;
   }
-  async dispatch(job, payload) {
-    const name = jobRegistry.resolveName(job);
-    if (!name) {
-      throw new Error("Job is not registered with the queue worker registry.");
-    }
-    const envelope = {
-      name,
-      payload,
-      attempts: 0
-    };
-    if (this.asyncDispatch) {
-      setTimeout(() => {
-        runQueueJob(envelope, this.failedJobs).catch((error) => {
-          console.error("[ResilientQueue] Job failed:", error);
-        });
-      }, 0);
-      return;
+  shuttingDown = true;
+  console.log(`[shutdown] Received ${signal}, draining ${shutdownHandlers.size} handler(s)...`);
+  for (const [name, handler] of shutdownHandlers) {
+    try {
+      await handler();
+      console.log(`[shutdown] Completed ${name}`);
+    } catch (error) {
+      console.error(`[shutdown] Failed ${name}:`, error);
     }
-    await runQueueJob(envelope, this.failedJobs);
   }
 }
-
-// ../../src/core/queue/publicQueue.ts
-function createFailedJobService() {
-  return new failedJobService_default(new failedJobRepository_default);
-}
-function createTrackedJob(name, job) {
-  return jobRegistry.track(name, job);
-}
-function createProductionQueue(driver, options = {}) {
-  options.registerJobs?.();
-  const failedJobs = options.failedJobs ?? createFailedJobService();
-  if (driver === "redis") {
-    if (!options.redisUrl) {
-      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
-    }
-    return new RedisQueue(options.redisUrl);
+function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
+  if (shutdownInstalled) {
+    return;
+  }
+  shutdownInstalled = true;
+  for (const signal of signals) {
+    process.on(signal, () => {
+      runGracefulShutdown(signal).finally(() => {
+        process.exit(0);
+      });
+    });
   }
-  return new ResilientQueue(failedJobs, driver === "async");
-}
-function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
-  return new QueueWorker(redisUrl, failedJobs);
 }
-// ../../src/core/queue/queueMetrics.ts
-var {RedisClient: RedisClient6 } = globalThis.Bun;
-async function readRedisQueueDepth(redisUrl) {
-  const client = new RedisClient6(redisUrl);
-  const [high, defaultQueue, low] = await Promise.all([
-    client.llen(QUEUE_HIGH_KEY),
-    client.llen(QUEUE_LIST_KEY),
-    client.llen(QUEUE_LOW_KEY)
-  ]);
-  return {
-    high: Number(high ?? 0),
-    default: Number(defaultQueue ?? 0),
-    low: Number(low ?? 0),
-    total: Number(high ?? 0) + Number(defaultQueue ?? 0) + Number(low ?? 0)
+// ../../src/core/logging/requestLoggingMiddleware.ts
+function createRequestLoggingMiddleware() {
+  return async (request, next) => {
+    return await runWithRequestMeta({
+      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      userAgent: request.headers.get("user-agent"),
+      request
+    }, async () => {
+      const startedAt = performance.now();
+      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+      const response = await next();
+      const durationMs = Math.round(performance.now() - startedAt);
+      appLogger.info("HTTP request completed", {
+        requestId,
+        method: request.method,
+        path: new URL(request.url).pathname,
+        status: response.status,
+        durationMs
+      });
+      return response;
+    });
   };
 }
-async function collectQueueMetrics() {
-  const driver = queueConfig.driver;
-  const failedJobs = createFailedJobService();
-  const failedCount = (await failedJobs.listRecent(1000)).length;
-  if (driver !== "redis") {
-    return {
-      driver,
-      pending: {
-        high: 0,
-        default: 0,
-        low: 0,
-        total: 0
-      },
-      failedCount
-    };
-  }
-  const redisUrl = process.env.REDIS_URL;
-  if (!redisUrl) {
-    return {
-      driver,
-      pending: {
-        high: 0,
-        default: 0,
-        low: 0,
-        total: 0
-      },
-      failedCount
-    };
-  }
+// ../../src/core/mail/markdownMail.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function stripMarkdown(markdown) {
+  return markdown.replace(/^#{1,6}\s+/gm, "").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1 ($2)").replace(/^[-*]\s+/gm, "\u2022 ").replace(/```[\s\S]*?```/g, "").replace(/\n{3,}/g, `
+
+`).trim();
+}
+function markdownToHtml(markdown) {
+  const escaped = markdown.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return escaped.replace(/^### (.+)$/gm, "<h3>$1</h3>").replace(/^## (.+)$/gm, "<h2>$1</h2>").replace(/^# (.+)$/gm, "<h1>$1</h1>").replace(/`([^`]+)`/g, "<code>$1</code>").replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>').replace(/^[-*]\s+(.+)$/gm, "<li>$1</li>").replace(/(<li>[\s\S]*?<\/li>\n?)+/g, (block) => `<ul>${block}</ul>`).replace(/```(\w+)?\n([\s\S]*?)```/g, "<pre><code>$2</code></pre>").split(/\n\n+/).map((block) => {
+    if (block.startsWith("<")) {
+      return block;
+    }
+    return `<p>${block.replace(/\n/g, " ")}</p>`;
+  }).join(`
+`);
+}
+function wrapMarkdownMailLayout(bodyHtml, options = {}) {
+  const title = escapeHtml(options.title ?? "GetStrata");
+  const preview = escapeHtml(options.preview ?? "");
+  const footer = escapeHtml(options.footer ?? "Sent by GetStrata");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; line-height: 1.5; color: #111827; background: #f9fafb; margin: 0; padding: 24px; }
+    .container { max-width: 640px; margin: 0 auto; background: #ffffff; border: 1px solid #e5e7eb; border-radius: 8px; overflow: hidden; }
+    .header { padding: 20px 24px; border-bottom: 1px solid #e5e7eb; font-weight: 600; }
+    .content { padding: 24px; }
+    .footer { padding: 16px 24px; border-top: 1px solid #e5e7eb; color: #6b7280; font-size: 14px; }
+    a { color: #2563eb; }
+    code { background: #f3f4f6; padding: 2px 4px; border-radius: 4px; }
+    pre { background: #111827; color: #f9fafb; padding: 12px; border-radius: 6px; overflow-x: auto; }
+  </style>
+</head>
+<body>
+  ${preview ? `<span style="display:none;max-height:0;overflow:hidden;">${preview}</span>` : ""}
+  <div class="container">
+    <div class="header">${title}</div>
+    <div class="content">${bodyHtml}</div>
+    <div class="footer">${footer}</div>
+  </div>
+</body>
+</html>`;
+}
+function renderMarkdownMail(markdown, options = {}) {
+  const bodyHtml = markdownToHtml(markdown.trim());
+  const html = wrapMarkdownMailLayout(bodyHtml, options);
+  const text = stripMarkdown(markdown);
+  return { html, text };
+}
+// ../../src/core/mail/markdownMailable.ts
+function buildMarkdownMailMessage(input) {
+  const rendered = renderMarkdownMail(input.markdown, {
+    title: input.layout?.title ?? input.subject,
+    ...input.layout
+  });
   return {
-    driver,
-    pending: await readRedisQueueDepth(redisUrl),
-    failedCount
+    to: input.to,
+    subject: input.subject,
+    body: rendered.text,
+    html: rendered.html
   };
 }
-// ../../src/core/scheduler/schedule.ts
-class Schedule {
-  tasks = [];
-  command(expression, name, run) {
-    this.tasks.push({ expression, name, run });
-    return this;
+async function sendMarkdownMail(mailer2, input) {
+  await mailer2.send(buildMarkdownMailMessage(input));
+}
+// ../../src/core/notifications/dispatcher.ts
+class NotificationDispatcher {
+  mailer;
+  databaseStore;
+  constructor(mailer2, databaseStore = null) {
+    this.mailer = mailer2;
+    this.databaseStore = databaseStore;
   }
-  dueTasks(now = new Date) {
-    const minute = now.getMinutes();
-    return this.tasks.filter((task) => {
-      if (task.expression === "* * * * *") {
-        return true;
+  async send(notifiable, notification) {
+    for (const channel of notification.via(notifiable)) {
+      if (channel === "mail") {
+        await this.sendMail(notifiable, notification);
+        continue;
       }
-      if (task.expression.startsWith("*/")) {
-        const interval = Number.parseInt(task.expression.slice(2), 10);
-        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
+      if (channel === "database") {
+        await this.sendDatabase(notifiable, notification);
       }
-      return false;
+    }
+  }
+  async sendMail(notifiable, notification) {
+    const routed = notifiable.routeNotificationFor("mail");
+    if (routed === null) {
+      return;
+    }
+    const message = notification.toMail(notifiable);
+    if (!message) {
+      return;
+    }
+    if (message.markdown) {
+      await this.mailer.send(buildMarkdownMailMessage({
+        to: String(routed),
+        subject: message.subject,
+        markdown: message.markdown
+      }));
+      return;
+    }
+    await this.mailer.send({
+      to: String(routed),
+      subject: message.subject,
+      body: message.body ?? "",
+      ...message.html ? { html: message.html } : {}
     });
   }
-  tasksList() {
-    return [...this.tasks];
+  async sendDatabase(notifiable, notification) {
+    if (!this.databaseStore) {
+      return;
+    }
+    const payload = notification.toDatabase(notifiable);
+    if (!payload) {
+      return;
+    }
+    await this.databaseStore.create({
+      userId: Number(notifiable.getNotificationKey()),
+      ...payload
+    });
   }
 }
-var appSchedule = new Schedule;
-async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
-  const due = schedule.dueTasks(now);
-  for (const task of due) {
-    await task.run();
-  }
-  return due.length;
+function createNotificationDispatcher(mailer2, databaseStore) {
+  return new NotificationDispatcher(mailer2, databaseStore ?? null);
 }
-// ../../src/core/security/publicReads.ts
-function isPublicReadsEnabled() {
-  return isFeatureEnabled("publicReads");
+// ../../src/core/notifications/notification.ts
+class Notification {
+  via(_notifiable) {
+    throw new Error("Notification subclasses must implement via().");
+  }
+  toMail(_notifiable) {
+    return null;
+  }
+  toDatabase(_notifiable) {
+    return null;
+  }
 }
-function guestCanViewResource() {
-  return isPublicReadsEnabled();
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
 }
-// ../../src/core/tenant/tenantMiddleware.ts
-import { createHash } from "crypto";
 
-// ../../src/core/tenant/databaseTenantContext.ts
-async function runWithMigrationBypass(callback) {
-  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
   }
 }
 
-// ../../src/core/tenant/tenantMiddleware.ts
-var DEFAULT_TENANT = {
-  id: 1,
-  slug: "default",
-  plan: "enterprise",
-  region: "eu"
-};
-async function resolveUserTenantId(userId) {
-  return await runWithMigrationBypass(async () => {
-    const rows = await repositoryConnection`
-      SELECT tenant_id
-      FROM users
-      WHERE id = ${userId}
-      LIMIT 1
-    `;
-    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
-  });
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
 }
-function auditChecksum(payload) {
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
-async function resolveTenantForRequest(request) {
-  const user = currentAuthUser();
-  const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
-  if (user) {
-    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
-    if (Number.isInteger(userId) && userId > 0) {
-      const userTenantId = await resolveUserTenantId(userId);
-      if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
-          throw new ForbiddenError("Tenant header does not match your account.");
-        }
-        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-      }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
-      }
-      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-    }
+// ../../src/core/queue/failedJobTable.ts
+var failedJobTable = defineTable({
+  name: "failed_job",
+  primaryKey: "id",
+  columns: ["id", "job_name", "payload", "exception", "failed_at"],
+  defaultOrderBy: { column: "failed_at", direction: "DESC" }
+});
+
+// ../../src/core/queue/failedJobRepository.ts
+class FailedJobRepository extends BaseRepository {
+  constructor() {
+    super(failedJobTable);
   }
-  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
-  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
 }
-function createTenantMiddleware() {
-  return async (request, next) => {
-    const pathname = new URL(request.url).pathname;
-    if (pathname.startsWith("/scim/")) {
-      return await next();
+var failedJobRepository_default = FailedJobRepository;
+
+// ../../src/core/queue/failedJobService.ts
+class FailedJobService {
+  repository;
+  constructor(repository) {
+    this.repository = repository;
+  }
+  async recordFailure(input) {
+    return await this.repository.create({
+      job_name: input.jobName,
+      payload: input.payload,
+      exception: input.exception,
+      failed_at: new Date
+    });
+  }
+  listRecent(limit = 50) {
+    return this.repository.findAll({
+      limit,
+      orderBy: { column: "failed_at", direction: "DESC" }
+    });
+  }
+  async retry(id) {
+    const failedJob = await this.repository.findByIdOrThrow(id, (jobId) => new Error(`Failed job ${jobId} not found.`));
+    await this.repository.deleteById(id);
+    return failedJob;
+  }
+  async delete(id) {
+    const deleted = await this.repository.deleteById(id);
+    if (!deleted) {
+      throw new Error(`Failed job ${id} not found.`);
     }
-    try {
-      const tenant = await resolveTenantForRequest(request);
-      return await runWithTenantDatabase(tenant, async () => {
-        const response = await next();
-        const headers = new Headers(response.headers);
-        headers.set("x-tenant-id", String(tenant.id));
-        headers.set("x-tenant-region", tenant.region);
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      });
-    } catch (error) {
-      if (error instanceof HttpError) {
-        return Response.json({ error: error.message }, { status: error.status });
+  }
+  async flush() {
+    const jobs = await this.repository.findAll();
+    let deleted = 0;
+    for (const job of jobs) {
+      if (await this.repository.deleteById(job.id)) {
+        deleted += 1;
       }
-      throw error;
     }
-  };
+    return deleted;
+  }
 }
-// ../../src/core/tracing/traceContext.ts
-var traceContextStorage = createAsyncContextStore("@getstrata/traceContext");
-function runWithTraceContext(context, callback) {
-  return traceContextStorage.run(context, callback);
+var failedJobService_default = FailedJobService;
+
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
 }
-function currentTraceId() {
-  return traceContextStorage.getStore()?.traceId ?? null;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
 }
-// ../../src/core/tracing/otel.ts
-import { randomBytes as randomBytes2 } from "crypto";
-function randomHex(bytes) {
-  return randomBytes2(bytes).toString("hex");
+var jobRegistry = readSharedJobRegistry();
+
+// ../../src/config/queue.ts
+var queueConfig = {
+  driver: process.env.QUEUE_DRIVER === "redis" || process.env.QUEUE_DRIVER === "async" || process.env.QUEUE_DRIVER === "sync" ? process.env.QUEUE_DRIVER : DEFAULT_QUEUE_DRIVER,
+  maxAttempts: Number(process.env.QUEUE_MAX_ATTEMPTS ?? "3"),
+  backoffMs: Number(process.env.QUEUE_BACKOFF_MS ?? "1000")
+};
+
+// ../../src/core/queue/jobRunner.ts
+async function runQueueJob(envelope, failedJobs) {
+  const job = jobRegistry.create(envelope.name);
+  if (!job) {
+    throw new Error(`Unknown job "${envelope.name}".`);
+  }
+  const attempts = envelope.attempts ?? 0;
+  try {
+    await job.handle(envelope.payload);
+  } catch (error) {
+    const nextAttempt = attempts + 1;
+    const maxAttempts = job.maxAttempts ?? queueConfig.maxAttempts;
+    if (nextAttempt < maxAttempts) {
+      const backoffMs = job.backoffMs ?? queueConfig.backoffMs;
+      await new Promise((resolve) => setTimeout(resolve, backoffMs * nextAttempt));
+      await runQueueJob({
+        ...envelope,
+        attempts: nextAttempt
+      }, failedJobs);
+      return;
+    }
+    await failedJobs.recordFailure({
+      jobName: envelope.name,
+      payload: envelope.payload,
+      exception: error instanceof Error ? error.stack ?? error.message : String(error)
+    });
+    throw error;
+  }
 }
-function createSpan(input) {
-  const spanId = randomHex(8);
+
+// ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient5 } = globalThis.Bun;
+var QUEUE_LIST_KEY = "workhub:queue:default";
+var QUEUE_HIGH_KEY = "workhub:queue:high";
+var QUEUE_LOW_KEY = "workhub:queue:low";
+var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
+function queueKeyForPriority(priority = "default") {
+  switch (priority) {
+    case "high":
+      return QUEUE_HIGH_KEY;
+    case "low":
+      return QUEUE_LOW_KEY;
+    default:
+      return QUEUE_LIST_KEY;
+  }
+}
+function parseQueueJobEnvelope(rawPayload) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawPayload);
+  } catch {
+    console.error("[QueueWorker] Ignoring malformed queue payload");
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    console.error("[QueueWorker] Ignoring non-object queue payload");
+    return null;
+  }
+  const envelope = parsed;
+  if (typeof envelope.name !== "string" || envelope.name.length === 0) {
+    console.error("[QueueWorker] Ignoring queue payload without job name");
+    return null;
+  }
+  if (!jobRegistry.create(envelope.name)) {
+    console.error(`[QueueWorker] Ignoring unknown job name: ${envelope.name}`);
+    return null;
+  }
+  if (envelope.payload !== undefined && (typeof envelope.payload !== "object" || envelope.payload === null)) {
+    console.error("[QueueWorker] Ignoring queue payload with invalid payload object");
+    return null;
+  }
   return {
-    traceId: input.traceId,
-    spanId,
-    name: input.name,
-    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
-    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
-    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
-      key,
-      value: { stringValue: value }
-    })),
-    status: { code: 1 }
+    name: envelope.name,
+    payload: envelope.payload ?? {},
+    attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
   };
 }
-async function exportOtelSpan(span) {
-  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-  if (!endpoint) {
-    return;
+
+class RedisQueue {
+  client;
+  constructor(redisUrl) {
+    this.client = new RedisClient5(redisUrl);
   }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
-  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      resourceSpans: [
-        {
-          resource: {
-            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
-          },
-          scopeSpans: [{ spans: [span] }]
-        }
-      ]
-    })
-  });
-}
-
-// ../../src/core/tracing/tracingMiddleware.ts
-function createTracingMiddleware() {
-  return async (request, next) => {
-    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
-    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
-    const startedAt = performance.now();
-    const path = new URL(request.url).pathname;
-    return await runWithTraceContext({ traceId, spanId }, async () => {
-      const response = await next();
-      const endedAt = performance.now();
-      const headers = new Headers(response.headers);
-      headers.set("x-trace-id", traceId);
-      headers.set("x-span-id", spanId);
-      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
-      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
-      exportOtelSpan(createSpan({
-        traceId,
-        name: `${request.method} ${path}`,
-        startedAt,
-        endedAt,
-        attributes: {
-          "http.method": request.method,
-          "http.route": path,
-          "http.status_code": String(response.status)
-        }
-      })).catch(() => {
-        return;
-      });
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    });
-  };
-}
-// ../../src/core/validation/rules.ts
-function required() {
-  return (field, value) => {
-    if (value === undefined || value === null || typeof value === "string" && value.trim() === "") {
-      return `"${field}" is required.`;
-    }
-    return;
-  };
-}
-function stringRule() {
-  return (field, value) => {
-    if (value === undefined || value === null) {
-      return;
-    }
-    if (typeof value !== "string") {
-      return `"${field}" must be a string.`;
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
     }
-    return;
-  };
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    const queueKey = queueKeyForPriority(job.priority);
+    await this.client.lpush(queueKey, JSON.stringify(envelope));
+  }
 }
-function minLength(minimum) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
+
+class QueueWorker {
+  failedJobs;
+  timeoutSeconds;
+  running = false;
+  stopping = false;
+  client;
+  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
+    this.failedJobs = failedJobs;
+    this.timeoutSeconds = timeoutSeconds;
+    this.client = new RedisClient5(redisUrl);
+  }
+  requestStop() {
+    this.stopping = true;
+  }
+  isRunning() {
+    return this.running;
+  }
+  async processNext() {
+    let result = null;
+    for (const queueKey of QUEUE_KEYS) {
+      result = await this.client.brpop(queueKey, 1);
+      if (result) {
+        break;
+      }
     }
-    if (value.trim().length < minimum) {
-      return `"${field}" must be at least ${minimum} characters.`;
+    if (!result) {
+      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
     }
-    return;
-  };
-}
-function maxLength(maximum) {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
+    if (!result) {
+      return false;
     }
-    if (value.trim().length > maximum) {
-      return `"${field}" must be at most ${maximum} characters.`;
+    const [, rawPayload] = result;
+    const envelope = parseQueueJobEnvelope(rawPayload);
+    if (!envelope) {
+      return true;
     }
-    return;
-  };
-}
-function emailRule() {
-  return (field, value) => {
-    if (typeof value !== "string") {
-      return;
+    try {
+      await runQueueJob(envelope, this.failedJobs);
+    } catch (error) {
+      console.error("[QueueWorker] Job failed:", error);
     }
-    const normalized = value.trim();
-    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
-      return `"${field}" must be a valid email address.`;
+    return true;
+  }
+  async run() {
+    this.running = true;
+    while (!this.stopping) {
+      await this.processNext();
     }
-    return;
-  };
+    this.running = false;
+  }
+  close() {
+    this.client.close();
+  }
 }
-function validateObject(payload, schema) {
-  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new ValidationError("Request body must be a JSON object.");
+
+// ../../src/core/queue/resilientQueue.ts
+class ResilientQueue {
+  failedJobs;
+  asyncDispatch;
+  constructor(failedJobs, asyncDispatch = false) {
+    this.failedJobs = failedJobs;
+    this.asyncDispatch = asyncDispatch;
   }
-  const body = payload;
-  const errors = {};
-  const output = {};
-  for (const [field, rules] of Object.entries(schema)) {
-    const messages = rules.map((rule) => rule(field, body[field], body)).filter((message) => message !== undefined);
-    if (messages.length > 0) {
-      errors[field] = messages;
-      continue;
+  async dispatch(job, payload) {
+    const name = jobRegistry.resolveName(job);
+    if (!name) {
+      throw new Error("Job is not registered with the queue worker registry.");
     }
-    if (field in body && body[field] !== undefined) {
-      const rawValue = body[field];
-      output[field] = typeof rawValue === "string" ? rawValue.trim() : rawValue;
+    const envelope = {
+      name,
+      payload,
+      attempts: 0
+    };
+    if (this.asyncDispatch) {
+      setTimeout(() => {
+        runQueueJob(envelope, this.failedJobs).catch((error) => {
+          console.error("[ResilientQueue] Job failed:", error);
+        });
+      }, 0);
+      return;
     }
+    await runQueueJob(envelope, this.failedJobs);
   }
-  if (Object.keys(errors).length > 0) {
-    throw new ValidationError("The given data was invalid.", errors);
+}
+
+// ../../src/core/queue/publicQueue.ts
+function createFailedJobService() {
+  return new failedJobService_default(new failedJobRepository_default);
+}
+function createTrackedJob(name, job) {
+  return jobRegistry.track(name, job);
+}
+function createProductionQueue(driver, options = {}) {
+  options.registerJobs?.();
+  const failedJobs = options.failedJobs ?? createFailedJobService();
+  if (driver === "redis") {
+    if (!options.redisUrl) {
+      throw new Error('QUEUE_DRIVER="redis" requires REDIS_URL to be set.');
+    }
+    return new RedisQueue(options.redisUrl);
   }
-  return output;
+  return new ResilientQueue(failedJobs, driver === "async");
 }
-export {
-  wrapRouteHandler,
-  wrapMarkdownMailLayout,
-  withMigrationLock,
-  withMiddleware,
-  withErrorHandling,
-  verifyCsrfToken,
-  validateObject,
-  toResourceCollection,
-  toPaginatedResourceCollection,
-  stripMarkdown,
-  stringRule,
-  storageFacade as storage,
-  setActiveApplicationContext,
-  serializeDate,
-  sendMarkdownMail,
-  securedBindRouteModelByKey,
-  securedBindRouteModel,
-  scopedOrganizationIds,
-  runWithTraceContext,
-  runWithTenantDatabase,
-  runWithTenant,
-  runWithRequestMeta,
-  runWithDatabaseConnection,
-  runWithAuthUser,
-  runSeedersFromDirectory,
-  runQueueJob,
-  runInTransaction,
-  runGracefulShutdown,
-  runDueScheduledTasks,
-  rollbackDatabase,
-  resolveWebLayoutData,
-  resolveUserTenantId,
-  resolveUserId,
-  resolveService,
-  resolveRepositoryConnection,
-  resolveOrganizationScope,
-  resolveMembershipService,
-  resolveDatabaseDriver,
-  resolveCsrfTokenForRequest,
-  resolveCsrfToken,
-  resolveApplicationQueue,
-  resolveApplicationPolicyGate,
-  resolveApplicationLogger,
-  resolveApplicationEventBus,
-  resolveApplicationDependencies,
-  resolveApplicationConfig,
-  resolveApplicationCache,
-  resolveApplicationAuth,
-  resetDefaultStorage,
-  required,
-  requestIdMiddleware,
-  repositoryConnection,
-  renderMarkdownMail,
-  registerShutdownHandler,
-  registerModelRepository,
-  registerDefaultDatabasePool,
-  readSubmittedCsrfTokenFromBody,
-  readSubmittedCsrfToken,
-  readRequestCookie,
-  readBunRequestCookie,
-  rateLimitMultiplierForPlan,
-  queue,
-  prometheusRegistry,
-  policyGate,
-  parsePositiveIntParam,
-  parsePaginationQuery,
-  parseMultipartUpload,
-  paginatedResponse,
-  normalizeMetricPath,
-  noContentResponse,
-  morphTo,
-  morphOne,
-  morphMany,
-  modelEventName,
-  minLength,
-  migrateDatabase,
-  maxLength,
-  markdownToHtml,
-  mailer,
-  mail,
-  logSecurityEvent,
-  log,
-  loadSeedersFromDirectory,
-  loadMigrationsFromDirectory,
-  jsonResponse2 as jsonResponse,
-  jobRegistry,
-  isPublicReadsEnabled,
-  isInsideTenantDatabaseScope,
-  isHtmxRequest,
-  isGlobalAdmin,
-  isEtagEnabled,
-  installGracefulShutdownSignals,
-  inferReferencedTable,
-  indexMorphToRelation,
-  indexMorphOneRelation,
-  indexMorphManyRelation,
-  indexHasOneRelation,
-  indexHasManyRelation,
-  indexBelongsToRelation,
-  indexBelongsToManyRelation,
-  hydrateValue,
-  htmlResponse,
-  hasOrgMembership,
-  hasOne,
-  hasMinimumOrgRole2 as hasMinimumOrgRole,
-  hasMany,
-  guestCanViewResource,
-  grammarForDriver,
-  getMigrationStatus,
-  getDefaultDatabaseQuery,
-  getDefaultDatabasePool,
-  getActiveDatabaseConnection,
-  freshDatabase,
-  formatAdminValue,
-  filterMassAssignable,
-  events,
-  eventBus,
-  etagFromResource,
-  emptyPaginateResult,
-  emailRule,
-  dehydrateValue,
-  defineTable,
-  currentTraceId,
-  currentTenantId,
-  currentTenant,
-  currentRequestMeta,
-  currentOrganizationIds,
-  currentOrgRole,
-  currentAuthUser,
-  createdResponse,
-  createTrackedJob,
-  createTracingMiddleware,
-  createThrottleMiddleware,
-  createTenantMiddleware,
-  createStorageDriver,
-  createSecurityHeadersMiddleware,
-  createScimThrottleMiddleware,
-  createScimAuthMiddleware,
-  createSchemaBuilder,
-  createRequireWebAuthMiddleware,
-  createRequireGlobalAdminMiddleware,
-  createRequireAuthMiddleware,
-  createRequireAbilityMiddleware,
-  createRequestLoggingMiddleware,
-  createQueueWorker,
-  createQueue,
-  createProductionQueue,
-  createNotificationDispatcher,
-  createMetricsMiddleware,
-  createMemoryThrottleMiddleware,
-  createMembershipMiddleware,
-  createLoginThrottleMiddleware,
-  createFlashMiddleware,
-  createFailedJobService,
-  createDatabaseQueryProxy,
-  createDatabaseConnection2 as createDatabaseConnection,
-  createCsrfTokenCookie,
-  createCsrfProtection,
-  createCsrfMiddleware,
-  createCorsMiddleware,
-  createCacheStore,
-  createBodySizeLimitMiddleware,
-  createAuthorizeMiddleware,
-  createAuthMiddleware,
-  config,
-  conditionalJsonResponse,
-  composeMiddleware,
-  compileBlueprint,
-  collectQueueMetrics,
-  cache,
-  buildSmtpPayload,
-  buildRequestCacheKey,
-  buildMarkdownMailMessage,
-  bindRouteModel,
-  bindDatabaseConnection2 as bindDatabaseConnection,
-  belongsToMany,
-  belongsTo,
-  authContext,
-  auth,
-  auditChecksum,
-  assertResourceInCurrentTenant,
-  assertOrganizationReadable,
-  assertIfMatch,
-  applyMiddlewareToRoutes,
-  applyConditionalGet,
-  applyCasts,
-  appendProjectScope,
-  appendOrganizationScope,
-  appSchedule,
-  WhereBuilder,
-  WebFormRequest,
-  ValidationError,
-  UnsupportedSchemaFeatureError,
-  UnprocessableEntityError,
-  UnauthorizedError,
-  SyncQueue,
-  StorageManager,
-  SqliteGrammar,
-  ServiceContainer,
-  Schema,
-  Schedule,
-  ResilientQueue,
-  RepositoryQuery,
-  RedisQueue,
-  QueueWorker,
-  PrometheusRegistry,
-  PreconditionFailedError,
-  PostgresGrammar,
-  PolicyGate,
-  Policy,
-  PayloadTooLargeError,
-  NotificationDispatcher,
-  Notification,
-  NotFoundError,
-  MySqlGrammar,
-  Model,
-  membershipService_default as MembershipService,
-  Mailer,
-  LogMailDriver,
-  LocalStorageDriver,
-  Job,
-  HttpError,
-  GuestGuard,
-  FormRequest,
-  ForeignIdColumnDefinition,
-  ForbiddenError,
-  failedJobService_default as FailedJobService,
-  failedJobRepository_default as FailedJobRepository,
-  EventBus,
-  EtaViewEngine,
-  DatabaseTokenGuard,
-  DEFAULT_VIEWS_DIRECTORY,
-  DEFAULT_TENANT,
-  ConflictError,
-  ConfigStore,
-  CompositeGuard,
-  ColumnDefinition,
-  repository_default2 as CacheRepository,
-  CACHE_TAGS,
-  Blueprint,
-  baseRepository_default as BaseRepository,
-  BadRequestError,
-  AuthManager,
-  AsyncQueue,
+function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
+  return new QueueWorker(redisUrl, failedJobs);
+}
+// ../../src/core/queue/queueMetrics.ts
+var {RedisClient: RedisClient6 } = globalThis.Bun;
+async function readRedisQueueDepth(redisUrl) {
+  const client = new RedisClient6(redisUrl);
+  const [high, defaultQueue, low] = await Promise.all([
+    client.llen(QUEUE_HIGH_KEY),
+    client.llen(QUEUE_LIST_KEY),
+    client.llen(QUEUE_LOW_KEY)
+  ]);
+  return {
+    high: Number(high ?? 0),
+    default: Number(defaultQueue ?? 0),
+    low: Number(low ?? 0),
+    total: Number(high ?? 0) + Number(defaultQueue ?? 0) + Number(low ?? 0)
+  };
+}
+async function collectQueueMetrics() {
+  const driver = queueConfig.driver;
+  const failedJobs = createFailedJobService();
+  const failedCount = (await failedJobs.listRecent(1000)).length;
+  if (driver !== "redis") {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  const redisUrl = process.env.REDIS_URL;
+  if (!redisUrl) {
+    return {
+      driver,
+      pending: {
+        high: 0,
+        default: 0,
+        low: 0,
+        total: 0
+      },
+      failedCount
+    };
+  }
+  return {
+    driver,
+    pending: await readRedisQueueDepth(redisUrl),
+    failedCount
+  };
+}
+// ../../src/core/scheduler/schedule.ts
+class Schedule {
+  tasks = [];
+  command(expression, name, run) {
+    this.tasks.push({ expression, name, run });
+    return this;
+  }
+  dueTasks(now = new Date) {
+    const minute = now.getMinutes();
+    return this.tasks.filter((task) => {
+      if (task.expression === "* * * * *") {
+        return true;
+      }
+      if (task.expression.startsWith("*/")) {
+        const interval = Number.parseInt(task.expression.slice(2), 10);
+        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
+      }
+      return false;
+    });
+  }
+  tasksList() {
+    return [...this.tasks];
+  }
+}
+var appSchedule = new Schedule;
+async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
+  const due = schedule.dueTasks(now);
+  for (const task of due) {
+    await task.run();
+  }
+  return due.length;
+}
+// ../../src/core/security/publicReads.ts
+function isPublicReadsEnabled() {
+  return isFeatureEnabled("publicReads");
+}
+function guestCanViewResource() {
+  return isPublicReadsEnabled();
+}
+// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash } from "crypto";
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/tenant/tenantMiddleware.ts
+var DEFAULT_TENANT = {
+  id: 1,
+  slug: "default",
+  plan: "enterprise",
+  region: "eu"
+};
+async function resolveUserTenantId(userId) {
+  return await runWithMigrationBypass(async () => {
+    const rows = await repositoryConnection`
+      SELECT tenant_id
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `;
+    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
+  });
+}
+function auditChecksum(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+async function resolveTenantForRequest(request) {
+  const user = currentAuthUser();
+  const headerValue = request.headers.get("x-tenant-id")?.trim();
+  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
+  if (user) {
+    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
+    if (Number.isInteger(userId) && userId > 0) {
+      const userTenantId = await resolveUserTenantId(userId);
+      if (!isGlobalAdmin(user)) {
+        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
+          throw new ForbiddenError("Tenant header does not match your account.");
+        }
+        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+      }
+      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
+        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
+      }
+      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
+    }
+  }
+  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
+  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
+}
+function createTenantMiddleware() {
+  return async (request, next) => {
+    const pathname = new URL(request.url).pathname;
+    if (pathname.startsWith("/scim/")) {
+      return await next();
+    }
+    try {
+      const tenant = await resolveTenantForRequest(request);
+      return await runWithTenantDatabase(tenant, async () => {
+        const response = await next();
+        const headers = new Headers(response.headers);
+        headers.set("x-tenant-id", String(tenant.id));
+        headers.set("x-tenant-region", tenant.region);
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers
+        });
+      });
+    } catch (error) {
+      if (error instanceof HttpError) {
+        return Response.json({ error: error.message }, { status: error.status });
+      }
+      throw error;
+    }
+  };
+}
+// ../../src/core/tracing/traceContext.ts
+var traceContextStorage = createAsyncContextStore("@getstrata/traceContext");
+function runWithTraceContext(context, callback) {
+  return traceContextStorage.run(context, callback);
+}
+function currentTraceId() {
+  return traceContextStorage.getStore()?.traceId ?? null;
+}
+// ../../src/core/tracing/otel.ts
+import { randomBytes } from "crypto";
+function randomHex(bytes) {
+  return randomBytes(bytes).toString("hex");
+}
+function createSpan(input) {
+  const spanId = randomHex(8);
+  return {
+    traceId: input.traceId,
+    spanId,
+    name: input.name,
+    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
+    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
+    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
+      key,
+      value: { stringValue: value }
+    })),
+    status: { code: 1 }
+  };
+}
+async function exportOtelSpan(span) {
+  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!endpoint) {
+    return;
+  }
+  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
+  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
+  await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      resourceSpans: [
+        {
+          resource: {
+            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
+          },
+          scopeSpans: [{ spans: [span] }]
+        }
+      ]
+    })
+  });
+}
+
+// ../../src/core/tracing/tracingMiddleware.ts
+function createTracingMiddleware() {
+  return async (request, next) => {
+    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
+    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+    const startedAt = performance.now();
+    const path = new URL(request.url).pathname;
+    return await runWithTraceContext({ traceId, spanId }, async () => {
+      const response = await next();
+      const endedAt = performance.now();
+      const headers = new Headers(response.headers);
+      headers.set("x-trace-id", traceId);
+      headers.set("x-span-id", spanId);
+      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
+      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
+      exportOtelSpan(createSpan({
+        traceId,
+        name: `${request.method} ${path}`,
+        startedAt,
+        endedAt,
+        attributes: {
+          "http.method": request.method,
+          "http.route": path,
+          "http.status_code": String(response.status)
+        }
+      })).catch(() => {
+        return;
+      });
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
+// ../../src/core/validation/rules.ts
+function required() {
+  return (field, value) => {
+    if (value === undefined || value === null || typeof value === "string" && value.trim() === "") {
+      return `"${field}" is required.`;
+    }
+    return;
+  };
+}
+function stringRule() {
+  return (field, value) => {
+    if (value === undefined || value === null) {
+      return;
+    }
+    if (typeof value !== "string") {
+      return `"${field}" must be a string.`;
+    }
+    return;
+  };
+}
+function minLength(minimum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length < minimum) {
+      return `"${field}" must be at least ${minimum} characters.`;
+    }
+    return;
+  };
+}
+function maxLength(maximum) {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    if (value.trim().length > maximum) {
+      return `"${field}" must be at most ${maximum} characters.`;
+    }
+    return;
+  };
+}
+function emailRule() {
+  return (field, value) => {
+    if (typeof value !== "string") {
+      return;
+    }
+    const normalized = value.trim();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
+      return `"${field}" must be a valid email address.`;
+    }
+    return;
+  };
+}
+function validateObject(payload, schema) {
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new ValidationError("Request body must be a JSON object.");
+  }
+  const body = payload;
+  const errors = {};
+  const output = {};
+  for (const [field, rules] of Object.entries(schema)) {
+    const messages = rules.map((rule) => rule(field, body[field], body)).filter((message) => message !== undefined);
+    if (messages.length > 0) {
+      errors[field] = messages;
+      continue;
+    }
+    if (field in body && body[field] !== undefined) {
+      const rawValue = body[field];
+      output[field] = typeof rawValue === "string" ? rawValue.trim() : rawValue;
+    }
+  }
+  if (Object.keys(errors).length > 0) {
+    throw new ValidationError("The given data was invalid.", errors);
+  }
+  return output;
+}
+export {
+  AdminResourceRegistry,
   ApiTokenGuard,
-  AdminResourceRegistry
+  AsyncQueue,
+  AuthManager,
+  BadRequestError,
+  baseRepository_default as BaseRepository,
+  Blueprint,
+  CACHE_TAGS,
+  repository_default2 as CacheRepository,
+  ColumnDefinition,
+  CompositeGuard,
+  ConfigStore,
+  ConflictError,
+  DEFAULT_TENANT,
+  DEFAULT_VIEWS_DIRECTORY,
+  DatabaseTokenGuard,
+  EtaViewEngine,
+  EventBus,
+  failedJobRepository_default as FailedJobRepository,
+  failedJobService_default as FailedJobService,
+  ForbiddenError,
+  ForeignIdColumnDefinition,
+  FormRequest,
+  GuestGuard,
+  HttpError,
+  Job,
+  LocalStorageDriver,
+  LogMailDriver,
+  Mailer,
+  membershipService_default as MembershipService,
+  Model,
+  MySqlGrammar,
+  NotFoundError,
+  Notification,
+  NotificationDispatcher,
+  PayloadTooLargeError,
+  Policy,
+  PolicyGate,
+  PostgresGrammar,
+  PreconditionFailedError,
+  PrometheusRegistry,
+  QueueWorker,
+  RedisQueue,
+  RepositoryQuery,
+  ResilientQueue,
+  Schedule,
+  Schema,
+  ServiceContainer,
+  SqliteGrammar,
+  StorageManager,
+  SyncQueue,
+  UnauthorizedError,
+  UnprocessableEntityError,
+  UnsupportedSchemaFeatureError,
+  ValidationError,
+  WebFormRequest,
+  WhereBuilder,
+  appSchedule,
+  appendOrganizationScope,
+  appendProjectScope,
+  applyCasts,
+  applyConditionalGet,
+  applyMiddlewareToRoutes,
+  assertIfMatch,
+  assertOrganizationReadable,
+  assertResourceInCurrentTenant,
+  auditChecksum,
+  auth,
+  authContext,
+  belongsTo,
+  belongsToMany,
+  bindDatabaseConnection2 as bindDatabaseConnection,
+  bindRouteModel,
+  buildMarkdownMailMessage,
+  buildRequestCacheKey,
+  buildSmtpPayload,
+  cache,
+  collectQueueMetrics,
+  compileBlueprint,
+  composeMiddleware,
+  conditionalJsonResponse,
+  config,
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCacheStore,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createCsrfProtection,
+  createCsrfTokenCookie,
+  createDatabaseConnection2 as createDatabaseConnection,
+  createDatabaseQueryProxy,
+  createFailedJobService,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createNotificationDispatcher,
+  createProductionQueue,
+  createQueue,
+  createQueueWorker,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSchemaBuilder,
+  createScimAuthMiddleware,
+  createScimThrottleMiddleware,
+  createSecurityHeadersMiddleware,
+  createStorageDriver,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  createTrackedJob,
+  createdResponse,
+  currentAuthUser,
+  currentOrgRole,
+  currentOrganizationIds,
+  currentRequestMeta,
+  currentTenant,
+  currentTenantId,
+  currentTraceId,
+  defineTable,
+  dehydrateValue,
+  emailRule,
+  emptyPaginateResult,
+  etagFromResource,
+  eventBus,
+  events,
+  filterMassAssignable,
+  formatAdminValue,
+  freshDatabase,
+  getActiveDatabaseConnection,
+  getDefaultDatabasePool,
+  getDefaultDatabaseQuery,
+  getMigrationStatus,
+  grammarForDriver,
+  guestCanViewResource,
+  hasMany,
+  hasMinimumOrgRole2 as hasMinimumOrgRole,
+  hasOne,
+  hasOrgMembership,
+  htmlResponse,
+  hydrateValue,
+  indexBelongsToManyRelation,
+  indexBelongsToRelation,
+  indexHasManyRelation,
+  indexHasOneRelation,
+  indexMorphManyRelation,
+  indexMorphOneRelation,
+  indexMorphToRelation,
+  inferReferencedTable,
+  installGracefulShutdownSignals,
+  isEtagEnabled,
+  isGlobalAdmin,
+  isHtmxRequest,
+  isInsideTenantDatabaseScope,
+  isPublicReadsEnabled,
+  jobRegistry,
+  jsonResponse2 as jsonResponse,
+  loadMigrationsFromDirectory,
+  loadSeedersFromDirectory,
+  log,
+  logSecurityEvent,
+  mail,
+  mailer,
+  markdownToHtml,
+  maxLength,
+  migrateDatabase,
+  minLength,
+  modelEventName,
+  morphMany,
+  morphOne,
+  morphTo,
+  noContentResponse,
+  normalizeMetricPath,
+  paginatedResponse,
+  parseMultipartUpload,
+  parsePaginationQuery,
+  parsePositiveIntParam,
+  policyGate,
+  prometheusRegistry,
+  queue,
+  rateLimitMultiplierForPlan,
+  readBunRequestCookie,
+  readRequestCookie,
+  readSubmittedCsrfToken,
+  readSubmittedCsrfTokenFromBody,
+  registerDefaultDatabasePool,
+  registerModelRepository,
+  registerShutdownHandler,
+  renderMarkdownMail,
+  repositoryConnection,
+  requestIdMiddleware,
+  required,
+  resetDefaultStorage,
+  resolveApplicationAuth,
+  resolveApplicationCache,
+  resolveApplicationConfig,
+  resolveApplicationDependencies,
+  resolveApplicationEventBus,
+  resolveApplicationLogger,
+  resolveApplicationPolicyGate,
+  resolveApplicationQueue,
+  resolveCsrfToken,
+  resolveCsrfTokenForRequest,
+  resolveDatabaseDriver,
+  resolveMembershipService,
+  resolveOrganizationScope,
+  resolveRepositoryConnection,
+  resolveService,
+  resolveUserId,
+  resolveUserTenantId,
+  resolveWebLayoutData,
+  rollbackDatabase,
+  runDueScheduledTasks,
+  runGracefulShutdown,
+  runInTransaction,
+  runQueueJob,
+  runSeedersFromDirectory,
+  runWithAuthUser,
+  runWithDatabaseConnection,
+  runWithRequestMeta,
+  runWithTenant,
+  runWithTenantDatabase,
+  runWithTraceContext,
+  scopedOrganizationIds,
+  securedBindRouteModel,
+  securedBindRouteModelByKey,
+  sendMarkdownMail,
+  serializeDate,
+  setActiveApplicationContext,
+  storageFacade as storage,
+  stringRule,
+  stripMarkdown,
+  toPaginatedResourceCollection,
+  toResourceCollection,
+  validateObject,
+  verifyCsrfToken,
+  withErrorHandling,
+  withMiddleware,
+  withMigrationLock,
+  wrapMarkdownMailLayout,
+  wrapRouteHandler
 };