@getstrata/core 0.5.60 → 0.5.62

package/dist/index.js

@@ -4306,6 +4306,133 @@ function conditionalJsonResponse(request, data, init = {}) {
     headers
   });
 }
+// ../../src/core/http/contentSecurityPolicy.ts
+var HTMX_2_0_4_INDICATOR_STYLE_HASH = "'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='";
+var API_DIRECTIVES = {
+  "default-src": ["'none'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'none'"]
+};
+var HTMX_HTML_DIRECTIVES = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'", "https://unpkg.com"],
+  "style-src": ["'self'", HTMX_2_0_4_INDICATOR_STYLE_HASH],
+  "connect-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'"],
+  "media-src": ["'self'", "https:"],
+  "frame-src": [
+    "https://www.youtube.com",
+    "https://www.youtube-nocookie.com",
+    "https://player.vimeo.com"
+  ],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"]
+};
+var SPA_HTML_DIRECTIVES = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'"],
+  "connect-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"]
+};
+var configuredHtmlOptions = {};
+function generateCspNonce() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Buffer.from(bytes).toString("base64");
+}
+function configureContentSecurityPolicy(options) {
+  configuredHtmlOptions = { ...options };
+}
+function cloneDirectives(source) {
+  const copy = {};
+  for (const [directive, values] of Object.entries(source)) {
+    copy[directive] = [...values];
+  }
+  return copy;
+}
+function normalizeSources(value) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => item.split(/\s+/).filter(Boolean));
+  }
+  return value.split(/\s+/).filter(Boolean);
+}
+function mergeDirectives(base, extra) {
+  const merged = cloneDirectives(base);
+  for (const [directive, value] of Object.entries(extra ?? {})) {
+    if (value === false) {
+      delete merged[directive];
+      continue;
+    }
+    const sources = normalizeSources(value);
+    const existing = merged[directive] ?? [];
+    merged[directive] = [...existing, ...sources.filter((source) => !existing.includes(source))];
+  }
+  return merged;
+}
+function serializeDirectives(directives) {
+  return Object.entries(directives).map(([directive, values]) => values.length > 0 ? `${directive} ${values.join(" ")}` : directive).join("; ");
+}
+function applyNonce(directives, nonce) {
+  if (!nonce) {
+    return directives;
+  }
+  const token = `'nonce-${nonce}'`;
+  const next = cloneDirectives(directives);
+  for (const directive of ["script-src", "style-src"]) {
+    const values = next[directive] ?? ["'self'"];
+    if (!values.includes(token)) {
+      next[directive] = [...values, token];
+    }
+  }
+  return next;
+}
+function htmlBaselineDirectives() {
+  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx") {
+    return cloneDirectives(HTMX_HTML_DIRECTIVES);
+  }
+  if (frontendMode === "spa-react") {
+    return cloneDirectives(SPA_HTML_DIRECTIVES);
+  }
+  return cloneDirectives(API_DIRECTIVES);
+}
+function strictApiContentSecurityPolicy() {
+  return serializeDirectives(API_DIRECTIVES);
+}
+function serverHtmxContentSecurityPolicy(nonce) {
+  return serializeDirectives(applyNonce(cloneDirectives(HTMX_HTML_DIRECTIVES), nonce));
+}
+function spaContentSecurityPolicy(nonce) {
+  return serializeDirectives(applyNonce(cloneDirectives(SPA_HTML_DIRECTIVES), nonce));
+}
+function resolveHtmlContentSecurityPolicy(options = {}) {
+  const resolved = {
+    ...configuredHtmlOptions,
+    ...options,
+    directives: {
+      ...configuredHtmlOptions.directives,
+      ...options.directives
+    }
+  };
+  const override = resolved.htmlCsp ?? resolved.csp;
+  if (override) {
+    return override;
+  }
+  return serializeDirectives(applyNonce(mergeDirectives(htmlBaselineDirectives(), resolved.directives), options.nonce));
+}
+function resolveContentSecurityPolicy(response, options = {}) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
+  }
+  return resolveHtmlContentSecurityPolicy(options);
+}
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -4906,219 +5033,6 @@ function isViewsEnabled() {
   return readFrontendMode() === "server-htmx";
 }
 
-// ../../src/core/view/etaViewEngine.ts
-import { join as join4, relative } from "path";
-import { Eta } from "eta";
-
-// ../../src/core/view/assertEtaHtmlSource.ts
-var HTML_TAGS = new Set([
-  "a",
-  "abbr",
-  "address",
-  "article",
-  "aside",
-  "audio",
-  "b",
-  "blockquote",
-  "body",
-  "button",
-  "canvas",
-  "caption",
-  "cite",
-  "code",
-  "col",
-  "colgroup",
-  "data",
-  "datalist",
-  "dd",
-  "del",
-  "details",
-  "dfn",
-  "dialog",
-  "div",
-  "dl",
-  "dt",
-  "em",
-  "fieldset",
-  "figcaption",
-  "figure",
-  "footer",
-  "form",
-  "h1",
-  "h2",
-  "h3",
-  "h4",
-  "h5",
-  "h6",
-  "header",
-  "hgroup",
-  "hr",
-  "html",
-  "i",
-  "iframe",
-  "img",
-  "input",
-  "ins",
-  "kbd",
-  "label",
-  "legend",
-  "li",
-  "main",
-  "map",
-  "mark",
-  "menu",
-  "meter",
-  "nav",
-  "object",
-  "ol",
-  "optgroup",
-  "option",
-  "output",
-  "p",
-  "picture",
-  "pre",
-  "progress",
-  "q",
-  "rp",
-  "rt",
-  "ruby",
-  "s",
-  "samp",
-  "script",
-  "search",
-  "section",
-  "select",
-  "slot",
-  "small",
-  "source",
-  "span",
-  "strong",
-  "style",
-  "sub",
-  "summary",
-  "sup",
-  "table",
-  "tbody",
-  "td",
-  "template",
-  "textarea",
-  "tfoot",
-  "th",
-  "thead",
-  "time",
-  "title",
-  "tr",
-  "track",
-  "u",
-  "ul",
-  "var",
-  "video",
-  "wbr"
-]);
-var TAG_PATTERN = "([a-z][a-z0-9]*)";
-var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
-var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
-var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
-var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
-function htmlTagName(match) {
-  const tag = match?.[1];
-  return tag && HTML_TAGS.has(tag) ? tag : undefined;
-}
-function describePugLikeLine(line) {
-  if (/^\|(?:\s|$)/.test(line)) {
-    return "piped text";
-  }
-  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
-    return "class/id shorthand";
-  }
-  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
-    return "attribute shorthand";
-  }
-  if (htmlTagName(line.match(TAG_SHORTHAND))) {
-    return "tag shorthand";
-  }
-  return;
-}
-function updateSkipBlock(lower, skipBlock) {
-  if (skipBlock) {
-    if (skipBlock === "comment" && lower.includes("-->")) {
-      return null;
-    }
-    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
-      return null;
-    }
-    return skipBlock;
-  }
-  if (lower.startsWith("<!--") && !lower.includes("-->")) {
-    return "comment";
-  }
-  if (lower.startsWith("<script") && !lower.includes("</script")) {
-    return "script";
-  }
-  if (lower.startsWith("<style") && !lower.includes("</style")) {
-    return "style";
-  }
-  return null;
-}
-function assertEtaHtmlSource(templateName, source) {
-  let skipBlock = null;
-  for (const rawLine of source.split(/\r?\n/)) {
-    const trimmed = rawLine.trim();
-    if (!trimmed) {
-      continue;
-    }
-    const lower = trimmed.toLowerCase();
-    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
-    if (skipBlock || nextSkipBlock) {
-      skipBlock = nextSkipBlock;
-      continue;
-    }
-    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
-      continue;
-    }
-    const kind = describePugLikeLine(trimmed);
-    if (kind) {
-      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
-    }
-  }
-}
-
-// ../../src/core/view/etaViewEngine.ts
-var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-    const readFile2 = this.eta.readFile?.bind(this.eta);
-    this.eta.readFile = (path) => {
-      const source = readFile2 ? readFile2(path) : "";
-      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
-      return source;
-    };
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
 // ../../src/core/view/htmlResponse.ts
 function withCharset(contentType) {
   return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
@@ -5143,9 +5057,6 @@ function redirectResponse(location, status = 302) {
     }
   });
 }
-function notFoundHtmlResponse(body = "Not Found") {
-  return htmlResponse(body, { status: 404 });
-}
 function textResponse(body, init = {}) {
   return new Response(body, {
     status: init.status ?? 200,
@@ -5165,57 +5076,82 @@ function xmlResponse(body, init = {}) {
 function rssResponse(body, init = {}) {
   return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
 }
-// ../../src/core/view/webLayoutData.ts
-var configuredLayoutOptions = {};
-function configureWebLayoutData(options) {
-  configuredLayoutOptions = { ...options };
+
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
 }
-function layoutUserKey(options) {
-  return options.userKey ?? "authUser";
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
 }
-async function defaultLoadLayoutUser(container, _request) {
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return null;
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
   }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return null;
+  if (status === 403) {
+    return "errors/forbidden";
   }
-  const directory = resolveAuthUserDirectory(container);
-  if (!directory) {
-    return {
-      id: userId,
-      email: "",
-      role: authUser.role ?? "member"
-    };
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
   }
   try {
-    const user = await directory.findByIdOrThrow(userId);
-    return {
-      id: userId,
-      email: user.email ?? "",
-      role: authUser.role ?? user.role ?? "member"
-    };
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
   } catch {
-    return null;
+    return renderKernelErrorChrome(input);
   }
 }
-async function resolveWebLayoutData(container, request, options = {}) {
-  const resolved = { ...configuredLayoutOptions, ...options };
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const userKey = layoutUserKey(resolved);
-  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
-  const user = await loadUser(container, request);
-  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
-  return {
-    [userKey]: user,
-    csrfToken,
-    flash,
-    ...extra
-  };
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+}
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    return htmlResponse(body, { status: 404 });
+  }
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
+  });
 }
+
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {
@@ -5239,6 +5175,39 @@ function requestPrefersJson(request) {
   return pathname.startsWith("/api/");
 }
 
+// ../../src/core/http/safeInternalPath.ts
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  if (looksLikeExternalTarget(raw)) {
+    return fallback;
+  }
+  return raw;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/http/webErrorResponse.ts
 function normalizeFieldErrors(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)) {
@@ -5256,23 +5225,37 @@ function normalizeFieldErrors(details) {
   }
   return errors;
 }
-function webErrorResponse(error, request) {
+function errorPageTitle(status, message) {
+  if (status === 404) {
+    return "Not Found";
+  }
+  if (status === 403) {
+    return "Forbidden";
+  }
+  if (status >= 500) {
+    return "Server Error";
+  }
+  return message;
+}
+function publicErrorMessage(status, message) {
+  if (status >= 500 && false) {}
+  return message;
+}
+async function webErrorResponse(error, request) {
   if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = error instanceof HttpError ? error : mapDatabaseError(error);
   if (mappedError instanceof UnauthorizedError) {
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  }
-  if (mappedError instanceof ValidationError) {
-    const errors = normalizeFieldErrors(mappedError.details);
-    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
-`);
-    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
-  }
-  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
-    status: mappedError.status
+    return Response.redirect(loginRedirectLocation(request), 302);
+  }
+  const errors = mappedError instanceof ValidationError ? normalizeFieldErrors(mappedError.details) : undefined;
+  return htmlErrorResponse({
+    status: mappedError.status,
+    title: errorPageTitle(mappedError.status, mappedError.message),
+    message: publicErrorMessage(mappedError.status, mappedError.message),
+    errors,
+    request
   });
 }
 
@@ -5302,7 +5285,7 @@ function withErrorHandling(handler) {
       return await handler(...args);
     } catch (error) {
       const request = args.find((arg) => arg instanceof Request);
-      const webResponse = webErrorResponse(error, request);
+      const webResponse = await webErrorResponse(error, request);
       if (webResponse) {
         return webResponse;
       }
@@ -5329,10 +5312,32 @@ function bindRouteModel(param, resolver, handler) {
 function isMutatingPolicyAction(action) {
   return action === "update" || action === "delete";
 }
+function modelHasIdentity(model) {
+  return !!model && typeof model === "object" && "id" in model && model.id !== undefined && model.id !== null;
+}
+function shouldApplyViewEtag(response, model, authorization) {
+  if (authorization.etag === false) {
+    return false;
+  }
+  if (authorization.etag === true) {
+    return true;
+  }
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("text/html")) {
+    return false;
+  }
+  return modelHasIdentity(model);
+}
+function requireResolvedModel(model) {
+  if (model == null) {
+    throw new NotFoundError;
+  }
+  return model;
+}
 function securedBindRouteModel(param, resolver, authorization, handler) {
   return async (request) => {
     const id = parsePositiveIntParam(String(request.params[param]), String(param));
-    const model = await resolver(id, request);
+    const model = requireResolvedModel(await resolver(id, request));
     const gate = resolveApplicationPolicyGate();
     const auth2 = resolveApplicationAuth();
     const user = currentAuthUser() ?? await auth2.resolve(request);
@@ -5343,7 +5348,7 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
       });
     }
     const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
+    if (isEtagEnabled() && authorization.action === "view" && shouldApplyViewEtag(response, model, authorization)) {
       return applyConditionalGet(request, response, etagFromResource(model));
     }
     return response;
@@ -5355,7 +5360,7 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     if (!key) {
       throw new BadRequestError(`Missing route parameter "${String(param)}".`);
     }
-    const model = await resolver(key, request);
+    const model = requireResolvedModel(await resolver(key, request));
     const gate = resolveApplicationPolicyGate();
     const auth2 = resolveApplicationAuth();
     const user = currentAuthUser() ?? await auth2.resolve(request);
@@ -5366,7 +5371,7 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
       });
     }
     const response = await handler(request, model);
-    if (isEtagEnabled() && authorization.action === "view") {
+    if (isEtagEnabled() && authorization.action === "view" && shouldApplyViewEtag(response, model, authorization)) {
       return applyConditionalGet(request, response, etagFromResource(model));
     }
     return response;
@@ -5535,12 +5540,15 @@ function createMetricsMiddleware() {
 // ../../src/core/http/requireAbilityMiddleware.ts
 function createRequireAbilityMiddleware(abilityChecker) {
   return (ability) => {
-    return async (_request, next) => {
+    return async (request, next) => {
       const user = currentAuthUser();
       try {
         abilityChecker.requireAbility(user, ability);
       } catch (error) {
         if (error instanceof ForbiddenError) {
+          if (isViewsEnabled() && !requestPrefersJson(request)) {
+            throw error;
+          }
           return Response.json({ error: error.message }, { status: error.status });
         }
         throw error;
@@ -5584,13 +5592,12 @@ function createRequireWebAuthMiddleware(auth2) {
   return async (request, next) => {
     const user = await auth2.resolve(request);
     if (user) {
-      return await next();
+      return await runWithAuthUser(user, () => next());
     }
     if (requestPrefersJson(request)) {
       throw new UnauthorizedError;
     }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
+    return Response.redirect(loginRedirectLocation(request), 302);
   };
 }
 // ../../src/core/http/scimThrottleMiddleware.ts
@@ -5636,76 +5643,127 @@ function createScimThrottleMiddleware(options) {
 }
 // ../../src/config/app.ts
 var appConfig = {
-  name: "WorkHub",
+  name: process.env.APP_NAME?.trim() || "WorkHub",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
+// ../../src/core/http/securityHeadersMiddleware.ts
+function createSecurityHeadersMiddleware(options = {}) {
+  return async (request, next) => {
+    const nonce = generateCspNonce();
+    const existing = currentRequestMeta();
+    return await runWithRequestMeta({
+      ...existing,
+      request: existing.request ?? request,
+      cspNonce: nonce
+    }, async () => {
+      const response = await next();
+      const headers = new Headers(response.headers);
+      headers.set("X-Content-Type-Options", "nosniff");
+      headers.set("X-Frame-Options", "DENY");
+      headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+      headers.set("X-XSS-Protection", "0");
+      headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response, { ...options, nonce }));
+      if (appConfig.env === "production") {
+        headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+      }
+      return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    });
+  };
+}
+// ../../src/core/http/signedUrl.ts
+import { createHmac as createHmac2 } from "crypto";
+function resolveSignedUrlSecret() {
+  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-signed-url-secret";
+}
+function resolveSignedUrlOrigin() {
+  return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
+}
+function normalizeSignedPath(path) {
+  const trimmed = path.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    throw new Error("Signed URLs must use a same-origin absolute path.");
   }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
+  if (trimmed.includes("://")) {
+    throw new Error("Signed URLs must use a same-origin absolute path.");
   }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
+  return trimmed;
+}
+function sortedQueryString(params) {
+  const entries = [...params.entries()].filter(([key]) => key !== "signature").sort(([left], [right]) => left.localeCompare(right));
+  return new URLSearchParams(entries).toString();
+}
+function signCanonicalPayload(path, query) {
+  return createHmac2("sha256", resolveSignedUrlSecret()).update(`${path}
+${query}`).digest("hex");
+}
+function buildSignedSearchParams(path, query = {}, expiresAt) {
+  const params = new URLSearchParams;
+  for (const [key, value] of Object.entries(query)) {
+    if (key === "signature" || key === "expires") {
+      continue;
+    }
+    params.set(key, String(value));
+  }
+  if (expiresAt !== undefined) {
+    params.set("expires", String(expiresAt));
   }
-  return strictApiContentSecurityPolicy();
+  params.set("signature", signCanonicalPayload(path, sortedQueryString(params)));
+  return params;
 }
-
-// ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+function signedUrl(path, query = {}) {
+  const normalizedPath = normalizeSignedPath(path);
+  const params = buildSignedSearchParams(normalizedPath, query);
+  return `${normalizedPath}?${params.toString()}`;
+}
+function temporarySignedUrl(path, expiresInSeconds, query = {}) {
+  if (!Number.isInteger(expiresInSeconds) || expiresInSeconds <= 0) {
+    throw new Error("Signed URL expiry must be a positive integer number of seconds.");
+  }
+  const normalizedPath = normalizeSignedPath(path);
+  const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
+  const params = buildSignedSearchParams(normalizedPath, query, expiresAt);
+  return `${normalizedPath}?${params.toString()}`;
+}
+function absoluteTemporarySignedUrl(path, expiresInSeconds, query = {}, origin = resolveSignedUrlOrigin()) {
+  return `${origin.replace(/\/$/, "")}${temporarySignedUrl(path, expiresInSeconds, query)}`;
+}
+function readSignedRequestUrl(input) {
+  if (input instanceof URL) {
+    return input;
+  }
+  if (typeof input === "string") {
+    return new URL(input, resolveSignedUrlOrigin());
+  }
+  return new URL(input.url);
+}
+function hasValidSignature(input) {
+  const url = readSignedRequestUrl(input);
+  const signature = url.searchParams.get("signature");
+  if (!signature) {
+    return false;
+  }
+  const expires = url.searchParams.get("expires");
+  if (expires) {
+    const expiresAt = Number.parseInt(expires, 10);
+    if (!Number.isInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+      return false;
     }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
+  }
+  const expected = signCanonicalPayload(url.pathname, sortedQueryString(url.searchParams));
+  return timingSafeCompareString(signature, expected);
+}
+function assertValidSignature(input) {
+  if (!hasValidSignature(input)) {
+    throw new ForbiddenError("Invalid or expired signed URL.");
+  }
 }
 // ../../src/core/http/throttleMiddleware.ts
 var {RedisClient: RedisClient4 } = globalThis.Bun;
@@ -5825,6 +5883,7 @@ function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
     return await runWithRequestMeta({
+      ...currentRequestMeta(),
       ipAddress: readClientIp(request) ?? null,
       userAgent: request.headers.get("user-agent"),
       request
@@ -5844,8 +5903,65 @@ function createRequestLoggingMiddleware() {
     });
   };
 }
+// ../../src/core/mail/sanitizeMailHtml.ts
+var ALLOWED_TAGS = new Set([
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "ul"
+]);
+function escapeHtml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function decodeBasicEntities(value) {
+  return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function isSafeHref(value) {
+  return /^(https?:|mailto:)/i.test(value.trim());
+}
+function sanitizeAttributes(tagName, rawAttributes) {
+  if (tagName !== "a") {
+    return "";
+  }
+  const hrefMatch = rawAttributes.match(/\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/i);
+  const href = decodeBasicEntities(hrefMatch?.[2] ?? hrefMatch?.[3] ?? hrefMatch?.[4] ?? "");
+  if (!href || !isSafeHref(href)) {
+    return "";
+  }
+  return ` href="${escapeHtml2(href)}"`;
+}
+function sanitizeMailHtml(html) {
+  return html.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)>/g, (match, tagName, rawAttributes) => {
+    const name = tagName.toLowerCase();
+    if (!ALLOWED_TAGS.has(name)) {
+      return "";
+    }
+    if (match.startsWith("</")) {
+      return `</${name}>`;
+    }
+    if (match.endsWith("/>") || name === "br" || name === "hr") {
+      return `<${name}>`;
+    }
+    return `<${name}${sanitizeAttributes(name, rawAttributes)}>`;
+  });
+}
+
 // ../../src/core/mail/markdownMail.ts
-function escapeHtml(value) {
+function escapeHtml3(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 function stripMarkdown(markdown) {
@@ -5854,19 +5970,12 @@ function stripMarkdown(markdown) {
 `).trim();
 }
 function markdownToHtml(markdown) {
-  const escaped = markdown.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return escaped.replace(/^### (.+)$/gm, "<h3>$1</h3>").replace(/^## (.+)$/gm, "<h2>$1</h2>").replace(/^# (.+)$/gm, "<h1>$1</h1>").replace(/`([^`]+)`/g, "<code>$1</code>").replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>').replace(/^[-*]\s+(.+)$/gm, "<li>$1</li>").replace(/(<li>[\s\S]*?<\/li>\n?)+/g, (block) => `<ul>${block}</ul>`).replace(/```(\w+)?\n([\s\S]*?)```/g, "<pre><code>$2</code></pre>").split(/\n\n+/).map((block) => {
-    if (block.startsWith("<")) {
-      return block;
-    }
-    return `<p>${block.replace(/\n/g, " ")}</p>`;
-  }).join(`
-`);
+  return sanitizeMailHtml(Bun.markdown.html(markdown));
 }
 function wrapMarkdownMailLayout(bodyHtml, options = {}) {
-  const title = escapeHtml(options.title ?? "GetStrata");
-  const preview = escapeHtml(options.preview ?? "");
-  const footer = escapeHtml(options.footer ?? "Sent by GetStrata");
+  const title = escapeHtml3(options.title ?? "GetStrata");
+  const preview = escapeHtml3(options.preview ?? "");
+  const footer = escapeHtml3(options.footer ?? "Sent by GetStrata");
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -6689,6 +6798,272 @@ function validateObject(payload, schema) {
   }
   return output;
 }
+// ../../src/core/view/etaViewEngine.ts
+import { join as join4, relative } from "path";
+import { Eta } from "eta";
+
+// ../../src/core/view/assertEtaHtmlSource.ts
+var HTML_TAGS = new Set([
+  "a",
+  "abbr",
+  "address",
+  "article",
+  "aside",
+  "audio",
+  "b",
+  "blockquote",
+  "body",
+  "button",
+  "canvas",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "datalist",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "dialog",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "fieldset",
+  "figcaption",
+  "figure",
+  "footer",
+  "form",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "header",
+  "hgroup",
+  "hr",
+  "html",
+  "i",
+  "iframe",
+  "img",
+  "input",
+  "ins",
+  "kbd",
+  "label",
+  "legend",
+  "li",
+  "main",
+  "map",
+  "mark",
+  "menu",
+  "meter",
+  "nav",
+  "object",
+  "ol",
+  "optgroup",
+  "option",
+  "output",
+  "p",
+  "picture",
+  "pre",
+  "progress",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "script",
+  "search",
+  "section",
+  "select",
+  "slot",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "style",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "template",
+  "textarea",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "title",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "wbr"
+]);
+var TAG_PATTERN = "([a-z][a-z0-9]*)";
+var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
+var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
+var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
+var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
+function htmlTagName(match) {
+  const tag = match?.[1];
+  return tag && HTML_TAGS.has(tag) ? tag : undefined;
+}
+function describePugLikeLine(line) {
+  if (/^\|(?:\s|$)/.test(line)) {
+    return "piped text";
+  }
+  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
+    return "class/id shorthand";
+  }
+  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
+    return "attribute shorthand";
+  }
+  if (htmlTagName(line.match(TAG_SHORTHAND))) {
+    return "tag shorthand";
+  }
+  return;
+}
+function updateSkipBlock(lower, skipBlock) {
+  if (skipBlock) {
+    if (skipBlock === "comment" && lower.includes("-->")) {
+      return null;
+    }
+    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
+      return null;
+    }
+    return skipBlock;
+  }
+  if (lower.startsWith("<!--") && !lower.includes("-->")) {
+    return "comment";
+  }
+  if (lower.startsWith("<script") && !lower.includes("</script")) {
+    return "script";
+  }
+  if (lower.startsWith("<style") && !lower.includes("</style")) {
+    return "style";
+  }
+  return null;
+}
+function assertEtaHtmlSource(templateName, source) {
+  let skipBlock = null;
+  for (const rawLine of source.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const lower = trimmed.toLowerCase();
+    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
+    if (skipBlock || nextSkipBlock) {
+      skipBlock = nextSkipBlock;
+      continue;
+    }
+    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
+      continue;
+    }
+    const kind = describePugLikeLine(trimmed);
+    if (kind) {
+      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
+    }
+  }
+}
+
+// ../../src/core/view/etaViewEngine.ts
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+    const readFile2 = this.eta.readFile?.bind(this.eta);
+    this.eta.readFile = (path) => {
+      const source = readFile2 ? readFile2(path) : "";
+      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      return source;
+    };
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const request = options.request ?? currentRequestMeta().request;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData(request) : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
+// ../../src/core/view/webLayoutData.ts
+var configuredLayoutOptions = {};
+function configureWebLayoutData(options) {
+  configuredLayoutOptions = { ...options };
+}
+function layoutUserKey(options) {
+  return options.userKey ?? "authUser";
+}
+async function defaultLoadLayoutUser(container, _request) {
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return null;
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return null;
+  }
+  const directory = resolveAuthUserDirectory(container);
+  if (!directory) {
+    return {
+      id: userId,
+      email: "",
+      role: authUser.role ?? "member"
+    };
+  }
+  try {
+    const user = await directory.findByIdOrThrow(userId);
+    return {
+      id: userId,
+      email: user.email ?? "",
+      role: authUser.role ?? user.role ?? "member"
+    };
+  } catch {
+    return null;
+  }
+}
+async function resolveWebLayoutData(container, request, options = {}) {
+  const resolved = { ...configuredLayoutOptions, ...options };
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const userKey = layoutUserKey(resolved);
+  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
+  const user = await loadUser(container, request);
+  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
+  return {
+    [userKey]: user,
+    csrfToken,
+    flash,
+    cspNonce: currentRequestMeta().cspNonce ?? "",
+    ...extra
+  };
+}
 export {
   AdminResourceRegistry,
   ApiTokenGuard,
@@ -6747,6 +7122,7 @@ export {
   ValidationError,
   WebFormRequest,
   WhereBuilder,
+  absoluteTemporarySignedUrl,
   appSchedule,
   appendOrganizationScope,
   appendProjectScope,
@@ -6756,6 +7132,7 @@ export {
   assertIfMatch,
   assertOrganizationReadable,
   assertResourceInCurrentTenant,
+  assertValidSignature,
   auditChecksum,
   auth,
   authContext,
@@ -6773,7 +7150,9 @@ export {
   composeMiddleware,
   conditionalJsonResponse,
   config,
+  configureContentSecurityPolicy,
   configureMembershipLookup,
+  configureWebErrorView,
   configureWebLayoutData,
   createAuthMiddleware,
   createAuthorizeMiddleware,
@@ -6822,12 +7201,14 @@ export {
   dehydrateValue,
   emailRule,
   emptyPaginateResult,
+  errorTemplateName,
   etagFromResource,
   eventBus,
   events,
   filterMassAssignable,
   formatAdminValue,
   freshDatabase,
+  generateCspNonce,
   getActiveDatabaseConnection,
   getBoundDatabaseConnection,
   getDefaultDatabasePool,
@@ -6839,6 +7220,8 @@ export {
   hasMinimumOrgRole2 as hasMinimumOrgRole,
   hasOne,
   hasOrgMembership,
+  hasValidSignature,
+  htmlErrorResponse,
   htmlResponse,
   hydrateValue,
   indexBelongsToManyRelation,
@@ -6862,6 +7245,7 @@ export {
   loadSeedersFromDirectory,
   log,
   logSecurityEvent,
+  loginRedirectLocation,
   mail,
   mailer,
   markdownToHtml,
@@ -6893,6 +7277,7 @@ export {
   registerDefaultDatabasePool,
   registerModelRepository,
   registerShutdownHandler,
+  renderKernelErrorChrome,
   renderMarkdownMail,
   repositoryConnection,
   requestIdMiddleware,
@@ -6908,9 +7293,11 @@ export {
   resolveApplicationLogger,
   resolveApplicationPolicyGate,
   resolveApplicationQueue,
+  resolveContentSecurityPolicy,
   resolveCsrfToken,
   resolveCsrfTokenForRequest,
   resolveDatabaseDriver,
+  resolveHtmlContentSecurityPolicy,
   resolveMembershipService,
   resolveOrganizationScope,
   resolveRepositoryConnection,
@@ -6931,15 +7318,23 @@ export {
   runWithTenant,
   runWithTenantDatabase,
   runWithTraceContext,
+  safeInternalRedirectPath,
+  sanitizeInternalPath,
+  sanitizeMailHtml,
   scopedOrganizationIds,
   securedBindRouteModel,
   securedBindRouteModelByKey,
   sendMarkdownMail,
   serializeDate,
+  serverHtmxContentSecurityPolicy,
   setActiveApplicationContext,
+  signedUrl,
+  spaContentSecurityPolicy,
   storageFacade as storage,
+  strictApiContentSecurityPolicy,
   stringRule,
   stripMarkdown,
+  temporarySignedUrl,
   textResponse,
   toPaginatedResourceCollection,
   toResourceCollection,