@getstrata/core 2.2.41 → 2.2.42

package/dist/index.js

@@ -11545,98 +11545,32 @@ function mail() {
 function storageFacade() {
   return storage();
 }
-// ../../src/core/http/bodySizeLimitMiddleware.ts
-var guards = new WeakMap;
-function guardBody(request, maxBytes) {
-  const existing = guards.get(request);
-  if (existing && existing.maxBytes <= maxBytes)
-    return existing;
-  const state = { maxBytes, exceeded: false };
-  const body = request.body;
-  if (!body)
-    return state;
-  let consumed = 0;
-  const stream = body.pipeThrough(new TransformStream({
-    transform(chunk, controller) {
-      const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
-      consumed += bytes.byteLength;
-      if (consumed > maxBytes) {
-        state.exceeded = true;
-        throw new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-      }
-      controller.enqueue(bytes);
-    }
-  }));
-  const bounded = new Request(request, { body: stream });
-  const decorateClone = (clone) => {
-    for (const field of ["params", "cookies"]) {
-      if (field in request)
-        Object.defineProperty(clone, field, { value: Reflect.get(request, field) });
-    }
-    const nativeClone = () => Reflect.apply(Request.prototype.clone, clone, []);
-    Object.defineProperty(clone, "clone", {
-      value: () => decorateClone(nativeClone())
-    });
-    guards.set(clone, state);
-    return clone;
-  };
-  const descriptors = {
-    body: { configurable: true, get: () => bounded.body },
-    bodyUsed: { configurable: true, get: () => bounded.bodyUsed },
-    clone: {
-      configurable: true,
-      value: () => decorateClone(Reflect.apply(Request.prototype.clone, bounded, []))
-    }
-  };
-  for (const method of [
-    "text",
-    "json",
-    "formData",
-    "arrayBuffer",
-    "blob",
-    "bytes",
-    "textStream"
-  ]) {
-    descriptors[method] = { configurable: true, value: bounded[method].bind(bounded) };
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
   }
-  Object.defineProperties(request, descriptors);
-  guards.set(request, state);
-  return state;
+  return "api";
 }
-var DEFAULT_MAX_BODY_BYTES = 1048576;
-function resolveMaxBodyBytes() {
-  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  const parsed = Number(raw);
-  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  return parsed;
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
 }
-function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
-  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
-    throw new RangeError("Body limit must be a positive safe integer.");
-  return async (request, next) => {
-    const tooLarge = () => {
-      const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-      return Response.json({ error: error.message }, { status: error.status });
-    };
-    const length = Number(request.headers.get("content-length"));
-    if (Number.isFinite(length) && length > maxBytes)
-      return tooLarge();
-    const state = guardBody(request, maxBytes);
-    try {
-      const response = await next();
-      return state.exceeded ? tooLarge() : response;
-    } catch (error) {
-      if (state.exceeded || error instanceof PayloadTooLargeError)
-        return tooLarge();
-      throw error;
-    }
-  };
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
 }
+
 // ../../src/core/http/requestMetaContext.ts
 init_asyncContextStore();
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
@@ -11650,1428 +11584,1500 @@ function currentRequestMeta() {
   };
 }
 
-// ../../src/core/http/clientIp.ts
-function trustForwardedFor(env = process.env) {
-  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
-}
-function isPrivateAddress(address) {
-  const ip = address.replace(/^::ffff:/i, "");
-  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
-}
-function forwardedClientIp(request) {
-  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
-  for (let index = hops.length - 1;index >= 0; index -= 1) {
-    const hop = hops[index];
-    if (hop && !isPrivateAddress(hop)) {
-      return hop;
-    }
+// ../../src/core/http/safeInternalPath.ts
+var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
   }
-  if (hops.length > 0) {
-    return hops[hops.length - 1];
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
   }
-  return request.headers.get("x-real-ip")?.trim() || undefined;
-}
-function readClientIp(request, env = process.env) {
-  if (trustForwardedFor(env)) {
-    const forwarded = forwardedClientIp(request);
-    if (forwarded) {
-      return forwarded;
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
     }
+  } catch {
+    return true;
   }
-  return currentRequestMeta().ipAddress ?? undefined;
+  return false;
 }
-// ../../src/core/crypto/nonCryptographicHash.ts
-function nonCryptographicDigest(input) {
-  return Bun.hash(input).toString(16);
+function sanitizeNestedQuery(search) {
+  if (!search) {
+    return "";
+  }
+  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
+  const next = new URLSearchParams;
+  for (const [key, value] of params.entries()) {
+    if (NESTED_REDIRECT_KEYS.has(key)) {
+      const sanitized = sanitizeInternalPath(value, "/");
+      next.set(key, sanitized);
+      continue;
+    }
+    if (looksLikeExternalTarget(value) && value.includes("://")) {
+      continue;
+    }
+    next.set(key, value);
+  }
+  const serialized = next.toString();
+  return serialized ? `?${serialized}` : "";
 }
-
-// ../../src/core/http/etag.ts
-function isEtagEnabled() {
-  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+function sanitizeInternalPath(raw, fallback = "/") {
+  const trimmed = raw.trim();
+  if (looksLikeExternalTarget(trimmed)) {
+    return fallback;
+  }
+  const queryIndex = trimmed.indexOf("?");
+  const hashIndex = trimmed.indexOf("#");
+  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
+  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
+  if (looksLikeExternalTarget(pathname)) {
+    return fallback;
+  }
+  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
+  return `${pathname}${sanitizeNestedQuery(search)}`;
 }
-function formatWeakEtag(digest) {
-  return `W/"${digest}"`;
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
 }
-function computeEtagFromJson(data) {
-  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
-  return formatWeakEtag(digest);
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
 }
-function etagFromResource(resource) {
-  const version = resource.updated_at ?? resource.created_at ?? "";
-  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
-  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
-  return formatWeakEtag(digest);
+
+// ../../src/core/view/htmlResponse.ts
+function withCharset(contentType) {
+  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
 }
-function normalizeEtag(value) {
-  return value.trim();
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
 }
-function etagValuesMatch(left, right) {
-  return normalizeEtag(left) === normalizeEtag(right);
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
 }
-function parseEtagList(header) {
-  if (!header) {
-    return [];
+function redirectResponse(location, status = 302) {
+  if (!location.startsWith("/") || location.startsWith("//")) {
+    throw new Error("Redirect location must be an internal path.");
   }
-  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+  return new Response(null, {
+    status,
+    headers: {
+      Location: sanitizeInternalPath(location, "/")
+    }
+  });
 }
-function ifNoneMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-none-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
-    return true;
-  }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
 }
-function ifMatchSatisfied(request, etag) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    return false;
-  }
-  if (header.trim() === "*") {
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": withCharset(init.contentType ?? "application/xml")
+    }
+  });
+}
+function rssResponse(body, init = {}) {
+  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
+}
+
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function errorReturnPath(request) {
+  if (!request)
+    return "/";
+  try {
+    const current = new URL(request.url);
+    const previous = new URL(request.headers.get("referer") ?? "");
+    if (previous.origin !== current.origin || (request.method === "GET" || request.method === "HEAD") && previous.pathname === current.pathname)
+      return "/";
+    return sanitizeInternalPath(previous.pathname, "/");
+  } catch {
+    return "/";
+  }
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="${escapeHtml(errorReturnPath(input.request ?? currentRequestMeta().request))}">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
+  }
+  if (status === 403) {
+    return "errors/forbidden";
+  }
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
+  }
+  try {
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
+  } catch {
+    return renderKernelErrorChrome(input);
+  }
+}
+async function htmlErrorResponse(input) {
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
+}
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    const response = htmlResponse(body, { status: 404 });
+    response.headers.set("Cache-Control", "no-store");
+    return response;
+  }
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
+  });
+}
+
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
     return true;
   }
-  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  return false;
 }
-function assertIfMatch(request, etag, options = {}) {
-  const header = request.headers.get("if-match");
-  if (!header) {
-    if (options.required) {
-      throw new PreconditionFailedError("If-Match header is required.");
+
+// ../../src/core/http/webErrorResponse.ts
+function normalizeFieldErrors(details) {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return {};
+  }
+  const errors = {};
+  for (const [field, messages] of Object.entries(details)) {
+    if (Array.isArray(messages)) {
+      errors[field] = messages.map(String);
+      continue;
+    }
+    if (typeof messages === "string") {
+      errors[field] = [messages];
     }
-    return;
   }
-  if (!ifMatchSatisfied(request, etag)) {
-    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  return errors;
+}
+function errorPageTitle(status, message) {
+  if (status === 404) {
+    return "Not Found";
+  }
+  if (status === 403) {
+    return "Forbidden";
+  }
+  if (status >= 500) {
+    return "Server Error";
   }
+  return message;
 }
-function applyEtagHeaders(headers, etag) {
-  const next = new Headers(headers);
-  next.set("ETag", etag);
-  next.set("Cache-Control", "private, must-revalidate");
-  next.append("Vary", "Authorization");
-  next.append("Vary", "X-Tenant-Id");
-  return next;
+function publicErrorMessage(status, message) {
+  if (status >= 500 && isProductionEnv()) {
+    return "Something went wrong.";
+  }
+  return message;
 }
-function notModifiedResponse(etag) {
-  return new Response(null, {
-    status: 304,
-    headers: applyEtagHeaders(new Headers, etag)
+function logServerError(error, mappedError) {
+  if (mappedError.status < 500) {
+    return;
+  }
+  appLogger.error("Unhandled request error", {
+    status: mappedError.status,
+    error: error instanceof Error ? error.message : String(error),
+    stack: error instanceof Error ? error.stack : undefined
   });
 }
-function applyConditionalGet(request, response, etag) {
-  if (!isEtagEnabled()) {
-    return response;
+async function webErrorResponse(error, request) {
+  if (currentRequestMeta().errorFormat === "json" || !request || !isViewsEnabled() || requestPrefersJson(request)) {
+    return null;
   }
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
+  const mappedError = toHttpError(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
+  if (mappedError.status === 401) {
+    return Response.redirect(loginRedirectLocation(request), 302);
   }
-  const headers = applyEtagHeaders(new Headers(response.headers), etag);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
+  const errors = mappedError instanceof ValidationError || mappedError.name === "ValidationError" ? normalizeFieldErrors(mappedError.details) : undefined;
+  return htmlErrorResponse({
+    status: mappedError.status,
+    title: errorPageTitle(mappedError.status, mappedError.message),
+    message: publicErrorMessage(mappedError.status, mappedError.message),
+    errors,
+    request
   });
 }
 
-// ../../src/core/http/conditionalResponse.ts
+// ../../src/core/http/response.ts
+init_transactionControl();
 function jsonResponse(data, init = {}) {
   return Response.json(data, {
     status: init.status ?? 200,
     headers: init.headers
   });
 }
-function conditionalJsonResponse(request, data, init = {}) {
-  if (!request || !isEtagEnabled()) {
-    return jsonResponse(data, init);
-  }
-  const etag = computeEtagFromJson(data);
-  if (ifNoneMatchSatisfied(request, etag)) {
-    return notModifiedResponse(etag);
-  }
+function privateJsonResponse(data, init = {}) {
   const response = jsonResponse(data, init);
-  const headers = new Headers(response.headers);
-  headers.set("ETag", etag);
-  headers.set("Cache-Control", "private, must-revalidate");
-  headers.append("Vary", "Authorization");
-  headers.append("Vary", "X-Tenant-Id");
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
+  response.headers.set("Cache-Control", "private, no-store");
+  return response;
 }
-// ../../src/core/runtime/frontendMode.ts
-var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
-var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
-function parseFrontendMode(value) {
-  const mode = (value ?? "api").trim();
-  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
-    return mode;
-  }
-  return "api";
+function createdResponse(data, init = {}) {
+  return jsonResponse(data, { ...init, status: init.status ?? 201 });
 }
-function readFrontendMode() {
-  return parseFrontendMode(process.env.FRONTEND_MODE);
+function noContentResponse() {
+  return new Response(null, { status: 204 });
 }
-function isViewsMode(mode) {
-  return mode === "server-htmx" || mode === "hybrid";
+function errorResponse(error) {
+  const mappedError = toHttpError(error) ?? mapDatabaseError(error);
+  logServerError(error, mappedError);
+  return Response.json({
+    error: mappedError.message,
+    ...mappedError.details === undefined ? {} : { details: mappedError.details }
+  }, { status: mappedError.status, headers: { "Cache-Control": "no-store" } });
 }
-function isSpaMode(mode) {
-  return mode === "spa-react" || mode === "hybrid";
-}
-function isViewsEnabled() {
-  return isViewsMode(readFrontendMode());
-}
-function isSpaEnabled() {
-  return isSpaMode(readFrontendMode());
+function withErrorHandling(handler) {
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (error) {
+      requestTransactionRollback();
+      const request = args.find((arg) => arg instanceof Request);
+      const webResponse = await webErrorResponse(error, request);
+      if (webResponse) {
+        return webResponse;
+      }
+      return errorResponse(error);
+    }
+  };
 }
 
-// ../../src/core/http/contentSecurityPolicy.ts
-var HTMX_2_0_4_INDICATOR_STYLE_HASH = "'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='";
-var API_DIRECTIVES = {
-  "default-src": ["'none'"],
-  "frame-ancestors": ["'none'"],
-  "base-uri": ["'none'"]
-};
-var HTMX_HTML_DIRECTIVES = {
-  "default-src": ["'self'"],
-  "script-src": ["'self'"],
-  "style-src": ["'self'", HTMX_2_0_4_INDICATOR_STYLE_HASH],
-  "connect-src": ["'self'"],
-  "img-src": ["'self'", "data:", "https:"],
-  "font-src": ["'self'"],
-  "media-src": ["'self'", "https:"],
-  "frame-src": [
-    "https://www.youtube.com",
-    "https://www.youtube-nocookie.com",
-    "https://player.vimeo.com"
-  ],
-  "form-action": ["'self'"],
-  "frame-ancestors": ["'none'"],
-  "base-uri": ["'self'"]
-};
-var SPA_HTML_DIRECTIVES = {
-  "default-src": ["'self'"],
-  "script-src": ["'self'"],
-  "style-src": ["'self'"],
-  "connect-src": ["'self'"],
-  "img-src": ["'self'", "data:", "https:"],
-  "font-src": ["'self'"],
-  "frame-ancestors": ["'none'"],
-  "base-uri": ["'self'"]
-};
-var configuredHtmlOptions = {};
-function generateCspNonce() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return Buffer.from(bytes).toString("base64");
-}
-function configureContentSecurityPolicy(options) {
-  configuredHtmlOptions = { ...options };
-}
-function resetContentSecurityPolicyForTests() {
-  configuredHtmlOptions = {};
-}
-function cloneDirectives(source) {
-  const copy = {};
-  for (const [directive, values] of Object.entries(source)) {
-    copy[directive] = [...values];
-  }
-  return copy;
-}
-function normalizeSources(value) {
-  if (Array.isArray(value)) {
-    return value.flatMap((item) => item.split(/\s+/).filter(Boolean));
-  }
-  return value.split(/\s+/).filter(Boolean);
-}
-function mergeDirectives(base, extra) {
-  const merged = cloneDirectives(base);
-  for (const [directive, value] of Object.entries(extra ?? {})) {
-    if (value === false) {
-      delete merged[directive];
-      continue;
+// ../../src/core/http/bodySizeLimitMiddleware.ts
+var guards = new WeakMap;
+function guardBody(request, maxBytes) {
+  const existing = guards.get(request);
+  if (existing && existing.maxBytes <= maxBytes)
+    return existing;
+  const state = { maxBytes, exceeded: false };
+  const body = request.body;
+  if (!body)
+    return state;
+  let consumed = 0;
+  const stream = body.pipeThrough(new TransformStream({
+    transform(chunk, controller) {
+      const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+      consumed += bytes.byteLength;
+      if (consumed > maxBytes) {
+        state.exceeded = true;
+        throw new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+      }
+      controller.enqueue(bytes);
     }
-    const sources = normalizeSources(value);
-    const existing = merged[directive] ?? [];
-    merged[directive] = [...existing, ...sources.filter((source) => !existing.includes(source))];
-  }
-  return merged;
-}
-function serializeDirectives(directives) {
-  return Object.entries(directives).map(([directive, values]) => values.length > 0 ? `${directive} ${values.join(" ")}` : directive).join("; ");
-}
-function applyNonce(directives, nonce) {
-  if (!nonce) {
-    return directives;
-  }
-  const token = `'nonce-${nonce}'`;
-  const next = cloneDirectives(directives);
-  for (const directive of ["script-src", "style-src"]) {
-    const values = next[directive] ?? ["'self'"];
-    if (!values.includes(token)) {
-      next[directive] = [...values, token];
+  }));
+  const bounded = new Request(request, { body: stream });
+  const decorateClone = (clone) => {
+    for (const field of ["params", "cookies"]) {
+      if (field in request)
+        Object.defineProperty(clone, field, { value: Reflect.get(request, field) });
     }
+    const nativeClone = () => Reflect.apply(Request.prototype.clone, clone, []);
+    Object.defineProperty(clone, "clone", {
+      value: () => decorateClone(nativeClone())
+    });
+    guards.set(clone, state);
+    return clone;
+  };
+  const descriptors = {
+    body: { configurable: true, get: () => bounded.body },
+    bodyUsed: { configurable: true, get: () => bounded.bodyUsed },
+    clone: {
+      configurable: true,
+      value: () => decorateClone(Reflect.apply(Request.prototype.clone, bounded, []))
+    }
+  };
+  for (const method of [
+    "text",
+    "json",
+    "formData",
+    "arrayBuffer",
+    "blob",
+    "bytes",
+    "textStream"
+  ]) {
+    descriptors[method] = { configurable: true, value: bounded[method].bind(bounded) };
   }
-  return next;
+  Object.defineProperties(request, descriptors);
+  guards.set(request, state);
+  return state;
 }
-function htmlBaselineDirectives() {
-  if (isViewsEnabled()) {
-    return cloneDirectives(HTMX_HTML_DIRECTIVES);
+var DEFAULT_MAX_BODY_BYTES = 1048576;
+function resolveMaxBodyBytes() {
+  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_BODY_BYTES;
   }
-  if (isSpaEnabled()) {
-    return cloneDirectives(SPA_HTML_DIRECTIVES);
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_BODY_BYTES;
   }
-  return cloneDirectives(API_DIRECTIVES);
+  return parsed;
 }
-function strictApiContentSecurityPolicy() {
-  return serializeDirectives(API_DIRECTIVES);
+function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+    throw new RangeError("Body limit must be a positive safe integer.");
+  return async (request, next) => {
+    const tooLarge = () => {
+      const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
+      return errorResponse(error);
+    };
+    const length = Number(request.headers.get("content-length"));
+    if (Number.isFinite(length) && length > maxBytes)
+      return tooLarge();
+    const state = guardBody(request, maxBytes);
+    try {
+      const response = await next();
+      return state.exceeded ? tooLarge() : response;
+    } catch (error) {
+      if (state.exceeded || error instanceof PayloadTooLargeError)
+        return tooLarge();
+      throw error;
+    }
+  };
 }
-function serverHtmxContentSecurityPolicy(nonce) {
-  return serializeDirectives(applyNonce(cloneDirectives(HTMX_HTML_DIRECTIVES), nonce));
+// ../../src/core/http/clientIp.ts
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
 }
-function spaContentSecurityPolicy(nonce) {
-  return serializeDirectives(applyNonce(cloneDirectives(SPA_HTML_DIRECTIVES), nonce));
+function isPrivateAddress(address) {
+  const ip = address.replace(/^::ffff:/i, "");
+  return ip === "::1" || ip === "localhost" || /^127\./.test(ip) || /^10\./.test(ip) || /^192\.168\./.test(ip) || /^172\.(1[6-9]|2\d|3[01])\./.test(ip) || /^169\.254\./.test(ip) || /^f[cd][0-9a-f]{2}:/i.test(ip) || /^fe80:/i.test(ip);
 }
-function resolveHtmlContentSecurityPolicy(options = {}) {
-  const resolved = {
-    ...configuredHtmlOptions,
-    ...options,
-    directives: {
-      ...configuredHtmlOptions.directives,
-      ...options.directives
+function forwardedClientIp(request) {
+  const hops = (request.headers.get("x-forwarded-for") ?? "").split(",").map((hop) => hop.trim()).filter(Boolean);
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop && !isPrivateAddress(hop)) {
+      return hop;
     }
-  };
-  const override = resolved.htmlCsp ?? resolved.csp;
-  if (override) {
-    return override;
   }
-  return serializeDirectives(applyNonce(mergeDirectives(htmlBaselineDirectives(), resolved.directives), options.nonce));
-}
-function resolveContentSecurityPolicy(response, options = {}) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
+  if (hops.length > 0) {
+    return hops[hops.length - 1];
   }
-  return resolveHtmlContentSecurityPolicy(options);
+  return request.headers.get("x-real-ip")?.trim() || undefined;
 }
-// ../../src/core/http/corsMiddleware.ts
-function additionalHeaders(options) {
-  const configured = process.env.CORS_ADDITIONAL_ALLOWED_HEADERS?.trim();
-  const supplied = options.additionalAllowedHeaders === undefined ? [] : options.additionalAllowedHeaders;
-  if (!Array.isArray(supplied)) {
-    throw new TypeError("CORS additionalAllowedHeaders must be an array of header names.");
-  }
-  const names = [
-    ...configured ? configured.split(",").map((name) => name.trim()) : [],
-    ...supplied
-  ];
-  return names.map((name) => {
-    if (typeof name !== "string" || name === "*" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) {
-      throw new TypeError("CORS additional headers must be explicit valid HTTP header names; wildcards are not allowed.");
+function readClientIp(request, env = process.env) {
+  if (trustForwardedFor(env)) {
+    const forwarded = forwardedClientIp(request);
+    if (forwarded) {
+      return forwarded;
     }
-    return name;
-  });
+  }
+  return currentRequestMeta().ipAddress ?? undefined;
 }
-function defaultAllowedOrigins() {
-  return appUrl();
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
 }
-function resolveCorsConfig(options = {}) {
-  const extraHeaders = additionalHeaders(options);
-  return {
-    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
-    allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-    allowedHeaders: [
-      "Authorization",
-      "Content-Type",
-      "X-Request-Id",
-      "X-Tenant-Id",
-      "X-Authenticated-User-Id",
-      "X-Authenticated-User-Role",
-      "If-Match",
-      "If-None-Match",
-      "X-CSRF-Token",
-      ...extraHeaders
-    ].filter((name, index, names) => names.findIndex((other) => other.toLowerCase() === name.toLowerCase()) === index),
-    maxAgeSeconds: 86400
-  };
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
 }
-function createCorsMiddleware(options = {}) {
-  resolveCorsConfig(options);
-  const captured = {
-    additionalAllowedHeaders: [...options.additionalAllowedHeaders ?? []]
-  };
-  return async (request, next) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders(request, captured)
-      });
-    }
-    const response = await next();
-    const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request, captured)) {
-      if (key === "vary") {
-        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
-        if (fields.includes("*"))
-          continue;
-        if (!fields.some((field) => field.toLowerCase() === "origin"))
-          fields.push(value);
-        headers.set("Vary", fields.join(", "));
-      } else {
-        headers.set(key, value);
-      }
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
 }
-function buildCorsHeaders(request, options) {
-  const headers = new Headers;
-  const origin = request.headers.get("origin");
-  const corsConfig = resolveCorsConfig(options);
-  const allowedOrigins = corsConfig.allowedOrigins;
-  headers.set("Vary", "Origin");
-  const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;
-  if (!allowOrigin) {
-    return headers;
-  }
-  headers.set("Access-Control-Allow-Origin", allowOrigin);
-  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
-  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
-  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  if (allowOrigin !== "*") {
-    headers.set("Access-Control-Allow-Credentials", "true");
-  }
-  return headers;
+function computeEtagFromJson(data) {
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
+  return formatWeakEtag(digest);
 }
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual as timingSafeEqual3 } from "crypto";
-var CSRF_COOKIE = appCookieName("csrf");
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function csrfCookieName() {
-  return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
 }
-function resolveCsrfSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "CSRF_SECRET"], "csrf-secret");
+function normalizeEtag(value) {
+  return value.trim();
 }
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
 }
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
+function parseEtagList(header) {
+  if (!header) {
+    return [];
   }
-  return timingSafeEqual3(leftBuffer, rightBuffer);
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = isProductionEnv() ? "; Secure" : "";
-  return {
-    token,
-    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
-  };
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
 }
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, csrfCookieName());
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
   }
-  return createCsrfTokenCookie();
-}
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
+  if (header.trim() === "*") {
+    return true;
   }
-  return null;
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
   }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
+  if (header.trim() === "*") {
+    return true;
   }
-  return null;
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
 }
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, csrfCookieName());
-  if (!cookieValue) {
-    return false;
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
   }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
   }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
-  }
-  return resolveCsrfToken(request).token;
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
 }
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function samlAcsPathname() {
-  const configured = process.env.SAML_ACS_URL?.trim();
-  if (!configured) {
-    return "/auth/saml/acs";
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
   }
-  try {
-    return new URL(configured, "http://strata.invalid").pathname;
-  } catch {
-    return "/auth/saml/acs";
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
   }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
-function skipsCsrfPath(pathname) {
-  return pathname === samlAcsPathname() || pathname.startsWith("/scim/") || pathname.startsWith("/billing/webhooks/");
+
+// ../../src/core/http/conditionalResponse.ts
+function jsonResponse2(data, init = {}) {
+  return Response.json(data, {
+    status: init.status ?? 200,
+    headers: init.headers
+  });
 }
-function appendSetCookie(response, cookie) {
+function conditionalJsonResponse(request, data, init = {}) {
+  if (!request || !isEtagEnabled()) {
+    return jsonResponse2(data, init);
+  }
+  const etag = computeEtagFromJson(data);
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const response = jsonResponse2(data, init);
   const headers = new Headers(response.headers);
-  headers.append("set-cookie", cookie);
+  headers.set("ETag", etag);
+  headers.set("Cache-Control", "private, must-revalidate");
+  headers.append("Vary", "Authorization");
+  headers.append("Vary", "X-Tenant-Id");
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
     headers
   });
 }
-function createCsrfMiddleware() {
-  return async (request, next) => {
-    const credentialSource = currentCredentialSource();
-    if (credentialSource === "bearer" || credentialSource === "basic") {
-      return await next();
-    }
-    const pathname = new URL(request.url).pathname;
-    if (skipsCsrfPath(pathname)) {
-      return await next();
-    }
-    const method = request.method.toUpperCase();
-    if (!MUTATING_METHODS.has(method)) {
-      const meta = currentRequestMeta();
-      const csrf = meta.csrfToken ? { token: meta.csrfToken } : resolveCsrfToken(request);
-      meta.csrfToken = csrf.token;
-      const response = await next();
-      if (!csrf.cookie) {
-        return response;
-      }
-      return appendSetCookie(response, csrf.cookie);
-    }
-    const submitted = await readSubmittedCsrfTokenFromBody(request);
-    if (!verifyCsrfToken(request, submitted)) {
-      throw new ForbiddenError("Invalid or missing CSRF token.");
-    }
-    const originHeader = request.headers.get("origin");
-    let headerOrigin = null;
-    if (originHeader) {
-      try {
-        headerOrigin = new URL(originHeader).origin;
-      } catch {
-        headerOrigin = null;
-      }
-    }
-    if (!headerOrigin || headerOrigin !== new URL(request.url).origin) {
-      throw new ForbiddenError("Cross-site cookie requests are not allowed.");
-    }
-    return await next();
-  };
-}
-// ../../src/core/http/csrfProtection.ts
-var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
-function createCsrfProtection(secret, options = {}) {
-  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
-  const maxAge = options.maxAge ?? expiresIn;
-  return {
-    generate(_sessionKey) {
-      return Bun.CSRF.generate(secret, { expiresIn });
-    },
-    verify(token, _sessionKey) {
-      if (!token) {
-        return false;
-      }
-      return Bun.CSRF.verify(token, { secret, maxAge });
-    },
-    secret
-  };
+// ../../src/core/http/contentSecurityPolicy.ts
+var HTMX_2_0_4_INDICATOR_STYLE_HASH = "'sha256-bsV5JivYxvGywDAZ22EZJKBFip65Ng9xoJVLbBg7bdo='";
+var API_DIRECTIVES = {
+  "default-src": ["'none'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'none'"]
+};
+var HTMX_HTML_DIRECTIVES = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'", HTMX_2_0_4_INDICATOR_STYLE_HASH],
+  "connect-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'"],
+  "media-src": ["'self'", "https:"],
+  "frame-src": [
+    "https://www.youtube.com",
+    "https://www.youtube-nocookie.com",
+    "https://player.vimeo.com"
+  ],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"]
+};
+var SPA_HTML_DIRECTIVES = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'"],
+  "style-src": ["'self'"],
+  "connect-src": ["'self'"],
+  "img-src": ["'self'", "data:", "https:"],
+  "font-src": ["'self'"],
+  "frame-ancestors": ["'none'"],
+  "base-uri": ["'self'"]
+};
+var configuredHtmlOptions = {};
+function generateCspNonce() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Buffer.from(bytes).toString("base64");
 }
-// ../../src/core/http/flashSession.ts
-import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual4 } from "crypto";
-var FLASH_COOKIE = appCookieName("flash");
-var FLASH_TTL_MS = 60 * 1000;
-function flashCookieName() {
-  return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
+function configureContentSecurityPolicy(options) {
+  configuredHtmlOptions = { ...options };
 }
-function resolveFlashSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
+function resetContentSecurityPolicyForTests() {
+  configuredHtmlOptions = {};
 }
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac5("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
+function cloneDirectives(source) {
+  const copy = {};
+  for (const [directive, values] of Object.entries(source)) {
+    copy[directive] = [...values];
+  }
+  return copy;
 }
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
+function normalizeSources(value) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => item.split(/\s+/).filter(Boolean));
   }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === flashCookieName()) {
-      return decodeURIComponent(rest.join("="));
+  return value.split(/\s+/).filter(Boolean);
+}
+function mergeDirectives(base, extra) {
+  const merged = cloneDirectives(base);
+  for (const [directive, value] of Object.entries(extra ?? {})) {
+    if (value === false) {
+      delete merged[directive];
+      continue;
     }
+    const sources = normalizeSources(value);
+    const existing = merged[directive] ?? [];
+    merged[directive] = [...existing, ...sources.filter((source) => !existing.includes(source))];
   }
-  return null;
+  return merged;
 }
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
+function serializeDirectives(directives) {
+  return Object.entries(directives).map(([directive, values]) => values.length > 0 ? `${directive} ${values.join(" ")}` : directive).join("; ");
+}
+function applyNonce(directives, nonce) {
+  if (!nonce) {
+    return directives;
   }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
+  const token = `'nonce-${nonce}'`;
+  const next = cloneDirectives(directives);
+  for (const directive of ["script-src", "style-src"]) {
+    const values = next[directive] ?? ["'self'"];
+    if (!values.includes(token)) {
+      next[directive] = [...values, token];
+    }
   }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
+  return next;
+}
+function htmlBaselineDirectives() {
+  if (isViewsEnabled()) {
+    return cloneDirectives(HTMX_HTML_DIRECTIVES);
   }
-  if (!timingSafeEqual4(expectedBuffer, actualBuffer)) {
-    return null;
+  if (isSpaEnabled()) {
+    return cloneDirectives(SPA_HTML_DIRECTIVES);
   }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
+  return cloneDirectives(API_DIRECTIVES);
+}
+function strictApiContentSecurityPolicy() {
+  return serializeDirectives(API_DIRECTIVES);
+}
+function serverHtmxContentSecurityPolicy(nonce) {
+  return serializeDirectives(applyNonce(cloneDirectives(HTMX_HTML_DIRECTIVES), nonce));
+}
+function spaContentSecurityPolicy(nonce) {
+  return serializeDirectives(applyNonce(cloneDirectives(SPA_HTML_DIRECTIVES), nonce));
+}
+function resolveHtmlContentSecurityPolicy(options = {}) {
+  const resolved = {
+    ...configuredHtmlOptions,
+    ...options,
+    directives: {
+      ...configuredHtmlOptions.directives,
+      ...options.directives
     }
-    return parsed;
-  } catch {
-    return null;
+  };
+  const override = resolved.htmlCsp ?? resolved.csp;
+  if (override) {
+    return override;
   }
+  return serializeDirectives(applyNonce(mergeDirectives(htmlBaselineDirectives(), resolved.directives), options.nonce));
 }
-function clearFlashCookie() {
-  const secure = isProductionEnv() ? "; Secure" : "";
-  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
+function resolveContentSecurityPolicy(response, options = {}) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!contentType.includes("text/html")) {
+    return strictApiContentSecurityPolicy();
   }
-  return parseFlashCookie(cookieValue);
+  return resolveHtmlContentSecurityPolicy(options);
 }
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
+// ../../src/core/http/corsMiddleware.ts
+function additionalHeaders(options) {
+  const configured = process.env.CORS_ADDITIONAL_ALLOWED_HEADERS?.trim();
+  const supplied = options.additionalAllowedHeaders === undefined ? [] : options.additionalAllowedHeaders;
+  if (!Array.isArray(supplied)) {
+    throw new TypeError("CORS additionalAllowedHeaders must be an array of header names.");
+  }
+  const names = [
+    ...configured ? configured.split(",").map((name) => name.trim()) : [],
+    ...supplied
+  ];
+  return names.map((name) => {
+    if (typeof name !== "string" || name === "*" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) {
+      throw new TypeError("CORS additional headers must be explicit valid HTTP header names; wildcards are not allowed.");
+    }
+    return name;
   });
 }
-
-// ../../src/core/http/flashMiddleware.ts
-function createFlashMiddleware() {
+function defaultAllowedOrigins() {
+  return appUrl();
+}
+function resolveCorsConfig(options = {}) {
+  const extraHeaders = additionalHeaders(options);
+  return {
+    allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? defaultAllowedOrigins()).split(",").map((origin) => origin.trim()).filter(Boolean),
+    allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+    allowedHeaders: [
+      "Authorization",
+      "Content-Type",
+      "X-Request-Id",
+      "X-Tenant-Id",
+      "X-Authenticated-User-Id",
+      "X-Authenticated-User-Role",
+      "If-Match",
+      "If-None-Match",
+      "X-CSRF-Token",
+      ...extraHeaders
+    ].filter((name, index, names) => names.findIndex((other) => other.toLowerCase() === name.toLowerCase()) === index),
+    maxAgeSeconds: 86400
+  };
+}
+function createCorsMiddleware(options = {}) {
+  resolveCorsConfig(options);
+  const captured = {
+    additionalAllowedHeaders: [...options.additionalAllowedHeaders ?? []]
+  };
   return async (request, next) => {
-    const flash = pullFlash(request);
-    const meta = currentRequestMeta();
-    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
-      const response = await next();
-      if (flash) {
-        return withFlashClear(response);
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: buildCorsHeaders(request, captured)
+      });
+    }
+    const response = await next();
+    const headers = new Headers(response.headers);
+    for (const [key, value] of buildCorsHeaders(request, captured)) {
+      if (key === "vary") {
+        const fields = (headers.get("Vary") ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+        if (fields.includes("*"))
+          continue;
+        if (!fields.some((field) => field.toLowerCase() === "origin"))
+          fields.push(value);
+        headers.set("Vary", fields.join(", "));
+      } else {
+        headers.set(key, value);
       }
-      return response;
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
     });
   };
 }
-// ../../src/core/http/validation.ts
-init_tenantContext();
-function buildRequestCacheKey(fallbackPath, request) {
-  if (!request) {
-    return fallbackPath;
+function buildCorsHeaders(request, options) {
+  const headers = new Headers;
+  const origin = request.headers.get("origin");
+  const corsConfig = resolveCorsConfig(options);
+  const allowedOrigins = corsConfig.allowedOrigins;
+  headers.set("Vary", "Origin");
+  const allowOrigin = allowedOrigins.includes("*") ? "*" : origin && allowedOrigins.includes(origin) ? origin : null;
+  if (!allowOrigin) {
+    return headers;
   }
-  const url = new URL(request.url);
-  const user = currentAuthUser();
-  const authScope = user ? `u:${user.id}` : "guest";
-  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
-  return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
-}
-function getQueryParams(request) {
-  if (!request) {
-    return new URLSearchParams;
+  headers.set("Access-Control-Allow-Origin", allowOrigin);
+  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
+  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
+  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
+  if (allowOrigin !== "*") {
+    headers.set("Access-Control-Allow-Credentials", "true");
   }
-  return new URL(request.url).searchParams;
+  return headers;
 }
-function parseOptionalPositiveIntQueryParam(params, name) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    return;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
-  }
-  return parsed;
+// ../../src/core/http/csrfToken.ts
+import { timingSafeEqual as timingSafeEqual3 } from "crypto";
+var CSRF_COOKIE = appCookieName("csrf");
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function csrfCookieName() {
+  return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
-function parseOptionalBooleanQueryParam(params, name) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    return;
-  }
-  switch (value.toLowerCase()) {
-    case "true":
-    case "1":
-      return true;
-    case "false":
-    case "0":
-      return false;
-    default:
-      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
-  }
+function resolveCsrfSecret() {
+  return requireConfiguredSecret(["SESSION_SECRET", "CSRF_SECRET"], "csrf-secret");
 }
-function parseOptionalEnumQueryParam(params, name, allowedValues) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    return;
-  }
-  if (!allowedValues.includes(value)) {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
-  }
-  return value;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function expectObject(value, label = "request body") {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new BadRequestError(`${label} must be a JSON object.`);
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return value;
+  return timingSafeEqual3(leftBuffer, rightBuffer);
 }
-async function parseJsonBody(request, validator) {
-  let payload;
-  try {
-    payload = await request.json();
-  } catch {
-    throw new BadRequestError("Request body must be valid JSON.");
-  }
-  return validator(payload);
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return {
+    token,
+    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
+  };
 }
-function readRequiredString(payload, field, options = {}) {
-  const value = payload[field];
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new BadRequestError(`"${field}" is required and must be a string.`);
-  }
-  const trimmed = value.trim();
-  if (options.minLength !== undefined && trimmed.length < options.minLength) {
-    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
-  }
-  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
-    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
-  }
-  if (options.pattern && !options.pattern.test(trimmed)) {
-    throw new BadRequestError(`"${field}" has an invalid format.`);
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, csrfCookieName());
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
-  return trimmed;
+  return createCsrfTokenCookie();
 }
-function readOptionalString(payload, field, options = {}) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
+function readSubmittedCsrfToken(request) {
+  const headerToken = request.headers.get("x-csrf-token")?.trim();
+  if (headerToken) {
+    return headerToken;
   }
-  return readRequiredString(payload, field, options);
+  return null;
 }
-function readRequiredEnum(payload, field, allowedValues) {
-  const value = readRequiredString(payload, field);
-  if (!allowedValues.includes(value)) {
-    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+async function readSubmittedCsrfTokenFromBody(request) {
+  const headerToken = readSubmittedCsrfToken(request);
+  if (headerToken) {
+    return headerToken;
   }
-  return value;
-}
-function readOptionalEnum(payload, field, allowedValues) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    const formData = await request.clone().formData();
+    const field = formData.get("_token");
+    if (typeof field === "string" && field.trim().length > 0) {
+      return field.trim();
+    }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
-  return readRequiredEnum(payload, field, allowedValues);
+  return null;
 }
-function readRequiredPositiveInt(payload, field) {
-  const value = payload[field];
-  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
+function verifyCsrfToken(request, submittedToken) {
+  if (!submittedToken) {
+    return false;
   }
-  return value;
-}
-function readOptionalPositiveInt(payload, field) {
-  if (!(field in payload) || payload[field] === undefined) {
-    return;
+  const cookieValue = readRequestCookie(request, csrfCookieName());
+  if (!cookieValue) {
+    return false;
   }
-  return readRequiredPositiveInt(payload, field);
-}
-function parsePositiveIntParam(value, name = "id") {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  if (!tokensMatch(submittedToken, cookieValue)) {
+    return false;
   }
-  return parsed;
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
-
-// ../../src/core/http/formRequest.ts
-class FormRequest {
-  authorize(_request) {
-    return true;
-  }
-  async validate(request) {
-    if (!await this.authorize(request)) {
-      throw new ForbiddenError;
-    }
-    return await parseJsonBody(request, (payload) => this.parse(payload));
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
   }
+  return resolveCsrfToken(request).token;
 }
 
-class QueryFormRequest {
-  validate(request) {
-    return this.parseQuery(request);
+// ../../src/core/http/csrfMiddleware.ts
+var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function samlAcsPathname() {
+  const configured = process.env.SAML_ACS_URL?.trim();
+  if (!configured) {
+    return "/auth/saml/acs";
   }
-}
-// ../../src/core/http/authMiddleware.ts
-function createAuthMiddleware(auth) {
-  return async (request, next) => {
-    const resolved = typeof auth.resolveWithSource === "function" ? await auth.resolveWithSource(request) : { user: await auth.resolve(request), credentialSource: null };
-    return await runWithAuthContext(resolved.user, resolved.credentialSource, async () => {
-      return await next();
-    });
-  };
-}
-// ../../src/core/http/authorizeMiddleware.ts
-function createAuthorizeMiddleware(gate, auth, resource, action) {
-  return async (request, next) => {
-    const user = currentAuthUser() ?? await auth.resolve(request);
-    if (!gate.allows(resource, action, user)) {
-      const error = new ForbiddenError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-// ../../src/core/http/middleware.ts
-function isRouteHandler(value) {
-  return typeof value === "function";
-}
-function isMethodRouteMap(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
+  try {
+    return new URL(configured, "http://strata.invalid").pathname;
+  } catch {
+    return "/auth/saml/acs";
   }
-  const entries = Object.entries(value);
-  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
 }
-function composeMiddleware(...middleware) {
-  return (handler) => {
-    return async (request) => {
-      let index = 0;
-      const dispatch = async () => {
-        if (index >= middleware.length) {
-          return await handler(request);
-        }
-        const current = middleware[index];
-        index += 1;
-        if (!current) {
-          return await handler(request);
-        }
-        return await current(request, dispatch);
-      };
-      return await dispatch();
-    };
-  };
+function skipsCsrfPath(pathname) {
+  return pathname === samlAcsPathname() || pathname.startsWith("/scim/") || pathname.startsWith("/billing/webhooks/");
 }
-async function requestIdMiddleware(request, next) {
-  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-  const response = await next();
+function appendSetCookie(response, cookie) {
   const headers = new Headers(response.headers);
-  headers.set("x-request-id", requestId);
+  headers.append("set-cookie", cookie);
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
     headers
   });
 }
-function wrapRouteHandler(handler, middleware) {
-  if (isMethodRouteMap(handler)) {
-    const wrapped = {};
-    for (const [method, routeHandler] of Object.entries(handler)) {
-      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+function createCsrfMiddleware() {
+  return async (request, next) => {
+    const credentialSource = currentCredentialSource();
+    if (credentialSource === "bearer" || credentialSource === "basic") {
+      return await next();
     }
-    return wrapped;
-  }
-  if (isRouteHandler(handler)) {
-    return composeMiddleware(...middleware)(handler);
-  }
-  return handler;
+    const pathname = new URL(request.url).pathname;
+    if (skipsCsrfPath(pathname)) {
+      return await next();
+    }
+    const method = request.method.toUpperCase();
+    if (!MUTATING_METHODS.has(method)) {
+      const meta = currentRequestMeta();
+      const csrf = meta.csrfToken ? { token: meta.csrfToken } : resolveCsrfToken(request);
+      meta.csrfToken = csrf.token;
+      const response = await next();
+      if (!csrf.cookie) {
+        return response;
+      }
+      return appendSetCookie(response, csrf.cookie);
+    }
+    const submitted = await readSubmittedCsrfTokenFromBody(request);
+    if (!verifyCsrfToken(request, submitted)) {
+      throw new ForbiddenError("Invalid or missing CSRF token.");
+    }
+    const originHeader = request.headers.get("origin");
+    let headerOrigin = null;
+    if (originHeader) {
+      try {
+        headerOrigin = new URL(originHeader).origin;
+      } catch {
+        headerOrigin = null;
+      }
+    }
+    if (!headerOrigin || headerOrigin !== new URL(request.url).origin) {
+      throw new ForbiddenError("Cross-site cookie requests are not allowed.");
+    }
+    return await next();
+  };
 }
-function applyMiddlewareToRoutes(routes, middleware) {
-  const wrapped = {};
-  for (const [path, routeHandler] of Object.entries(routes)) {
-    const identity = async (_request, next) => await runWithRequestMeta({ ...currentRequestMeta(), routeTemplate: path }, next);
-    wrapped[path] = wrapRouteHandler(routeHandler, [identity, ...middleware]);
-  }
-  return wrapped;
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
 }
-// ../../src/core/http/pagination.ts
-var DEFAULT_PER_PAGE = 15;
-var MAX_PER_PAGE = 100;
-function parseRequiredPositiveIntQueryParam(params, name) {
-  const value = params.get(name);
-  if (value === null || value.trim() === "") {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
-  }
-  return parsed;
+// ../../src/core/http/flashSession.ts
+import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual4 } from "crypto";
+var FLASH_COOKIE = appCookieName("flash");
+var FLASH_TTL_MS = 60 * 1000;
+function flashCookieName() {
+  return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
 }
-function parsePaginationQuery(request) {
-  const params = getQueryParams(request);
-  const pageParam = params.get("page");
-  const perPageParam = params.get("per_page");
-  const page = pageParam === null || pageParam.trim() === "" ? 1 : parseRequiredPositiveIntQueryParam(params, "page");
-  if (perPageParam === null || perPageParam.trim() === "") {
-    return { page, perPage: DEFAULT_PER_PAGE };
-  }
-  const perPage = parseRequiredPositiveIntQueryParam(params, "per_page");
-  if (perPage > MAX_PER_PAGE) {
-    throw new BadRequestError(`Invalid query parameter "per_page". Maximum allowed value is ${MAX_PER_PAGE}.`);
-  }
-  return { page, perPage };
+function resolveFlashSecret() {
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
 }
-function paginatedResponse(data, meta, init = {}) {
-  return Response.json({ data, meta }, init);
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac5("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
 }
-// ../../src/core/http/uploads.ts
-var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
-var ALLOWED_UPLOAD_MIME_TYPES = new Set([
-  "application/pdf",
-  "application/json",
-  "application/zip",
-  "application/x-zip-compressed",
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "text/plain",
-  "text/csv"
-]);
-function resolveMaxUploadBytes() {
-  const raw = process.env.MAX_UPLOAD_BYTES?.trim() ?? process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_UPLOAD_BYTES;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_UPLOAD_BYTES;
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
   }
-  return parsed;
-}
-function normalizeMimeType(mimeType) {
-  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
-}
-function isAllowedMimeType(mimeType) {
-  const normalized = normalizeMimeType(mimeType);
-  if (!normalized || normalized === "application/octet-stream") {
-    return envFlagEnabled(process.env.UPLOAD_ALLOW_UNKNOWN_MIME);
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === flashCookieName()) {
+      return decodeURIComponent(rest.join("="));
+    }
   }
-  return ALLOWED_UPLOAD_MIME_TYPES.has(normalized);
-}
-
-// ../../src/core/http/parseMultipartUpload.ts
-function normalizeMimeType2(mimeType) {
-  return mimeType.split(";")[0]?.trim().toLowerCase() || "application/octet-stream";
-}
-function sanitizeUploadFileName(name) {
-  const base = name.split(/[/\\]/).pop()?.trim() ?? "upload";
-  const sanitized = base.replace(/[^\w.\-()+ ]+/g, "_").slice(0, 200);
-  return sanitized.length > 0 ? sanitized : "upload";
+  return null;
 }
-async function validateUploadFile(file, fieldName = "file") {
-  if (!(file instanceof File)) {
-    throw new BadRequestError(`Missing upload field "${fieldName}".`);
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
   }
-  if (file.size <= 0) {
-    throw new BadRequestError("Uploaded file is empty.");
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
   }
-  const maxBytes = resolveMaxUploadBytes();
-  if (file.size > maxBytes) {
-    throw new PayloadTooLargeError(`Upload exceeds the ${maxBytes} byte limit.`);
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
   }
-  const mimeType = normalizeMimeType2(file.type.trim() || "application/octet-stream");
-  if (!isAllowedMimeType(mimeType)) {
-    throw new BadRequestError(`File type "${mimeType}" is not allowed.`);
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
   }
-  return {
-    fileName: sanitizeUploadFileName(file.name),
-    mimeType,
-    size: file.size,
-    contents: new Uint8Array(await file.arrayBuffer())
-  };
-}
-async function parseMultipartUpload(request, fieldName = "file") {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("multipart/form-data")) {
-    throw new BadRequestError("Expected multipart form data.");
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
   }
-  const formData = await request.formData();
-  const value = formData.get(fieldName);
-  if (!(value instanceof File)) {
-    throw new BadRequestError(`Missing upload field "${fieldName}".`);
+  if (!timingSafeEqual4(expectedBuffer, actualBuffer)) {
+    return null;
   }
-  return validateUploadFile(value, fieldName);
-}
-// ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth) {
-  return async (request, next) => {
-    if (!await auth.check(request)) {
-      const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
     }
-    return await next();
-  };
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
 }
-// ../../src/core/http/resources.ts
-function serializeDate(value) {
-  return value instanceof Date ? value.toISOString() : value;
+function clearFlashCookie() {
+  const secure = isProductionEnv() ? "; Secure" : "";
+  return `${flashCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
-function whenLoaded(model, relation, transform) {
-  const value = model.loaded(relation);
-  if (value === undefined) {
-    return;
-  }
-  if (value === null) {
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
     return null;
   }
-  return transform ? transform(value) : value;
+  return parseFlashCookie(cookieValue);
+}
+function withFlashClear(response) {
+  const headers = new Headers(response.headers);
+  headers.append("set-cookie", clearFlashCookie());
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
 }
 
-class JsonResource {
-  resource;
-  static wrap = "data";
-  extra = {};
-  constructor(resource) {
-    this.resource = resource;
-  }
-  static make(resource) {
-    return new JsonResource(resource);
-  }
-  static collection(items) {
-    return new ResourceCollection(items);
+// ../../src/core/http/flashMiddleware.ts
+function createFlashMiddleware() {
+  return async (request, next) => {
+    const flash = pullFlash(request);
+    const meta = currentRequestMeta();
+    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
+      const response = await next();
+      if (flash) {
+        return withFlashClear(response);
+      }
+      return response;
+    });
+  };
+}
+// ../../src/core/http/validation.ts
+init_tenantContext();
+function buildRequestCacheKey(fallbackPath, request) {
+  if (!request) {
+    return fallbackPath;
   }
-  additional(data) {
-    this.extra = { ...this.extra, ...data };
-    return this;
+  const url = new URL(request.url);
+  const user = currentAuthUser();
+  const authScope = user ? `u:${user.id}` : "guest";
+  const tenantScope = `t:${currentTenant()?.id ?? "none"}`;
+  return `${authScope}|${tenantScope}|${url.pathname}${url.search}`;
+}
+function getQueryParams(request) {
+  if (!request) {
+    return new URLSearchParams;
   }
-  when(condition, value) {
-    return condition ? value : undefined;
+  return new URL(request.url).searchParams;
+}
+function parseOptionalPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
   }
-  whenLoaded(relation, transform) {
-    const model = this.resource;
-    if (this.resource == null || typeof model.loaded !== "function") {
-      return;
-    }
-    return whenLoaded(model, relation, transform);
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
   }
-  toArray() {
-    if (this.resource && typeof this.resource === "object" && "toArray" in this.resource) {
-      return this.resource.toArray();
-    }
-    return { ...this.resource };
+  return parsed;
+}
+function parseOptionalBooleanQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
   }
-  toResponse() {
-    const wrap = this.constructor.wrap;
-    const payload = this.toArray();
-    if (wrap === null) {
-      return { ...payload, ...this.extra };
-    }
-    return { [wrap]: payload, ...this.extra };
+  switch (value.toLowerCase()) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
   }
 }
-
-class ResourceCollection extends JsonResource {
-  toArray() {
-    const items = this.resource.map((item) => item instanceof JsonResource ? item.toArray() : { ...item });
-    const wrap = this.constructor.wrap;
-    if (wrap === null) {
-      return { data: items };
-    }
-    return { [wrap]: items };
+function parseOptionalEnumQueryParam(params, name, allowedValues) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
   }
-  toResponse() {
-    return { ...this.toArray(), ...this.extra };
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
   }
+  return value;
 }
-function toResourceCollection(items, transformer) {
-  return items.map(transformer);
+function expectObject(value, label = "request body") {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new BadRequestError(`${label} must be a JSON object.`);
+  }
+  return value;
 }
-function toPaginatedResourceCollection(items, meta, transformer) {
-  return {
-    data: toResourceCollection(items, transformer),
-    meta
-  };
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
 }
-// ../../src/core/http/safeInternalPath.ts
-var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
-function looksLikeExternalTarget(value) {
+function readRequiredString(payload, field, options = {}) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new BadRequestError(`"${field}" is required and must be a string.`);
+  }
   const trimmed = value.trim();
-  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
-    return true;
+  if (options.minLength !== undefined && trimmed.length < options.minLength) {
+    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
   }
-  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
-    return true;
+  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
+    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
   }
-  try {
-    const decoded = decodeURIComponent(trimmed);
-    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
-      return true;
-    }
-  } catch {
-    return true;
+  if (options.pattern && !options.pattern.test(trimmed)) {
+    throw new BadRequestError(`"${field}" has an invalid format.`);
   }
-  return false;
+  return trimmed;
 }
-function sanitizeNestedQuery(search) {
-  if (!search) {
-    return "";
+function readOptionalString(payload, field, options = {}) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
   }
-  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
-  const next = new URLSearchParams;
-  for (const [key, value] of params.entries()) {
-    if (NESTED_REDIRECT_KEYS.has(key)) {
-      const sanitized = sanitizeInternalPath(value, "/");
-      next.set(key, sanitized);
-      continue;
-    }
-    if (looksLikeExternalTarget(value) && value.includes("://")) {
-      continue;
-    }
-    next.set(key, value);
+  return readRequiredString(payload, field, options);
+}
+function readRequiredEnum(payload, field, allowedValues) {
+  const value = readRequiredString(payload, field);
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function readOptionalEnum(payload, field, allowedValues) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
   }
-  const serialized = next.toString();
-  return serialized ? `?${serialized}` : "";
+  return readRequiredEnum(payload, field, allowedValues);
 }
-function sanitizeInternalPath(raw, fallback = "/") {
-  const trimmed = raw.trim();
-  if (looksLikeExternalTarget(trimmed)) {
-    return fallback;
+function readRequiredPositiveInt(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
   }
-  const queryIndex = trimmed.indexOf("?");
-  const hashIndex = trimmed.indexOf("#");
-  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
-  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
-  if (looksLikeExternalTarget(pathname)) {
-    return fallback;
+  return value;
+}
+function readOptionalPositiveInt(payload, field) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
   }
-  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
-  return `${pathname}${sanitizeNestedQuery(search)}`;
+  return readRequiredPositiveInt(payload, field);
 }
-function safeInternalRedirectPath(request, fallback = "/") {
-  const url = new URL(request.url);
-  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
 }
-function loginRedirectLocation(request) {
-  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+
+// ../../src/core/http/formRequest.ts
+class FormRequest {
+  authorize(_request) {
+    return true;
+  }
+  async validate(request) {
+    if (!await this.authorize(request)) {
+      throw new ForbiddenError;
+    }
+    return await parseJsonBody(request, (payload) => this.parse(payload));
+  }
 }
 
-// ../../src/core/view/htmlResponse.ts
-function withCharset(contentType) {
-  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
+class QueryFormRequest {
+  validate(request) {
+    return this.parseQuery(request);
+  }
 }
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
+// ../../src/core/http/authMiddleware.ts
+function createAuthMiddleware(auth) {
+  return async (request, next) => {
+    const resolved = typeof auth.resolveWithSource === "function" ? await auth.resolveWithSource(request) : { user: await auth.resolve(request), credentialSource: null };
+    return await runWithAuthContext(resolved.user, resolved.credentialSource, async () => {
+      return await next();
+    });
+  };
+}
+// ../../src/core/http/authorizeMiddleware.ts
+function createAuthorizeMiddleware(gate, auth, resource, action) {
+  return async (request, next) => {
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    if (!gate.allows(resource, action, user)) {
+      const error = new ForbiddenError;
+      return errorResponse(error);
     }
-  });
+    return await next();
+  };
 }
-function isHtmxRequest(request) {
-  return request.headers.get("HX-Request") === "true";
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
 }
-function redirectResponse(location, status = 302) {
-  if (!location.startsWith("/") || location.startsWith("//")) {
-    throw new Error("Redirect location must be an internal path.");
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
   }
-  return new Response(null, {
-    status,
-    headers: {
-      Location: sanitizeInternalPath(location, "/")
-    }
-  });
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
 }
-function textResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": "text/plain; charset=utf-8"
-    }
-  });
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
 }
-function xmlResponse(body, init = {}) {
-  return new Response(body, {
-    status: init.status ?? 200,
-    headers: {
-      "Content-Type": withCharset(init.contentType ?? "application/xml")
-    }
+async function requestIdMiddleware(request, next) {
+  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
+  const response = await next();
+  const headers = new Headers(response.headers);
+  headers.set("x-request-id", requestId);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
   });
 }
-function rssResponse(body, init = {}) {
-  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
-}
-
-// ../../src/core/view/webErrorView.ts
-var configuredErrorView = {};
-function configureWebErrorView(options) {
-  configuredErrorView = { ...options };
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+    }
+    return wrapped;
+  }
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
+  }
+  return handler;
 }
-function errorReturnPath(request) {
-  if (!request)
-    return "/";
-  try {
-    const current = new URL(request.url);
-    const previous = new URL(request.headers.get("referer") ?? "");
-    if (previous.origin !== current.origin || (request.method === "GET" || request.method === "HEAD") && previous.pathname === current.pathname)
-      return "/";
-    return sanitizeInternalPath(previous.pathname, "/");
-  } catch {
-    return "/";
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    const identity = async (_request, next) => await runWithRequestMeta({ ...currentRequestMeta(), routeTemplate: path }, next);
+    wrapped[path] = wrapRouteHandler(routeHandler, [identity, ...middleware]);
   }
+  return wrapped;
 }
-function renderKernelErrorChrome(input) {
-  const title = escapeHtml(input.title);
-  const message = escapeHtml(input.message);
-  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
-  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
-  const goBack = input.status === 422 ? `<p><a href="${escapeHtml(errorReturnPath(input.request ?? currentRequestMeta().request))}">Go back</a></p>` : "";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/assets/app.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">Home</a>
-    </header>
-    <main class="site-main">
-      <section class="page-header">
-        <h1>${title}</h1>
-        <p>${message}</p>
-        ${details}
-        ${goBack}
-      </section>
-    </main>
-  </body>
-</html>
-`;
+// ../../src/core/http/pagination.ts
+var DEFAULT_PER_PAGE = 15;
+var MAX_PER_PAGE = 100;
+function parseRequiredPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  return parsed;
 }
-function errorTemplateName(status) {
-  if (status === 404) {
-    return "errors/not-found";
+function parsePaginationQuery(request) {
+  const params = getQueryParams(request);
+  const pageParam = params.get("page");
+  const perPageParam = params.get("per_page");
+  const page = pageParam === null || pageParam.trim() === "" ? 1 : parseRequiredPositiveIntQueryParam(params, "page");
+  if (perPageParam === null || perPageParam.trim() === "") {
+    return { page, perPage: DEFAULT_PER_PAGE };
   }
-  if (status === 403) {
-    return "errors/forbidden";
+  const perPage = parseRequiredPositiveIntQueryParam(params, "per_page");
+  if (perPage > MAX_PER_PAGE) {
+    throw new BadRequestError(`Invalid query parameter "per_page". Maximum allowed value is ${MAX_PER_PAGE}.`);
   }
-  return "errors/error";
+  return { page, perPage };
 }
-async function renderWebErrorHtml(input) {
-  const render = configuredErrorView.render;
-  if (!render) {
-    return renderKernelErrorChrome(input);
+function paginatedResponse(data, meta, init = {}) {
+  return Response.json({ data, meta }, init);
+}
+// ../../src/core/http/uploads.ts
+var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
+var ALLOWED_UPLOAD_MIME_TYPES = new Set([
+  "application/pdf",
+  "application/json",
+  "application/zip",
+  "application/x-zip-compressed",
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "text/plain",
+  "text/csv"
+]);
+function resolveMaxUploadBytes() {
+  const raw = process.env.MAX_UPLOAD_BYTES?.trim() ?? process.env.MAX_REQUEST_BODY_BYTES?.trim();
+  if (!raw) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
   }
-  try {
-    return await render({
-      ...input,
-      request: input.request ?? currentRequestMeta().request
-    });
-  } catch {
-    return renderKernelErrorChrome(input);
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return DEFAULT_MAX_UPLOAD_BYTES;
   }
+  return parsed;
 }
-async function htmlErrorResponse(input) {
-  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
-  response.headers.set("Cache-Control", "no-store");
-  return response;
+function normalizeMimeType(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
 }
-async function notFoundHtmlResponse(body) {
-  if (body !== undefined) {
-    const response = htmlResponse(body, { status: 404 });
-    response.headers.set("Cache-Control", "no-store");
-    return response;
+function isAllowedMimeType(mimeType) {
+  const normalized = normalizeMimeType(mimeType);
+  if (!normalized || normalized === "application/octet-stream") {
+    return envFlagEnabled(process.env.UPLOAD_ALLOW_UNKNOWN_MIME);
   }
-  return htmlErrorResponse({
-    status: 404,
-    title: "Not Found",
-    message: "The page you requested was not found."
-  });
+  return ALLOWED_UPLOAD_MIME_TYPES.has(normalized);
 }
 
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
+// ../../src/core/http/parseMultipartUpload.ts
+function normalizeMimeType2(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() || "application/octet-stream";
+}
+function sanitizeUploadFileName(name) {
+  const base = name.split(/[/\\]/).pop()?.trim() ?? "upload";
+  const sanitized = base.replace(/[^\w.\-()+ ]+/g, "_").slice(0, 200);
+  return sanitized.length > 0 ? sanitized : "upload";
+}
+async function validateUploadFile(file, fieldName = "file") {
+  if (!(file instanceof File)) {
+    throw new BadRequestError(`Missing upload field "${fieldName}".`);
   }
-  const pathname = new URL(request.url).pathname;
-  if (pathname.startsWith("/api/")) {
-    return true;
+  if (file.size <= 0) {
+    throw new BadRequestError("Uploaded file is empty.");
   }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
+  const maxBytes = resolveMaxUploadBytes();
+  if (file.size > maxBytes) {
+    throw new PayloadTooLargeError(`Upload exceeds the ${maxBytes} byte limit.`);
   }
-  if (accept.includes("application/json")) {
-    return true;
+  const mimeType = normalizeMimeType2(file.type.trim() || "application/octet-stream");
+  if (!isAllowedMimeType(mimeType)) {
+    throw new BadRequestError(`File type "${mimeType}" is not allowed.`);
   }
+  return {
+    fileName: sanitizeUploadFileName(file.name),
+    mimeType,
+    size: file.size,
+    contents: new Uint8Array(await file.arrayBuffer())
+  };
+}
+async function parseMultipartUpload(request, fieldName = "file") {
   const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
+  if (!contentType.includes("multipart/form-data")) {
+    throw new BadRequestError("Expected multipart form data.");
   }
-  return false;
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
+  const formData = await request.formData();
+  const value = formData.get(fieldName);
+  if (!(value instanceof File)) {
+    throw new BadRequestError(`Missing upload field "${fieldName}".`);
   }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
+  return validateUploadFile(value, fieldName);
+}
+// ../../src/core/http/requireAuthMiddleware.ts
+function createRequireAuthMiddleware(auth) {
+  return async (request, next) => {
+    if (!await auth.check(request)) {
+      const error = new UnauthorizedError;
+      return errorResponse(error);
     }
+    return await next();
+  };
+}
+// ../../src/core/http/resources.ts
+function serializeDate(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+function whenLoaded(model, relation, transform) {
+  const value = model.loaded(relation);
+  if (value === undefined) {
+    return;
   }
-  return errors;
+  if (value === null) {
+    return null;
+  }
+  return transform ? transform(value) : value;
 }
-function errorPageTitle(status, message) {
-  if (status === 404) {
-    return "Not Found";
+
+class JsonResource {
+  resource;
+  static wrap = "data";
+  extra = {};
+  constructor(resource) {
+    this.resource = resource;
   }
-  if (status === 403) {
-    return "Forbidden";
+  static make(resource) {
+    return new JsonResource(resource);
   }
-  if (status >= 500) {
-    return "Server Error";
+  static collection(items) {
+    return new ResourceCollection(items);
   }
-  return message;
-}
-function publicErrorMessage(status, message) {
-  if (status >= 500 && isProductionEnv()) {
-    return "Something went wrong.";
+  additional(data) {
+    this.extra = { ...this.extra, ...data };
+    return this;
   }
-  return message;
-}
-function logServerError(error, mappedError) {
-  if (mappedError.status < 500) {
-    return;
+  when(condition, value) {
+    return condition ? value : undefined;
   }
-  appLogger.error("Unhandled request error", {
-    status: mappedError.status,
-    error: error instanceof Error ? error.message : String(error),
-    stack: error instanceof Error ? error.stack : undefined
-  });
-}
-async function webErrorResponse(error, request) {
-  if (currentRequestMeta().errorFormat === "json" || !request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
+  whenLoaded(relation, transform) {
+    const model = this.resource;
+    if (this.resource == null || typeof model.loaded !== "function") {
+      return;
+    }
+    return whenLoaded(model, relation, transform);
   }
-  const mappedError = toHttpError(error) ?? mapDatabaseError(error);
-  logServerError(error, mappedError);
-  if (mappedError.status === 401) {
-    return Response.redirect(loginRedirectLocation(request), 302);
+  toArray() {
+    if (this.resource && typeof this.resource === "object" && "toArray" in this.resource) {
+      return this.resource.toArray();
+    }
+    return { ...this.resource };
+  }
+  toResponse() {
+    const wrap = this.constructor.wrap;
+    const payload = this.toArray();
+    if (wrap === null) {
+      return { ...payload, ...this.extra };
+    }
+    return { [wrap]: payload, ...this.extra };
   }
-  const errors = mappedError instanceof ValidationError || mappedError.name === "ValidationError" ? normalizeFieldErrors(mappedError.details) : undefined;
-  return htmlErrorResponse({
-    status: mappedError.status,
-    title: errorPageTitle(mappedError.status, mappedError.message),
-    message: publicErrorMessage(mappedError.status, mappedError.message),
-    errors,
-    request
-  });
 }
 
-// ../../src/core/http/response.ts
-init_transactionControl();
-function jsonResponse2(data, init = {}) {
-  return Response.json(data, {
-    status: init.status ?? 200,
-    headers: init.headers
-  });
-}
-function createdResponse(data, init = {}) {
-  return jsonResponse2(data, { ...init, status: init.status ?? 201 });
-}
-function noContentResponse() {
-  return new Response(null, { status: 204 });
+class ResourceCollection extends JsonResource {
+  toArray() {
+    const items = this.resource.map((item) => item instanceof JsonResource ? item.toArray() : { ...item });
+    const wrap = this.constructor.wrap;
+    if (wrap === null) {
+      return { data: items };
+    }
+    return { [wrap]: items };
+  }
+  toResponse() {
+    return { ...this.toArray(), ...this.extra };
+  }
 }
-function errorResponse(error) {
-  const mappedError = toHttpError(error) ?? mapDatabaseError(error);
-  logServerError(error, mappedError);
-  return Response.json({
-    error: mappedError.message,
-    ...mappedError.details === undefined ? {} : { details: mappedError.details }
-  }, { status: mappedError.status, headers: { "Cache-Control": "no-store" } });
+function toResourceCollection(items, transformer) {
+  return items.map(transformer);
 }
-function withErrorHandling(handler) {
-  return async (...args) => {
-    try {
-      return await handler(...args);
-    } catch (error) {
-      requestTransactionRollback();
-      const request = args.find((arg) => arg instanceof Request);
-      const webResponse = await webErrorResponse(error, request);
-      if (webResponse) {
-        return webResponse;
-      }
-      return errorResponse(error);
-    }
+function toPaginatedResourceCollection(items, meta, transformer) {
+  return {
+    data: toResourceCollection(items, transformer),
+    meta
   };
 }
 // ../../src/core/http/route.ts
@@ -13691,7 +13697,7 @@ function createRequireAbilityMiddleware(abilityChecker) {
           if (isViewsEnabled() && !requestPrefersJson(request)) {
             throw error;
           }
-          return Response.json({ error: error.message }, { status: error.status });
+          return errorResponse(new HttpError(error.status, error.message));
         }
         throw error;
       }
@@ -13724,7 +13730,7 @@ function createRequireGlobalAdminMiddleware() {
         path: new URL(_request.url).pathname
       });
       const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
+      return errorResponse(error);
     }
     return await next();
   };
@@ -16977,16 +16983,32 @@ class ViewRenderer {
     this.engine = engine;
     this.defaultLayout = defaultLayout;
   }
-  namespace(prefix) {
+  namespace(prefix, defaults = {}) {
     validateRelativeViewName(prefix);
+    const defaultHeaders = new Headers(defaults.headers);
+    const responseHeaders = (headers) => {
+      const merged = new Headers(defaultHeaders);
+      const overrides = new Headers(headers);
+      for (const [name, value] of overrides) {
+        if (name !== "set-cookie")
+          merged.set(name, value);
+      }
+      if (overrides.has("set-cookie")) {
+        merged.delete("set-cookie");
+        for (const cookie of overrides.getSetCookie())
+          merged.append("set-cookie", cookie);
+      }
+      return merged;
+    };
     const qualify = (name) => {
       validateRelativeViewName(name);
       return `${prefix}/${name}`;
     };
     return {
-      render: async (name, data, options) => this.render(qualify(name), data, options),
+      render: async (name, data, options = {}) => this.render(qualify(name), data, { ...options, headers: responseHeaders(options.headers) }),
       renderHtmx: async (name, data, options = {}) => this.renderHtmx(qualify(name), data, {
         ...options,
+        headers: responseHeaders(options.headers),
         ...options.fragment === undefined ? {} : { fragment: qualify(options.fragment) }
       })
     };
@@ -17374,7 +17396,7 @@ export {
   isRlsTenancy,
   isTenancyEnabled,
   jobRegistry,
-  jsonResponse2 as jsonResponse,
+  jsonResponse,
   jwtTtlSeconds,
   loadMigrationsFromDirectory,
   loadSeedersFromDirectory,
@@ -17415,6 +17437,7 @@ export {
   pinUrlToAddress,
   pivotTableName,
   policyGate,
+  privateJsonResponse,
   projectPluck,
   prometheusRegistry,
   qualifyColumn,