@hachej/boring-core 0.1.0

package/dist/chunk-CZ4HIXII.js

@@ -0,0 +1,2869 @@
+import {
+  idempotencyKeys,
+  schema_exports,
+  users,
+  verification_tokens,
+  workspaceInvites,
+  workspaceMembers,
+  workspaceRuntimes,
+  workspaceSettings,
+  workspaces
+} from "./chunk-HSRBZLKT.js";
+import {
+  ConfigValidationError,
+  ERROR_CODES,
+  HttpError
+} from "./chunk-H5KU6R6Y.js";
+
+// src/server/config/schema.ts
+import { z } from "zod";
+var VALID_MAIL_SCHEMES = ["resend://", "smtp://", "smtps://", "console://", "console-capture://"];
+var logLevelSchema = z.enum([
+  "fatal",
+  "error",
+  "warn",
+  "info",
+  "debug",
+  "trace"
+]);
+var rateLimitEndpointOverrideSchema = z.object({
+  max: z.number().int().positive(),
+  window: z.string().min(1)
+});
+var mailTransportUrlSchema = z.string().refine(
+  (url) => VALID_MAIL_SCHEMES.some((s) => url.startsWith(s)),
+  {
+    message: `Mail transport URL must start with one of: ${VALID_MAIL_SCHEMES.join(", ")}`
+  }
+);
+var coreConfigSchema = z.object({
+  appId: z.string().min(1),
+  appName: z.string().min(1),
+  appLogo: z.string().nullable(),
+  port: z.number().int().min(1).max(65535),
+  host: z.string().min(1),
+  staticDir: z.string().nullable(),
+  databaseUrl: z.string().nullable(),
+  stores: z.enum(["postgres", "local"]),
+  cors: z.object({
+    origins: z.array(z.string()),
+    credentials: z.literal(true)
+  }),
+  bodyLimit: z.number().int().positive(),
+  logLevel: logLevelSchema,
+  rateLimit: z.record(rateLimitEndpointOverrideSchema).optional(),
+  security: z.object({
+    csp: z.object({
+      enabled: z.boolean(),
+      upgradeInsecureRequests: z.boolean().optional()
+    })
+  }).optional(),
+  encryption: z.object({
+    workspaceSettingsKey: z.string().min(1)
+  }),
+  auth: z.object({
+    secret: z.string().min(1),
+    url: z.string().url(),
+    github: z.object({
+      clientId: z.string().min(1),
+      clientSecret: z.string().min(1)
+    }).optional(),
+    mail: z.object({
+      from: z.string().min(1),
+      transportUrl: mailTransportUrlSchema
+    }).optional(),
+    sessionTtlSeconds: z.number().int().positive(),
+    sessionCookieSecure: z.boolean()
+  }),
+  features: z.object({
+    githubOauth: z.boolean(),
+    invitesEnabled: z.boolean(),
+    sendWelcomeEmail: z.boolean(),
+    inviteTtlDays: z.number().int().min(1).max(30).default(7)
+  })
+});
+
+// src/server/config/loadConfig.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+import { parse as parseTOML } from "smol-toml";
+var THIRTY_DAYS_SECONDS = 60 * 60 * 24 * 30;
+var SIXTEEN_MB = 16 * 1024 * 1024;
+var INSECURE_PLACEHOLDER_SECRET = "0000000000000000000000000000000000000000000000000000000000000000";
+var INSECURE_DATABASE_URL = "postgres://placeholder:placeholder@localhost:5432/placeholder";
+var INSECURE_ENCRYPTION_KEY = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+function parseRateLimitOverrides(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new ConfigValidationError([
+      {
+        message: 'RATE_LIMIT_OVERRIDES_JSON must be valid JSON object: {"<endpoint>":{"max":number,"window":"<duration>"}}',
+        path: ["rateLimit"]
+      }
+    ]);
+  }
+}
+async function loadConfig(options) {
+  const env = options?.env ?? process.env;
+  const tomlPath = resolve(options?.tomlPath ?? "./boring.app.toml");
+  const allowMissingSecrets = options?.allowMissingSecrets ?? false;
+  if (allowMissingSecrets && env.NODE_ENV === "production") {
+    throw new ConfigValidationError([
+      {
+        message: "allowMissingSecrets is forbidden in production",
+        path: ["allowMissingSecrets"]
+      }
+    ]);
+  }
+  let toml = {};
+  if (existsSync(tomlPath)) {
+    const raw2 = readFileSync(tomlPath, "utf-8");
+    toml = parseTOML(raw2);
+  }
+  const appId = toml.app?.id ?? env.APP_ID ?? "boring-app";
+  const appName = toml.frontend?.branding?.name ?? env.APP_NAME ?? appId;
+  const appLogo = toml.frontend?.branding?.logo ?? null;
+  const storesRaw = env.CORE_STORES ?? "postgres";
+  const stores = storesRaw === "local" ? "local" : "postgres";
+  let databaseUrl = env.DATABASE_URL ?? null;
+  let authSecret = env.BETTER_AUTH_SECRET ?? "";
+  let encryptionKey = env.WORKSPACE_SETTINGS_ENCRYPTION_KEY ?? "";
+  const insecureDefaults = [];
+  if (allowMissingSecrets) {
+    if (!databaseUrl) {
+      databaseUrl = INSECURE_DATABASE_URL;
+      insecureDefaults.push("DATABASE_URL");
+    }
+    if (!authSecret) {
+      authSecret = INSECURE_PLACEHOLDER_SECRET;
+      insecureDefaults.push("BETTER_AUTH_SECRET");
+    }
+    if (!encryptionKey) {
+      encryptionKey = INSECURE_ENCRYPTION_KEY;
+      insecureDefaults.push("WORKSPACE_SETTINGS_ENCRYPTION_KEY");
+    }
+  }
+  if (insecureDefaults.length > 0) {
+    console.warn(
+      `[config:insecure-defaults] Using placeholder values for: ${insecureDefaults.join(", ")}. Do NOT use in production.`
+    );
+  }
+  const authUrl = env.BETTER_AUTH_URL ?? `http://localhost:${env.PORT ?? "3000"}`;
+  const corsOriginsRaw = env.CORS_ORIGINS ?? "";
+  const corsOrigins = corsOriginsRaw ? corsOriginsRaw.split(",").map((s) => s.trim()).filter(Boolean) : ["http://localhost:3000", "http://localhost:5173"];
+  const cspEnabled = env.CSP_ENABLED !== "false";
+  const cspUpgradeInsecureRequests = env.CSP_UPGRADE_INSECURE_REQUESTS !== void 0 ? env.CSP_UPGRADE_INSECURE_REQUESTS === "true" : authUrl.startsWith("https://");
+  const sessionCookieSecureOverride = env.SESSION_COOKIE_SECURE;
+  const sessionCookieSecure = sessionCookieSecureOverride !== void 0 ? sessionCookieSecureOverride === "true" : authUrl.startsWith("https://");
+  const githubOauth = toml.features?.github_oauth ?? env.GITHUB_OAUTH === "true";
+  const github = env.GITHUB_CLIENT_ID && env.GITHUB_CLIENT_SECRET ? {
+    clientId: env.GITHUB_CLIENT_ID,
+    clientSecret: env.GITHUB_CLIENT_SECRET
+  } : void 0;
+  const mailFrom = env.MAIL_FROM;
+  const mailTransportUrl = env.MAIL_TRANSPORT_URL;
+  const mail = mailFrom && mailTransportUrl ? { from: mailFrom, transportUrl: mailTransportUrl } : void 0;
+  const raw = {
+    appId,
+    appName,
+    appLogo,
+    port: parseInt(env.PORT ?? "3000", 10),
+    host: env.HOST ?? "0.0.0.0",
+    staticDir: env.STATIC_DIR ?? null,
+    databaseUrl,
+    stores,
+    cors: {
+      origins: corsOrigins,
+      credentials: true
+    },
+    bodyLimit: parseInt(env.BODY_LIMIT_BYTES ?? String(SIXTEEN_MB), 10),
+    logLevel: env.LOG_LEVEL ?? "info",
+    rateLimit: parseRateLimitOverrides(env.RATE_LIMIT_OVERRIDES_JSON),
+    security: {
+      csp: {
+        enabled: cspEnabled,
+        upgradeInsecureRequests: cspUpgradeInsecureRequests
+      }
+    },
+    encryption: {
+      workspaceSettingsKey: encryptionKey
+    },
+    auth: {
+      secret: authSecret,
+      url: authUrl,
+      github,
+      mail,
+      sessionTtlSeconds: parseInt(
+        env.SESSION_TTL_SECONDS ?? String(THIRTY_DAYS_SECONDS),
+        10
+      ),
+      sessionCookieSecure
+    },
+    features: {
+      githubOauth: githubOauth && github !== void 0,
+      invitesEnabled: toml.features?.invites_enabled ?? true,
+      sendWelcomeEmail: env.SEND_WELCOME_EMAIL !== "false",
+      ...toml.features?.invite_ttl_days != null && { inviteTtlDays: toml.features.invite_ttl_days }
+    }
+  };
+  return validateConfig(raw);
+}
+function validateConfig(raw) {
+  const result = coreConfigSchema.safeParse(raw);
+  if (!result.success) {
+    throw new ConfigValidationError(
+      result.error.issues.map((i) => ({
+        message: i.message,
+        path: i.path.map((p) => typeof p === "number" ? p : String(p))
+      }))
+    );
+  }
+  return result.data;
+}
+function buildRuntimeConfigPayload(config) {
+  return {
+    appId: config.appId,
+    appName: config.appName,
+    appLogo: config.appLogo,
+    apiBase: config.auth.url,
+    features: {
+      githubOauth: config.features.githubOauth,
+      invitesEnabled: config.features.invitesEnabled,
+      sendWelcomeEmail: config.features.sendWelcomeEmail
+    }
+  };
+}
+
+// src/server/app/createCoreApp.ts
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import helmet from "@fastify/helmet";
+import { randomBytes, randomUUID } from "crypto";
+
+// src/server/app/errorHandler.ts
+function registerErrorHandler(app) {
+  app.setNotFoundHandler((request, reply) => {
+    return reply.status(404).send({
+      error: "Not found",
+      code: "not_found",
+      message: `Route ${request.method}:${request.url} not found`,
+      requestId: request.id
+    });
+  });
+  app.setErrorHandler((error, request, reply) => {
+    const requestId = request.id;
+    if (error instanceof HttpError) {
+      return reply.status(error.status).send({
+        error: error.message,
+        code: error.code,
+        message: error.message,
+        requestId
+      });
+    }
+    if (isValidationError(error)) {
+      const firstIssue = extractFirstValidationMessage(error);
+      return reply.status(400).send({
+        error: "validation_failed",
+        code: "validation_failed",
+        message: firstIssue,
+        requestId
+      });
+    }
+    if (isRateLimitError(error)) {
+      const retryAfter = error.retryAfter ?? 60;
+      reply.header("Retry-After", String(retryAfter));
+      return reply.status(429).send({
+        error: "rate_limited",
+        code: "rate_limited",
+        message: `Too many requests. Retry after ${retryAfter} seconds.`,
+        requestId
+      });
+    }
+    const fastifyErr = error;
+    if (fastifyErr.statusCode && fastifyErr.statusCode >= 400 && fastifyErr.statusCode < 500) {
+      const code = fastifyErr.code ? fastifyErr.code.toLowerCase().replace(/^fst_err_/, "") : `http_${fastifyErr.statusCode}`;
+      return reply.status(fastifyErr.statusCode).send({
+        error: fastifyErr.message,
+        code,
+        message: fastifyErr.message,
+        requestId
+      });
+    }
+    request.log.error({ err: error, requestId }, "unhandled error");
+    return reply.status(500).send({
+      error: "internal_error",
+      code: "internal_error",
+      message: "Internal server error",
+      requestId
+    });
+  });
+}
+function isValidationError(error) {
+  const err = error;
+  if (err.validation) return true;
+  if (err.code === "FST_ERR_VALIDATION") return true;
+  return false;
+}
+function isRateLimitError(error) {
+  const err = error;
+  return err.statusCode === 429 || err.code === "FST_ERR_RATE_LIMIT";
+}
+function extractFirstValidationMessage(error) {
+  const err = error;
+  if (err.validation && err.validation.length > 0) {
+    const first = err.validation[0];
+    const path = first.instancePath ?? "";
+    const msg = first.message ?? first.params?.issue ?? "Invalid value";
+    return path ? `${path}: ${msg}` : msg;
+  }
+  return error.message || "Validation failed";
+}
+
+// src/server/app/capabilities.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2, dirname } from "path";
+import { fileURLToPath } from "url";
+var cachedVersion;
+function readCorePackageVersion(startDir) {
+  let dir = startDir;
+  while (true) {
+    const pkgPath = resolve2(dir, "package.json");
+    if (existsSync2(pkgPath)) {
+      const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
+      if (pkg.name === "@hachej/boring-core" && typeof pkg.version === "string") {
+        return pkg.version;
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function getCoreVersion() {
+  if (cachedVersion) return cachedVersion;
+  try {
+    const dir = dirname(fileURLToPath(import.meta.url));
+    cachedVersion = readCorePackageVersion(dir) ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+function registerCapabilities(app) {
+  const contributors = /* @__PURE__ */ new Map();
+  app.decorate("capabilitiesCache", null);
+  app.decorate(
+    "registerCapabilitiesContributor",
+    function(name, fn) {
+      contributors.set(name, fn);
+    }
+  );
+  const hasMail = !!app.config.auth.mail;
+  app.registerCapabilitiesContributor("core", () => {
+    const core = {
+      version: getCoreVersion(),
+      features: {
+        invitesEnabled: app.config.features.invitesEnabled,
+        githubOauth: app.config.features.githubOauth,
+        emailFlows: hasMail
+      },
+      auth: {
+        emailPassword: true,
+        github: false,
+        emailVerification: hasMail,
+        passwordReset: hasMail,
+        magicLink: hasMail
+      }
+    };
+    return { core };
+  });
+  app.addHook("onReady", async () => {
+    const result = {};
+    for (const [name, fn] of contributors) {
+      const partial = await fn({ config: app.config });
+      for (const [key, value] of Object.entries(partial)) {
+        if (value !== void 0) {
+          result[key] = value;
+        }
+      }
+    }
+    app.capabilitiesCache = result;
+  });
+  app.get("/api/v1/capabilities", async () => {
+    return app.capabilitiesCache;
+  });
+}
+
+// src/server/security/rateLimit.ts
+import rateLimit from "@fastify/rate-limit";
+var DEFAULT_RATE_LIMIT_RULES = [
+  {
+    endpoint: "/auth/sign-in/email",
+    url: "/auth/sign-in/email",
+    method: "POST",
+    max: 5,
+    timeWindow: "1 minute"
+  },
+  {
+    endpoint: "/auth/sign-up/email",
+    url: "/auth/sign-up/email",
+    method: "POST",
+    max: 3,
+    timeWindow: "1 hour"
+  },
+  {
+    endpoint: "/auth/forget-password",
+    url: "/auth/forget-password",
+    method: "POST",
+    max: 3,
+    timeWindow: "1 hour"
+  },
+  {
+    endpoint: "/auth/send-verification-email",
+    url: "/auth/send-verification-email",
+    method: "POST",
+    max: 3,
+    timeWindow: "1 hour"
+  },
+  {
+    // Override key uses the templated route string, not a concrete workspace ID.
+    endpoint: "/api/v1/workspaces/:id/invites",
+    url: "/api/v1/workspaces/:id/invites",
+    method: "POST",
+    max: 20,
+    timeWindow: "1 hour",
+    keyGenerator: (req) => {
+      const workspaceId = req.params.id ?? "unknown";
+      return workspaceId;
+    }
+  },
+  {
+    endpoint: "/api/v1/invites/resolve",
+    url: "/api/v1/invites/resolve",
+    method: "POST",
+    max: 60,
+    timeWindow: "1 minute"
+  },
+  {
+    endpoint: "/api/v1/invites/accept",
+    url: "/api/v1/invites/accept",
+    method: "POST",
+    max: 10,
+    timeWindow: "1 minute",
+    keyGenerator: (req) => {
+      const userId = req.user?.id ?? "anon";
+      return `${req.ip}:${userId}`;
+    }
+  }
+];
+function matchesRule(routeOptions, rule) {
+  if (routeOptions.url !== rule.url) return false;
+  const methods = Array.isArray(routeOptions.method) ? routeOptions.method : [routeOptions.method];
+  return methods.some((m) => m.toUpperCase() === rule.method);
+}
+function resolveRule(rule, overrides) {
+  if (!overrides) return rule;
+  const byMethodAndPath = overrides[`${rule.method} ${rule.endpoint}`];
+  const byPath = overrides[rule.endpoint];
+  const override = byMethodAndPath ?? byPath;
+  if (!override) return rule;
+  return {
+    ...rule,
+    max: override.max,
+    timeWindow: override.window
+  };
+}
+async function registerRateLimits(app) {
+  const overrides = app.config.rateLimit;
+  app.addHook("onRoute", (routeOptions) => {
+    const baseRule = DEFAULT_RATE_LIMIT_RULES.find(
+      (r) => matchesRule(routeOptions, r)
+    );
+    if (!baseRule) return;
+    const rule = resolveRule(baseRule, overrides);
+    routeOptions.config = {
+      ...routeOptions.config,
+      rateLimit: {
+        max: rule.max,
+        timeWindow: rule.timeWindow,
+        ...rule.keyGenerator ? { keyGenerator: rule.keyGenerator } : {}
+      }
+    };
+  });
+  await app.register(rateLimit, { global: false });
+}
+
+// src/server/app/createCoreApp.ts
+var DEFAULT_REDACTION_KEYWORDS = [
+  "secret",
+  "token",
+  "clientsecret",
+  "password",
+  "authorization",
+  "cookie"
+];
+var SHUTDOWN_GRACE_MS = 3e4;
+var CSP_NONCE_SIZE_BYTES = 16;
+function redactObject(obj, keywords) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    const keyLower = key.toLowerCase();
+    if (keywords.some((kw) => keyLower.includes(kw))) {
+      result[key] = "[REDACTED]";
+    } else if (value && typeof value === "object" && !Array.isArray(value)) {
+      result[key] = redactObject(
+        value,
+        keywords
+      );
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+async function closeDbPoolIfPresent(app) {
+  const maybeDb = app.db;
+  if (!maybeDb || typeof maybeDb !== "object") return;
+  const db = maybeDb;
+  const closeFn = typeof db.end === "function" ? db.end.bind(db) : typeof db.close === "function" ? db.close.bind(db) : null;
+  if (!closeFn) return;
+  await closeFn();
+}
+function installShutdownHandlers(app) {
+  let shuttingDown = false;
+  const onSignal = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    app.log.info({ signal }, "shutdown:start");
+    try {
+      let timeoutHandle;
+      const result = await Promise.race([
+        app.close(),
+        new Promise((resolve3) => {
+          timeoutHandle = setTimeout(() => {
+            resolve3("timeout");
+          }, SHUTDOWN_GRACE_MS);
+        })
+      ]);
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      if (result === "timeout") {
+        app.log.warn(
+          { signal, timeoutMs: SHUTDOWN_GRACE_MS },
+          "shutdown:grace-exceeded"
+        );
+        try {
+          await closeDbPoolIfPresent(app);
+        } catch (error) {
+          app.log.error(
+            { err: error, signal },
+            "shutdown:db-close-failed"
+          );
+        }
+        process.exit(1);
+        return;
+      }
+      try {
+        await closeDbPoolIfPresent(app);
+      } catch (error) {
+        app.log.error({ err: error, signal }, "shutdown:db-close-failed");
+        process.exit(1);
+        return;
+      }
+      app.log.info({ signal }, "shutdown:complete");
+      process.exit(0);
+    } catch (error) {
+      app.log.error({ err: error, signal }, "shutdown:error");
+      try {
+        await closeDbPoolIfPresent(app);
+      } catch (dbError) {
+        app.log.error({ err: dbError, signal }, "shutdown:db-close-failed");
+      }
+      process.exit(1);
+    }
+  };
+  const sigtermHandler = () => {
+    void onSignal("SIGTERM");
+  };
+  const sigintHandler = () => {
+    void onSignal("SIGINT");
+  };
+  process.once("SIGTERM", sigtermHandler);
+  process.once("SIGINT", sigintHandler);
+  app.addHook("onClose", async () => {
+    process.removeListener("SIGTERM", sigtermHandler);
+    process.removeListener("SIGINT", sigintHandler);
+  });
+}
+async function createCoreApp(config, options) {
+  const redactionKeywords = [...DEFAULT_REDACTION_KEYWORDS];
+  const app = Fastify({
+    trustProxy: true,
+    bodyLimit: config.bodyLimit,
+    genReqId: (req) => {
+      const incoming = req.headers["x-request-id"];
+      if (typeof incoming === "string" && incoming.length > 0 && incoming.length <= 128) {
+        return incoming;
+      }
+      return randomUUID();
+    },
+    logger: {
+      level: config.logLevel,
+      serializers: {
+        req(req) {
+          return redactObject(
+            {
+              method: req.method,
+              url: req.url,
+              hostname: req.hostname,
+              remoteAddress: req.ip,
+              headers: req.headers
+            },
+            redactionKeywords
+          );
+        },
+        res(res) {
+          return { statusCode: res.statusCode };
+        }
+      }
+    }
+  });
+  app.decorate("config", config);
+  app.decorate("provisioner", options?.provisioner ?? null);
+  app.decorate("addRedactionPaths", function(paths) {
+    for (const p of paths) {
+      redactionKeywords.push(p.toLowerCase());
+    }
+  });
+  app.addHook("onSend", async (request, reply) => {
+    reply.header("x-request-id", request.id);
+  });
+  app.addHook("onRequest", async (request) => {
+    const nonce = randomBytes(CSP_NONCE_SIZE_BYTES).toString("base64");
+    request.cspNonce = nonce;
+    request.raw.cspNonce = nonce;
+  });
+  await app.register(cors, {
+    origin: config.cors.origins.length > 0 ? config.cors.origins : true,
+    credentials: config.cors.credentials
+  });
+  const cspEnabled = config.security?.csp?.enabled ?? true;
+  const cspUpgradeInsecureRequests = config.security?.csp?.upgradeInsecureRequests ?? config.auth.url.startsWith("https://");
+  await app.register(helmet, {
+    hsts: {
+      maxAge: 31536e3,
+      includeSubDomains: true,
+      preload: true
+    },
+    frameguard: {
+      action: "deny"
+    },
+    noSniff: true,
+    referrerPolicy: {
+      policy: "strict-origin-when-cross-origin"
+    },
+    contentSecurityPolicy: cspEnabled ? {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: [
+          "'self'",
+          (request) => `'nonce-${request.cspNonce ?? ""}'`
+        ],
+        styleSrc: [
+          "'self'",
+          (request) => `'nonce-${request.cspNonce ?? ""}'`
+        ],
+        imgSrc: ["'self'", "data:", "blob:"],
+        connectSrc: ["'self'"],
+        fontSrc: ["'self'"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+        baseUri: ["'self'"],
+        formAction: ["'self'"],
+        upgradeInsecureRequests: cspUpgradeInsecureRequests ? [] : null
+      }
+    } : false
+  });
+  registerErrorHandler(app);
+  registerCapabilities(app);
+  await registerRateLimits(app);
+  const manageShutdown = options?.manageShutdown ?? true;
+  if (manageShutdown) {
+    installShutdownHandlers(app);
+  }
+  return app;
+}
+
+// src/server/app/routes.ts
+import fp from "fastify-plugin";
+import { z as z2 } from "zod";
+
+// src/server/auth/deleteUserCompletely.ts
+import { and, eq, isNotNull, isNull, sql } from "drizzle-orm";
+var RETRYABLE_TX_ERROR_CODES = /* @__PURE__ */ new Set(["40001", "40P01"]);
+var SERIALIZATION_RETRY_LIMIT = 5;
+var BASE_RETRY_DELAY_MS = 25;
+function isRetryableTxFailure(error) {
+  return typeof error === "object" && error !== null && "code" in error && RETRYABLE_TX_ERROR_CODES.has(String(error.code));
+}
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function deleteUserCompletely(userId, deps) {
+  for (let attempt = 1; attempt <= SERIALIZATION_RETRY_LIMIT; attempt += 1) {
+    try {
+      await deps.db.transaction(async (tx) => {
+        await tx.execute(sql`SET TRANSACTION ISOLATION LEVEL SERIALIZABLE`);
+        const ownerWorkspaces = await tx.select({ id: workspaces.id }).from(workspaces).innerJoin(
+          workspaceMembers,
+          and(
+            eq(workspaceMembers.workspaceId, workspaces.id),
+            eq(workspaceMembers.userId, userId),
+            eq(workspaceMembers.role, "owner")
+          )
+        ).where(isNull(workspaces.deletedAt));
+        for (const workspace of ownerWorkspaces) {
+          await tx.execute(sql`
+            SELECT user_id
+            FROM workspace_members
+            WHERE workspace_id = ${workspace.id}
+              AND role = 'owner'
+            FOR UPDATE
+          `);
+          const [ownerCount] = await tx.select({ count: sql`count(*)::int` }).from(workspaceMembers).where(
+            and(
+              eq(workspaceMembers.workspaceId, workspace.id),
+              eq(workspaceMembers.role, sql`'owner'`)
+            )
+          );
+          if (Number(ownerCount.count) !== 1) {
+            continue;
+          }
+          const [oldestEditor] = await tx.select({ userId: workspaceMembers.userId }).from(workspaceMembers).where(
+            and(
+              eq(workspaceMembers.workspaceId, workspace.id),
+              eq(workspaceMembers.role, "editor"),
+              sql`${workspaceMembers.userId} <> ${userId}`
+            )
+          ).orderBy(workspaceMembers.createdAt, workspaceMembers.userId).limit(1);
+          if (oldestEditor) {
+            await tx.update(workspaceMembers).set({ role: "owner" }).where(
+              and(
+                eq(workspaceMembers.workspaceId, workspace.id),
+                eq(workspaceMembers.userId, oldestEditor.userId)
+              )
+            );
+            await tx.update(workspaces).set({ createdBy: oldestEditor.userId }).where(eq(workspaces.id, workspace.id));
+            continue;
+          }
+          await tx.delete(workspaceInvites).where(eq(workspaceInvites.workspaceId, workspace.id));
+          await tx.delete(workspaceSettings).where(eq(workspaceSettings.workspaceId, workspace.id));
+          await tx.delete(workspaceRuntimes).where(eq(workspaceRuntimes.workspaceId, workspace.id));
+          await tx.delete(workspaceMembers).where(eq(workspaceMembers.workspaceId, workspace.id));
+          await tx.delete(workspaces).where(eq(workspaces.id, workspace.id));
+        }
+        await tx.execute(sql`
+          UPDATE workspaces
+          SET created_by = (
+            SELECT wm.user_id
+            FROM workspace_members AS wm
+            WHERE wm.workspace_id = workspaces.id
+              AND wm.user_id <> ${userId}
+            ORDER BY
+              CASE wm.role
+                WHEN 'owner' THEN 0
+                WHEN 'editor' THEN 1
+                ELSE 2
+              END,
+              wm.created_at ASC,
+              wm.user_id ASC
+            LIMIT 1
+          )
+          WHERE workspaces.created_by = ${userId}
+            AND EXISTS (
+              SELECT 1
+              FROM workspace_members AS wm
+              WHERE wm.workspace_id = workspaces.id
+                AND wm.user_id <> ${userId}
+          )
+        `);
+        await tx.delete(workspaceMembers).where(eq(workspaceMembers.userId, userId));
+        await tx.delete(workspaceInvites).where(
+          and(
+            eq(workspaceInvites.createdBy, userId),
+            isNull(workspaceInvites.acceptedAt)
+          )
+        );
+        await tx.update(workspaceInvites).set({ createdBy: null }).where(
+          and(
+            eq(workspaceInvites.createdBy, userId),
+            isNotNull(workspaceInvites.acceptedAt)
+          )
+        );
+        const remainingCreatedWorkspaces = await tx.select({ id: workspaces.id }).from(workspaces).where(eq(workspaces.createdBy, userId));
+        for (const workspace of remainingCreatedWorkspaces) {
+          await tx.delete(workspaceInvites).where(eq(workspaceInvites.workspaceId, workspace.id));
+          await tx.delete(workspaceSettings).where(eq(workspaceSettings.workspaceId, workspace.id));
+          await tx.delete(workspaceRuntimes).where(eq(workspaceRuntimes.workspaceId, workspace.id));
+          await tx.delete(workspaceMembers).where(eq(workspaceMembers.workspaceId, workspace.id));
+          await tx.delete(workspaces).where(eq(workspaces.id, workspace.id));
+        }
+        const [userRow] = await tx.select({ email: users.email }).from(users).where(eq(users.id, userId)).limit(1);
+        if (userRow?.email) {
+          await tx.delete(verification_tokens).where(eq(verification_tokens.identifier, userRow.email));
+        }
+        await tx.delete(users).where(eq(users.id, userId));
+      });
+      return;
+    } catch (error) {
+      if (attempt < SERIALIZATION_RETRY_LIMIT && isRetryableTxFailure(error)) {
+        await sleep(BASE_RETRY_DELAY_MS * attempt);
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+
+// src/server/app/routes.ts
+var HEALTH_DB_TIMEOUT_MS = 2e3;
+async function pingDatabase(sqlClient, timeoutMs) {
+  const timeoutMessage = `Database ping timed out after ${timeoutMs}ms`;
+  let timeoutId;
+  try {
+    await Promise.race([
+      sqlClient`SELECT 1`,
+      new Promise((_, reject) => {
+        timeoutId = setTimeout(() => {
+          reject(new Error(timeoutMessage));
+        }, timeoutMs);
+      })
+    ]);
+    return { ok: true };
+  } catch (error) {
+    if (error instanceof Error && error.message.length > 0) {
+      return { ok: false, message: error.message };
+    }
+    return { ok: false, message: "Database ping failed" };
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
+  }
+}
+var updateSettingsBody = z2.object({
+  displayName: z2.string().optional(),
+  settings: z2.record(z2.unknown()).optional()
+}).strict();
+var deleteMeBody = z2.object({
+  confirm: z2.string().optional()
+}).optional();
+function toHeaders(source) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(source)) {
+    if (!value) continue;
+    headers.set(key, Array.isArray(value) ? value[0] : value);
+  }
+  return headers;
+}
+var routesPlugin = async (app, opts) => {
+  const { sql: sql3, db, userStore } = opts;
+  app.get("/health", async (request, reply) => {
+    if (sql3) {
+      const result = await pingDatabase(sql3, HEALTH_DB_TIMEOUT_MS);
+      if (!result.ok) {
+        reply.status(503);
+        return {
+          error: "db_unavailable",
+          code: ERROR_CODES.DB_UNAVAILABLE,
+          message: result.message,
+          requestId: request.id
+        };
+      }
+    }
+    return { ok: true };
+  });
+  app.get("/api/v1/config", async () => {
+    return buildRuntimeConfigPayload(app.config);
+  });
+  app.get("/api/v1/me", async (request) => {
+    const user = request.user;
+    const settings = await userStore.getUserSettings(user.id, app.config.appId);
+    return { user, settings };
+  });
+  app.put("/api/v1/me/settings", async (request, reply) => {
+    const parsed = updateSettingsBody.safeParse(request.body);
+    if (!parsed.success) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+        requestId: request.id
+      });
+    }
+    const result = await userStore.putUserSettings(
+      request.user.id,
+      app.config.appId,
+      parsed.data
+    );
+    reply.status(200);
+    return result;
+  });
+  app.delete("/api/v1/me", async (request, reply) => {
+    const parsed = deleteMeBody.safeParse(request.body);
+    if (!parsed.success) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+        requestId: request.id
+      });
+    }
+    const user = request.user;
+    if (!user.email || parsed.data?.confirm !== user.email) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: "confirm must match the signed-in email",
+        requestId: request.id
+      });
+    }
+    if (!db) {
+      throw new HttpError({
+        status: 500,
+        code: ERROR_CODES.INTERNAL_ERROR,
+        message: "DELETE /api/v1/me is not configured",
+        requestId: request.id
+      });
+    }
+    const startedAt = Date.now();
+    request.log.info(
+      { event: "user.delete.start", userId: user.id },
+      "user.delete.start"
+    );
+    await deleteUserCompletely(user.id, { db });
+    const signOutResponse = await app.auth.api.signOut({
+      headers: toHeaders(request.headers),
+      asResponse: true
+    });
+    const responseHeaders = signOutResponse.headers;
+    const setCookies = typeof responseHeaders.getSetCookie === "function" ? responseHeaders.getSetCookie() : responseHeaders.get("set-cookie") ? [responseHeaders.get("set-cookie")] : [];
+    if (setCookies.length > 0) {
+      reply.header("set-cookie", setCookies.length === 1 ? setCookies[0] : setCookies);
+    }
+    request.log.info(
+      {
+        event: "user.delete.complete",
+        userId: user.id,
+        durationMs: Date.now() - startedAt
+      },
+      "user.delete.complete"
+    );
+    reply.status(200);
+    return { deleted: true };
+  });
+};
+var registerRoutes = fp(routesPlugin, { name: "core-routes" });
+
+// src/server/mail/transport.ts
+var MailDeliveryError = class extends Error {
+  statusCode;
+  constructor(message, statusCode) {
+    super(message);
+    this.name = "MailDeliveryError";
+    this.statusCode = statusCode;
+  }
+};
+function createMailTransport(url, from, env = "development") {
+  if (url.startsWith("resend://")) {
+    const apiKey = url.slice("resend://".length);
+    return new ResendTransport(apiKey, from);
+  }
+  if (url.startsWith("smtp://") || url.startsWith("smtps://")) {
+    return new SmtpTransport(url, from);
+  }
+  if (url.startsWith("console-capture://")) {
+    if (env !== "test") {
+      throw new ConfigValidationError([
+        {
+          message: "console-capture:// transport is only allowed in test env",
+          path: ["auth", "mail", "transportUrl"]
+        }
+      ]);
+    }
+    const outputPath = url.slice("console-capture://".length) || void 0;
+    return new ConsoleCaptureTransport(outputPath);
+  }
+  if (url.startsWith("console://")) {
+    if (env === "production") {
+      throw new ConfigValidationError([
+        {
+          message: "console mail transport is not allowed in production",
+          path: ["auth", "mail", "transportUrl"]
+        }
+      ]);
+    }
+    return new ConsoleTransport();
+  }
+  throw new ConfigValidationError([
+    {
+      message: `Unknown mail transport scheme: ${url.split("://")[0]}://. Expected resend://, smtp://, smtps://, console://, or console-capture://`,
+      path: ["auth", "mail", "transportUrl"]
+    }
+  ]);
+}
+async function fetchWithRetry(url, init, maxRetries = 3) {
+  const delays = [500, 1e3, 2e3];
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    const delay = delays[Math.min(attempt, delays.length - 1)];
+    let response;
+    try {
+      response = await fetch(url, init);
+    } catch (err) {
+      if (attempt < maxRetries) {
+        await new Promise((r) => setTimeout(r, delay));
+        continue;
+      }
+      throw new MailDeliveryError(
+        `Network error after ${maxRetries + 1} attempts: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (response.ok) return response;
+    if (response.status >= 400 && response.status < 500) {
+      const body3 = await response.text();
+      throw new MailDeliveryError(
+        `Resend API error ${response.status}: ${body3}`,
+        response.status
+      );
+    }
+    if (attempt < maxRetries) {
+      await new Promise((r) => setTimeout(r, delay));
+      continue;
+    }
+    const body2 = await response.text();
+    throw new MailDeliveryError(
+      `Resend API error ${response.status} after ${maxRetries + 1} attempts: ${body2}`,
+      response.status
+    );
+  }
+  throw new MailDeliveryError("Unreachable");
+}
+var ResendTransport = class {
+  constructor(apiKey, from) {
+    this.apiKey = apiKey;
+    this.from = from;
+  }
+  apiKey;
+  from;
+  async send(email) {
+    const response = await fetchWithRetry(
+      "https://api.resend.com/emails",
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.apiKey}`
+        },
+        body: JSON.stringify({
+          from: this.from,
+          to: email.to,
+          subject: email.subject,
+          html: email.html,
+          text: email.text
+        })
+      }
+    );
+    const data = await response.json();
+    return { id: data.id };
+  }
+};
+var SmtpTransport = class {
+  connectionUrl;
+  from;
+  constructor(url, from) {
+    this.connectionUrl = url;
+    this.from = from;
+  }
+  async send(email) {
+    try {
+      const { createTransport } = await import("nodemailer");
+      const transporter = createTransport(this.connectionUrl);
+      const info = await transporter.sendMail({
+        from: this.from,
+        to: email.to,
+        subject: email.subject,
+        html: email.html,
+        text: email.text
+      });
+      return { id: info.messageId };
+    } catch (err) {
+      if (err instanceof MailDeliveryError) throw err;
+      throw new MailDeliveryError(
+        `SMTP send failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+};
+var consoleCounter = 0;
+var ConsoleTransport = class {
+  async send(email) {
+    const id = `console-${++consoleCounter}-${Date.now()}`;
+    const logEntry = {
+      type: "mail_sent",
+      id,
+      to: email.to,
+      subject: email.subject,
+      html: email.html,
+      text: email.text,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    console.info("[mail:console]", JSON.stringify(logEntry));
+    return { id };
+  }
+};
+var ConsoleCaptureTransport = class {
+  constructor(outputPath) {
+    this.outputPath = outputPath;
+  }
+  outputPath;
+  async send(email) {
+    const id = `capture-${++consoleCounter}-${Date.now()}`;
+    const logEntry = {
+      type: "mail_sent",
+      id,
+      to: email.to,
+      subject: email.subject,
+      html: email.html,
+      text: email.text,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    console.info("[mail:console-capture]", JSON.stringify(logEntry));
+    const { appendFileSync } = await import("fs");
+    const path = this.outputPath ?? `/tmp/test-mail-${process.pid}.log`;
+    appendFileSync(path, JSON.stringify(logEntry) + "\n");
+    return { id };
+  }
+};
+
+// src/server/mail/templates/index.ts
+import { render } from "@react-email/render";
+
+// src/server/mail/templates/VerifyEmail.tsx
+import { Button, Section as Section2, Text as Text2 } from "@react-email/components";
+
+// src/server/mail/templates/Layout.tsx
+import {
+  Body,
+  Container,
+  Head,
+  Html,
+  Preview,
+  Section,
+  Text,
+  Hr
+} from "@react-email/components";
+import { jsx, jsxs } from "react/jsx-runtime";
+function Layout({ preview, appName, children }) {
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Preview, { children: preview }),
+    /* @__PURE__ */ jsx(Body, { style: body, children: /* @__PURE__ */ jsxs(Container, { style: container, children: [
+      /* @__PURE__ */ jsx(Section, { style: header, children: /* @__PURE__ */ jsx(Text, { style: logo, children: appName }) }),
+      children,
+      /* @__PURE__ */ jsx(Hr, { style: hr }),
+      /* @__PURE__ */ jsxs(Text, { style: footer, children: [
+        "\xA9 ",
+        (/* @__PURE__ */ new Date()).getFullYear(),
+        " ",
+        appName,
+        ". All rights reserved."
+      ] })
+    ] }) })
+  ] });
+}
+var body = {
+  backgroundColor: "#f6f9fc",
+  fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Ubuntu, sans-serif'
+};
+var container = {
+  backgroundColor: "#ffffff",
+  margin: "0 auto",
+  padding: "20px 0 48px",
+  marginBottom: "64px",
+  maxWidth: "560px"
+};
+var header = {
+  padding: "0 48px"
+};
+var logo = {
+  fontSize: "20px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "20px 0"
+};
+var hr = {
+  borderColor: "#e6ebf1",
+  margin: "20px 48px"
+};
+var footer = {
+  color: "#8898aa",
+  fontSize: "12px",
+  lineHeight: "16px",
+  padding: "0 48px"
+};
+
+// src/server/mail/templates/VerifyEmail.tsx
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function VerifyEmail({
+  verifyUrl,
+  appName,
+  expiresInHours
+}) {
+  return /* @__PURE__ */ jsx2(Layout, { preview: `Verify your ${appName} email address`, appName, children: /* @__PURE__ */ jsxs2(Section2, { style: content, children: [
+    /* @__PURE__ */ jsx2(Text2, { style: heading, children: "Verify your email address" }),
+    /* @__PURE__ */ jsxs2(Text2, { style: paragraph, children: [
+      "Click the button below to verify your email address and activate your",
+      " ",
+      appName,
+      " account."
+    ] }),
+    /* @__PURE__ */ jsx2(Button, { style: button, href: verifyUrl, children: "Verify email" }),
+    /* @__PURE__ */ jsxs2(Text2, { style: hint, children: [
+      "This link expires in ",
+      expiresInHours,
+      " ",
+      expiresInHours === 1 ? "hour" : "hours",
+      ". If you didn't create an account, you can safely ignore this email."
+    ] })
+  ] }) });
+}
+var content = { padding: "0 48px" };
+var heading = {
+  fontSize: "24px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "0 0 16px"
+};
+var paragraph = {
+  fontSize: "14px",
+  lineHeight: "24px",
+  color: "#525f7f",
+  margin: "0 0 24px"
+};
+var button = {
+  backgroundColor: "#1a1a1a",
+  borderRadius: "6px",
+  color: "#ffffff",
+  fontSize: "14px",
+  fontWeight: "600",
+  textDecoration: "none",
+  textAlign: "center",
+  display: "block",
+  padding: "12px 24px"
+};
+var hint = {
+  fontSize: "12px",
+  lineHeight: "20px",
+  color: "#8898aa",
+  margin: "24px 0 0"
+};
+
+// src/server/mail/templates/ResetPassword.tsx
+import { Button as Button2, Section as Section3, Text as Text3 } from "@react-email/components";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function ResetPassword({
+  resetUrl,
+  appName,
+  expiresInHours
+}) {
+  return /* @__PURE__ */ jsx3(
+    Layout,
+    {
+      preview: `Reset your ${appName} password`,
+      appName,
+      children: /* @__PURE__ */ jsxs3(Section3, { style: content2, children: [
+        /* @__PURE__ */ jsx3(Text3, { style: heading2, children: "Reset your password" }),
+        /* @__PURE__ */ jsxs3(Text3, { style: paragraph2, children: [
+          "We received a request to reset your ",
+          appName,
+          " password. Click the button below to choose a new one."
+        ] }),
+        /* @__PURE__ */ jsx3(Button2, { style: button2, href: resetUrl, children: "Reset password" }),
+        /* @__PURE__ */ jsxs3(Text3, { style: hint2, children: [
+          "This link expires in ",
+          expiresInHours,
+          " ",
+          expiresInHours === 1 ? "hour" : "hours",
+          ". If you didn't request a password reset, you can safely ignore this email."
+        ] })
+      ] })
+    }
+  );
+}
+var content2 = { padding: "0 48px" };
+var heading2 = {
+  fontSize: "24px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "0 0 16px"
+};
+var paragraph2 = {
+  fontSize: "14px",
+  lineHeight: "24px",
+  color: "#525f7f",
+  margin: "0 0 24px"
+};
+var button2 = {
+  backgroundColor: "#1a1a1a",
+  borderRadius: "6px",
+  color: "#ffffff",
+  fontSize: "14px",
+  fontWeight: "600",
+  textDecoration: "none",
+  textAlign: "center",
+  display: "block",
+  padding: "12px 24px"
+};
+var hint2 = {
+  fontSize: "12px",
+  lineHeight: "20px",
+  color: "#8898aa",
+  margin: "24px 0 0"
+};
+
+// src/server/mail/templates/MagicLink.tsx
+import { Button as Button3, Section as Section4, Text as Text4 } from "@react-email/components";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function MagicLink({
+  loginUrl,
+  appName,
+  expiresInMinutes
+}) {
+  return /* @__PURE__ */ jsx4(Layout, { preview: `Sign in to ${appName}`, appName, children: /* @__PURE__ */ jsxs4(Section4, { style: content3, children: [
+    /* @__PURE__ */ jsxs4(Text4, { style: heading3, children: [
+      "Sign in to ",
+      appName
+    ] }),
+    /* @__PURE__ */ jsx4(Text4, { style: paragraph3, children: "Click the button below to sign in. No password needed." }),
+    /* @__PURE__ */ jsx4(Button3, { style: button3, href: loginUrl, children: "Sign in" }),
+    /* @__PURE__ */ jsxs4(Text4, { style: hint3, children: [
+      "This link expires in ",
+      expiresInMinutes,
+      " ",
+      expiresInMinutes === 1 ? "minute" : "minutes",
+      ". If you didn't request this, you can safely ignore this email."
+    ] })
+  ] }) });
+}
+var content3 = { padding: "0 48px" };
+var heading3 = {
+  fontSize: "24px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "0 0 16px"
+};
+var paragraph3 = {
+  fontSize: "14px",
+  lineHeight: "24px",
+  color: "#525f7f",
+  margin: "0 0 24px"
+};
+var button3 = {
+  backgroundColor: "#1a1a1a",
+  borderRadius: "6px",
+  color: "#ffffff",
+  fontSize: "14px",
+  fontWeight: "600",
+  textDecoration: "none",
+  textAlign: "center",
+  display: "block",
+  padding: "12px 24px"
+};
+var hint3 = {
+  fontSize: "12px",
+  lineHeight: "20px",
+  color: "#8898aa",
+  margin: "24px 0 0"
+};
+
+// src/server/mail/templates/WorkspaceInvite.tsx
+import { Button as Button4, Section as Section5, Text as Text5 } from "@react-email/components";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+function WorkspaceInvite({
+  acceptUrl,
+  inviterName,
+  workspaceName,
+  role,
+  expiresInDays
+}) {
+  return /* @__PURE__ */ jsx5(
+    Layout,
+    {
+      preview: `${inviterName} invited you to ${workspaceName}`,
+      appName: workspaceName,
+      children: /* @__PURE__ */ jsxs5(Section5, { style: content4, children: [
+        /* @__PURE__ */ jsx5(Text5, { style: heading4, children: "You've been invited" }),
+        /* @__PURE__ */ jsxs5(Text5, { style: paragraph4, children: [
+          inviterName,
+          " invited you to join ",
+          /* @__PURE__ */ jsx5("strong", { children: workspaceName }),
+          " as a",
+          " ",
+          /* @__PURE__ */ jsx5("strong", { children: role }),
+          "."
+        ] }),
+        /* @__PURE__ */ jsx5(Button4, { style: button4, href: acceptUrl, children: "Accept invitation" }),
+        /* @__PURE__ */ jsxs5(Text5, { style: hint4, children: [
+          "This invitation expires in ",
+          expiresInDays,
+          " ",
+          expiresInDays === 1 ? "day" : "days",
+          ". If you don't recognize this workspace, you can safely ignore this email."
+        ] })
+      ] })
+    }
+  );
+}
+var content4 = { padding: "0 48px" };
+var heading4 = {
+  fontSize: "24px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "0 0 16px"
+};
+var paragraph4 = {
+  fontSize: "14px",
+  lineHeight: "24px",
+  color: "#525f7f",
+  margin: "0 0 24px"
+};
+var button4 = {
+  backgroundColor: "#1a1a1a",
+  borderRadius: "6px",
+  color: "#ffffff",
+  fontSize: "14px",
+  fontWeight: "600",
+  textDecoration: "none",
+  textAlign: "center",
+  display: "block",
+  padding: "12px 24px"
+};
+var hint4 = {
+  fontSize: "12px",
+  lineHeight: "20px",
+  color: "#8898aa",
+  margin: "24px 0 0"
+};
+
+// src/server/mail/templates/Welcome.tsx
+import { Button as Button5, Section as Section6, Text as Text6 } from "@react-email/components";
+import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function Welcome({ appName, getStartedUrl }) {
+  return /* @__PURE__ */ jsx6(Layout, { preview: `Welcome to ${appName}`, appName, children: /* @__PURE__ */ jsxs6(Section6, { style: content5, children: [
+    /* @__PURE__ */ jsxs6(Text6, { style: heading5, children: [
+      "Welcome to ",
+      appName
+    ] }),
+    /* @__PURE__ */ jsx6(Text6, { style: paragraph5, children: "Your account is ready. Click below to get started." }),
+    /* @__PURE__ */ jsx6(Button5, { style: button5, href: getStartedUrl, children: "Get started" })
+  ] }) });
+}
+var content5 = { padding: "0 48px" };
+var heading5 = {
+  fontSize: "24px",
+  fontWeight: "bold",
+  color: "#1a1a1a",
+  margin: "0 0 16px"
+};
+var paragraph5 = {
+  fontSize: "14px",
+  lineHeight: "24px",
+  color: "#525f7f",
+  margin: "0 0 24px"
+};
+var button5 = {
+  backgroundColor: "#1a1a1a",
+  borderRadius: "6px",
+  color: "#ffffff",
+  fontSize: "14px",
+  fontWeight: "600",
+  textDecoration: "none",
+  textAlign: "center",
+  display: "block",
+  padding: "12px 24px"
+};
+
+// src/server/mail/templates/index.ts
+async function renderVerifyEmail(data) {
+  const element = VerifyEmail({
+    verifyUrl: data.verifyUrl,
+    appName: data.appName,
+    expiresInHours: data.expiresInHours
+  });
+  return {
+    to: data.to,
+    subject: `Verify your ${data.appName} email address`,
+    html: await render(element),
+    text: await render(element, { plainText: true })
+  };
+}
+async function renderResetPassword(data) {
+  const element = ResetPassword({
+    resetUrl: data.resetUrl,
+    appName: data.appName,
+    expiresInHours: data.expiresInHours
+  });
+  return {
+    to: data.to,
+    subject: `Reset your ${data.appName} password`,
+    html: await render(element),
+    text: await render(element, { plainText: true })
+  };
+}
+async function renderMagicLink(data) {
+  const element = MagicLink({
+    loginUrl: data.loginUrl,
+    appName: data.appName,
+    expiresInMinutes: data.expiresInMinutes
+  });
+  return {
+    to: data.to,
+    subject: `Sign in to ${data.appName}`,
+    html: await render(element),
+    text: await render(element, { plainText: true })
+  };
+}
+async function renderWorkspaceInvite(data) {
+  const element = WorkspaceInvite({
+    acceptUrl: data.acceptUrl,
+    inviterName: data.inviterName,
+    workspaceName: data.workspaceName,
+    role: data.role,
+    expiresInDays: data.expiresInDays
+  });
+  return {
+    to: data.to,
+    subject: `${data.inviterName} invited you to ${data.workspaceName}`,
+    html: await render(element),
+    text: await render(element, { plainText: true })
+  };
+}
+async function renderWelcome(data) {
+  const element = Welcome({
+    appName: data.appName,
+    getStartedUrl: data.getStartedUrl
+  });
+  return {
+    to: data.to,
+    subject: `Welcome to ${data.appName}`,
+    html: await render(element),
+    text: await render(element, { plainText: true })
+  };
+}
+
+// src/server/auth/postSignupHook.ts
+import { createHash } from "crypto";
+function readHeader(ctx, name) {
+  if (!ctx) return null;
+  const fromGetHeader = ctx.getHeader?.(name);
+  if (fromGetHeader) return fromGetHeader;
+  const ctxAny = ctx;
+  const req = ctxAny.request;
+  return req?.headers?.get?.(name) ?? null;
+}
+function createPostSignupHook(deps) {
+  const { config, workspaceStore, transport, logger } = deps;
+  return async function postSignupHook(user, rawCtx) {
+    const ctx = rawCtx;
+    const inviteToken = readHeader(ctx, "x-invite-token");
+    let inviteAccepted = false;
+    if (inviteToken) {
+      try {
+        const failureCode = await tryAcceptInvite(user, inviteToken);
+        if (failureCode) {
+          logger?.warn(
+            { userId: user.id, email: user.email, code: failureCode },
+            "post-signup invite acceptance failed"
+          );
+          ctx?.setCookie?.("boring_invite_failed", failureCode, {
+            maxAge: 60,
+            path: "/",
+            httpOnly: false,
+            sameSite: "lax"
+          });
+        } else {
+          inviteAccepted = true;
+        }
+      } catch (err) {
+        logger?.warn(
+          { userId: user.id, email: user.email, error: err instanceof Error ? err.message : String(err) },
+          "post-signup invite acceptance threw unexpectedly"
+        );
+      }
+    }
+    if (!inviteAccepted) {
+      await workspaceStore.create(user.id, "My Workspace", config.appId, { isDefault: true });
+    }
+    if (!inviteAccepted && config.features.sendWelcomeEmail !== false && transport) {
+      const getStartedUrl = `${config.auth.url}/`;
+      try {
+        const email = await renderWelcome({
+          to: user.email,
+          appName: config.appName,
+          getStartedUrl
+        });
+        await transport.send(email);
+      } catch (err) {
+        logger?.warn(
+          { userId: user.id, err },
+          "failed to send welcome email"
+        );
+      }
+    }
+  };
+  async function tryAcceptInvite(user, rawToken) {
+    const tokenHash = createHash("sha256").update(rawToken).digest("hex");
+    const invite = await workspaceStore.getInviteByTokenHash(tokenHash);
+    if (!invite) return "invite_not_found";
+    if (invite.lockedUntil && new Date(invite.lockedUntil) > /* @__PURE__ */ new Date()) return "invite_not_found";
+    if (invite.acceptedAt) return "invite_already_accepted";
+    if (new Date(invite.expiresAt) <= /* @__PURE__ */ new Date()) return "invite_expired";
+    if (invite.email.toLowerCase() !== user.email.toLowerCase()) return "invite_email_mismatch";
+    await workspaceStore.acceptInvite(invite.workspaceId, invite.id, user.id);
+    return null;
+  }
+}
+
+// src/server/auth/createAuth.ts
+import { betterAuth, APIError } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { magicLink } from "better-auth/plugins/magic-link";
+import { zxcvbn, zxcvbnOptions } from "@zxcvbn-ts/core";
+import * as zxcvbnCommon from "@zxcvbn-ts/language-common";
+import * as zxcvbnEn from "@zxcvbn-ts/language-en";
+var MIN_ZXCVBN_SCORE = 2;
+var zxcvbnInitialized = false;
+function ensureZxcvbn() {
+  if (zxcvbnInitialized) return;
+  zxcvbnOptions.setOptions({
+    translations: zxcvbnEn.translations,
+    graphs: zxcvbnCommon.adjacencyGraphs,
+    dictionary: {
+      ...zxcvbnCommon.dictionary,
+      ...zxcvbnEn.dictionary
+    }
+  });
+  zxcvbnInitialized = true;
+}
+function validatePasswordStrength(password) {
+  ensureZxcvbn();
+  const result = zxcvbn(password);
+  if (result.score < MIN_ZXCVBN_SCORE) {
+    return {
+      valid: false,
+      message: "This password is too common. Please choose another."
+    };
+  }
+  return { valid: true };
+}
+function buildMailTransport(config) {
+  if (!config.auth.mail) return null;
+  const env = process.env.NODE_ENV === "production" ? "production" : process.env.NODE_ENV === "test" ? "test" : "development";
+  return createMailTransport(config.auth.mail.transportUrl, config.auth.mail.from, env);
+}
+function createAuth(config, db, opts) {
+  const transport = buildMailTransport(config);
+  const emailVerificationConfig = transport ? {
+    sendOnSignUp: true,
+    sendVerificationEmail: async (data) => {
+      const email = await renderVerifyEmail({
+        to: data.user.email,
+        verifyUrl: data.url,
+        appName: config.appName,
+        expiresInHours: 24
+      });
+      await transport.send(email);
+    }
+  } : void 0;
+  const sendResetPasswordFn = transport ? async (data) => {
+    const email = await renderResetPassword({
+      to: data.user.email,
+      resetUrl: data.url,
+      appName: config.appName,
+      expiresInHours: 1
+    });
+    await transport.send(email);
+  } : void 0;
+  const plugins = transport ? [
+    magicLink({
+      sendMagicLink: async (data) => {
+        const email = await renderMagicLink({
+          to: data.email,
+          loginUrl: data.url,
+          appName: config.appName,
+          expiresInMinutes: 10
+        });
+        await transport.send(email);
+      }
+    })
+  ] : [];
+  const postSignupHook = opts?.workspaceStore ? createPostSignupHook({
+    config,
+    workspaceStore: opts.workspaceStore,
+    transport,
+    logger: opts.logger
+  }) : void 0;
+  return betterAuth({
+    database: drizzleAdapter(db, { provider: "pg", schema: schema_exports }),
+    secret: config.auth.secret,
+    baseURL: config.auth.url,
+    basePath: "/auth",
+    trustedOrigins: config.cors.origins,
+    databaseHooks: postSignupHook ? {
+      user: {
+        create: {
+          after: postSignupHook
+        }
+      }
+    } : void 0,
+    advanced: {
+      database: {
+        generateId: "uuid"
+      },
+      cookiePrefix: config.appId,
+      useSecureCookies: config.auth.sessionCookieSecure
+    },
+    user: {
+      modelName: "users",
+      fields: {
+        emailVerified: "email_verified",
+        createdAt: "created_at",
+        updatedAt: "updated_at"
+      }
+    },
+    session: {
+      modelName: "sessions",
+      expiresIn: config.auth.sessionTtlSeconds,
+      fields: {
+        expiresAt: "expires_at",
+        ipAddress: "ip_address",
+        userAgent: "user_agent",
+        createdAt: "created_at",
+        updatedAt: "updated_at"
+      }
+    },
+    account: {
+      modelName: "accounts",
+      fields: {
+        accountId: "account_id",
+        providerId: "provider_id",
+        accessToken: "access_token",
+        refreshToken: "refresh_token",
+        accessTokenExpiresAt: "access_token_expires_at",
+        refreshTokenExpiresAt: "refresh_token_expires_at",
+        idToken: "id_token",
+        createdAt: "created_at",
+        updatedAt: "updated_at"
+      }
+    },
+    verification: {
+      modelName: "verification_tokens",
+      fields: {
+        expiresAt: "expires_at",
+        createdAt: "created_at",
+        updatedAt: "updated_at"
+      }
+    },
+    emailAndPassword: {
+      enabled: true,
+      minPasswordLength: 8,
+      sendResetPassword: sendResetPasswordFn,
+      password: {
+        async hash(password) {
+          const check = validatePasswordStrength(password);
+          if (!check.valid) {
+            throw APIError.from("BAD_REQUEST", {
+              message: check.message,
+              code: "WEAK_PASSWORD"
+            });
+          }
+          const { hashPassword } = await import("better-auth/crypto");
+          return hashPassword(password);
+        }
+      }
+    },
+    emailVerification: emailVerificationConfig,
+    socialProviders: config.auth.github ? { github: { clientId: config.auth.github.clientId, clientSecret: config.auth.github.clientSecret } } : {},
+    plugins
+  });
+}
+
+// src/server/auth/authHook.ts
+import fp2 from "fastify-plugin";
+var DEFAULT_PUBLIC = [
+  /^\/auth\//,
+  /^\/health$/,
+  /^\/api\/v1\/config$/
+];
+var authHookPlugin = async (app, opts) => {
+  const publicPatterns = opts.public ?? DEFAULT_PUBLIC;
+  app.addHook("onRequest", async (request, _reply) => {
+    request.user = null;
+    if (app.auth) {
+      try {
+        const headers = new Headers();
+        for (const [key, val] of Object.entries(request.headers)) {
+          if (val) headers.set(key, Array.isArray(val) ? val[0] : val);
+        }
+        const result = await app.auth.api.getSession({ headers });
+        if (result?.user) {
+          request.user = {
+            id: result.user.id,
+            email: result.user.email,
+            name: result.user.name ?? null
+          };
+        }
+      } catch {
+        request.user = null;
+      }
+    }
+    const path = request.url.split("?")[0];
+    if (path.startsWith("/api/v1/") && !publicPatterns.some((re) => re.test(path)) && !request.user) {
+      throw new HttpError({
+        status: 401,
+        code: ERROR_CODES.UNAUTHORIZED,
+        message: "Authentication required",
+        requestId: request.id
+      });
+    }
+  });
+};
+var authHook = fp2(authHookPlugin, { name: "auth-hook" });
+
+// src/server/auth/requireWorkspaceMember.ts
+var ROLE_LEVELS = {
+  viewer: 0,
+  editor: 1,
+  owner: 2
+};
+var WORKSPACE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+function requireWorkspaceMember(minimumRole) {
+  return async function(request, _reply) {
+    const user = request.user;
+    if (!user) {
+      throw new Error(
+        "requireWorkspaceMember: request.user is null \u2014 authHook must run before this hook"
+      );
+    }
+    const workspaceId = request.params.id;
+    if (!workspaceId) {
+      throw new Error(
+        "requireWorkspaceMember: missing :id param \u2014 route must include :id"
+      );
+    }
+    if (!WORKSPACE_ID_RE.test(workspaceId)) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: "Invalid workspace id",
+        requestId: request.id
+      });
+    }
+    const workspace = await request.server.workspaceStore.get(workspaceId);
+    if (!workspace || workspace.appId !== request.server.config.appId) {
+      throw new HttpError({
+        status: 404,
+        code: ERROR_CODES.NOT_FOUND,
+        message: "Workspace not found",
+        requestId: request.id
+      });
+    }
+    const role = await request.server.workspaceStore.getMemberRole(
+      workspaceId,
+      user.id
+    );
+    if (!role) {
+      throw new HttpError({
+        status: 403,
+        code: ERROR_CODES.NOT_MEMBER,
+        message: "Not a member of this workspace",
+        requestId: request.id
+      });
+    }
+    if (minimumRole && ROLE_LEVELS[role] < ROLE_LEVELS[minimumRole]) {
+      throw new HttpError({
+        status: 403,
+        code: ERROR_CODES.FORBIDDEN,
+        message: `Requires ${minimumRole} role or higher`,
+        requestId: request.id
+      });
+    }
+  };
+}
+
+// src/server/routes/workspaces.ts
+import fp3 from "fastify-plugin";
+
+// src/server/routes/__schemas__/workspaces.ts
+import { z as z3 } from "zod";
+var createWorkspaceBody = z3.object({
+  name: z3.string().min(1, "Name is required").max(100, "Name must be 100 characters or fewer")
+}).strict();
+var updateWorkspaceBody = z3.object({
+  name: z3.string().min(1, "Name is required").max(100, "Name must be 100 characters or fewer").optional()
+}).strict();
+
+// src/server/routes/workspaces.ts
+var workspaceRoutesPlugin = async (app) => {
+  const store = app.workspaceStore;
+  const provisioner = app.provisioner;
+  app.post("/api/v1/workspaces", async (request, reply) => {
+    const parsed = createWorkspaceBody.safeParse(request.body);
+    if (!parsed.success) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+        requestId: request.id
+      });
+    }
+    const user = request.user;
+    const existing = await store.list(user.id, app.config.appId);
+    const isDefault = existing.length === 0;
+    const workspace = await store.create(user.id, parsed.data.name, app.config.appId, { isDefault });
+    if (provisioner) {
+      await store.putWorkspaceRuntime(workspace.id, { state: "pending" });
+      try {
+        const result = await provisioner.provision({
+          workspaceId: workspace.id,
+          workspaceName: workspace.name,
+          ownerId: user.id,
+          appId: app.config.appId
+        });
+        await store.putWorkspaceRuntime(workspace.id, {
+          state: "ready",
+          volumePath: result.volumePath
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        await store.putWorkspaceRuntime(workspace.id, {
+          state: "error",
+          lastError: message,
+          lastErrorOp: "provision"
+        });
+        request.log.error({ workspaceId: workspace.id, err }, "workspace.provision.failed");
+        throw new HttpError({
+          status: 500,
+          code: ERROR_CODES.PROVISION_FAILED,
+          message: "Workspace provisioning failed",
+          requestId: request.id
+        });
+      }
+    }
+    request.log.info({ workspaceId: workspace.id, userId: user.id }, "workspace.create");
+    reply.status(201);
+    return { workspace, role: "owner" };
+  });
+  app.get("/api/v1/workspaces", async (request) => {
+    const workspaces2 = await store.list(request.user.id, app.config.appId);
+    return { workspaces: workspaces2 };
+  });
+  app.get(
+    "/api/v1/workspaces/:id",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id } = request.params;
+      const workspace = await store.get(id);
+      if (!workspace) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_FOUND,
+          message: "Workspace not found",
+          requestId: request.id
+        });
+      }
+      const role = await store.getMemberRole(id, request.user.id);
+      return { workspace, role };
+    }
+  );
+  app.put(
+    "/api/v1/workspaces/:id",
+    { preHandler: requireWorkspaceMember("editor") },
+    async (request) => {
+      const { id } = request.params;
+      const parsed = updateWorkspaceBody.safeParse(request.body);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+          requestId: request.id
+        });
+      }
+      if (Object.keys(parsed.data).length === 0) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: "At least one field must be provided",
+          requestId: request.id
+        });
+      }
+      const workspace = await store.update(id, parsed.data);
+      if (!workspace) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_FOUND,
+          message: "Workspace not found",
+          requestId: request.id
+        });
+      }
+      request.log.info({ workspaceId: id }, "workspace.update");
+      return { workspace };
+    }
+  );
+  app.delete(
+    "/api/v1/workspaces/:id",
+    { preHandler: requireWorkspaceMember("owner") },
+    async (request) => {
+      const { id } = request.params;
+      request.log.info({ workspaceId: id }, "workspace.delete.start");
+      if (provisioner) {
+        try {
+          await provisioner.destroy(id);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          await store.putWorkspaceRuntime(id, {
+            state: "error",
+            lastError: message,
+            lastErrorOp: "destroy"
+          });
+          request.log.error({ workspaceId: id, err }, "workspace.destroy.failed");
+          throw new HttpError({
+            status: 500,
+            code: ERROR_CODES.DESTROY_FAILED,
+            message: "Workspace destruction failed",
+            requestId: request.id
+          });
+        }
+      }
+      const result = await store.delete(id);
+      if (result.removed) {
+        request.log.info({ workspaceId: id }, "workspace.delete.complete");
+        return { deleted: true };
+      }
+      throw new HttpError({
+        status: 404,
+        code: ERROR_CODES.NOT_FOUND,
+        message: "Workspace not found",
+        requestId: request.id
+      });
+    }
+  );
+};
+var registerWorkspaceRoutes = fp3(workspaceRoutesPlugin, { name: "workspace-routes" });
+
+// src/server/routes/members.ts
+import fp4 from "fastify-plugin";
+
+// src/server/routes/__schemas__/members.ts
+import { z as z4 } from "zod";
+var addMemberBody = z4.object({
+  userId: z4.string().uuid("userId must be a valid UUID"),
+  role: z4.enum(["owner", "editor", "viewer"])
+}).strict();
+var updateRoleBody = z4.object({
+  role: z4.enum(["owner", "editor", "viewer"])
+}).strict();
+
+// src/server/routes/members.ts
+var memberRoutesPlugin = async (app) => {
+  const store = app.workspaceStore;
+  app.get(
+    "/api/v1/workspaces/:id/members",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id } = request.params;
+      const members = await store.listMembers(id);
+      return { members };
+    }
+  );
+  app.post(
+    "/api/v1/workspaces/:id/members",
+    { preHandler: requireWorkspaceMember("owner") },
+    async (request, reply) => {
+      const { id } = request.params;
+      const parsed = addMemberBody.safeParse(request.body);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+          requestId: request.id
+        });
+      }
+      const existing = await store.getMemberRole(id, parsed.data.userId);
+      if (existing) {
+        throw new HttpError({
+          status: 409,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: "User is already a member of this workspace",
+          requestId: request.id
+        });
+      }
+      const member = await store.upsertMember(id, parsed.data.userId, parsed.data.role);
+      reply.status(201);
+      return { member };
+    }
+  );
+  app.patch(
+    "/api/v1/workspaces/:id/members/:userId/role",
+    { preHandler: requireWorkspaceMember("owner") },
+    async (request) => {
+      const { id, userId } = request.params;
+      const parsed = updateRoleBody.safeParse(request.body);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+          requestId: request.id
+        });
+      }
+      const result = await store.updateMemberRole(id, userId, parsed.data.role);
+      if (result.member) {
+        return { member: result.member };
+      }
+      if (result.code === ERROR_CODES.LAST_OWNER) {
+        throw new HttpError({
+          status: 409,
+          code: ERROR_CODES.LAST_OWNER,
+          message: "Cannot demote the last owner",
+          requestId: request.id
+        });
+      }
+      if (result.code === ERROR_CODES.NOT_MEMBER) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_MEMBER,
+          message: "User is not a member of this workspace",
+          requestId: request.id
+        });
+      }
+      throw new HttpError({
+        status: 500,
+        code: ERROR_CODES.INTERNAL_ERROR,
+        message: "Unexpected error updating role",
+        requestId: request.id
+      });
+    }
+  );
+  app.delete(
+    "/api/v1/workspaces/:id/members/:userId",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id, userId } = request.params;
+      const isSelfRemoval = request.user?.id === userId;
+      if (!isSelfRemoval) {
+        const callerRole = await store.getMemberRole(id, request.user.id);
+        if (callerRole !== "owner") {
+          throw new HttpError({
+            status: 403,
+            code: ERROR_CODES.FORBIDDEN,
+            message: "Only owners can remove other members",
+            requestId: request.id
+          });
+        }
+      }
+      const result = await store.removeMember(id, userId);
+      if (result.removed) {
+        return { removed: true };
+      }
+      if (result.code === ERROR_CODES.LAST_OWNER) {
+        throw new HttpError({
+          status: 409,
+          code: ERROR_CODES.LAST_OWNER,
+          message: "Cannot remove the last owner",
+          requestId: request.id
+        });
+      }
+      if (result.code === ERROR_CODES.NOT_MEMBER) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_MEMBER,
+          message: "User is not a member of this workspace",
+          requestId: request.id
+        });
+      }
+      throw new HttpError({
+        status: 500,
+        code: ERROR_CODES.INTERNAL_ERROR,
+        message: "Unexpected error removing member",
+        requestId: request.id
+      });
+    }
+  );
+};
+var registerMemberRoutes = fp4(memberRoutesPlugin, { name: "member-routes" });
+
+// src/server/middleware/idempotency.ts
+import { eq as eq2, lt, sql as sql2 } from "drizzle-orm";
+function createDrizzleIdempotencyStore(db) {
+  return {
+    async sweep() {
+      await db.delete(idempotencyKeys).where(
+        lt(idempotencyKeys.createdAt, sql2`now() - interval '24 hours'`)
+      );
+    },
+    async find(key) {
+      const rows = await db.select({
+        responseStatus: idempotencyKeys.responseStatus,
+        responseBody: idempotencyKeys.responseBody
+      }).from(idempotencyKeys).where(eq2(idempotencyKeys.key, key)).limit(1);
+      return rows[0] ?? null;
+    },
+    async set(key, scope, status, body2) {
+      await db.insert(idempotencyKeys).values({ key, scope, responseStatus: status, responseBody: body2 }).onConflictDoNothing();
+    }
+  };
+}
+var REQUEST_KEY = "__idempotencyKey";
+var REQUEST_SCOPE = "__idempotencyScope";
+function createIdempotencyMiddleware(store) {
+  function guard(scope) {
+    return async (request, reply) => {
+      const key = request.headers["idempotency-key"];
+      if (typeof key !== "string" || key.length === 0) return;
+      const compositeKey = `${scope}:${key}`;
+      await store.sweep();
+      const existing = await store.find(compositeKey);
+      if (existing) {
+        reply.status(existing.responseStatus).send(existing.responseBody);
+        return reply;
+      }
+      ;
+      request[REQUEST_KEY] = compositeKey;
+      request[REQUEST_SCOPE] = scope;
+    };
+  }
+  async function onSendCapture(request, reply, payload) {
+    const key = request[REQUEST_KEY];
+    const scope = request[REQUEST_SCOPE];
+    if (!key || !scope) return payload;
+    if (typeof payload !== "string") {
+      request.log.warn({ idempotencyKey: key }, "idempotency.skip-non-json");
+      return payload;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      request.log.warn({ idempotencyKey: key }, "idempotency.skip-non-json");
+      return payload;
+    }
+    await store.set(key, scope, reply.statusCode, parsed);
+    return payload;
+  }
+  return { guard, onSendCapture };
+}
+
+// src/server/routes/invites.ts
+import { createHash as createHash2 } from "crypto";
+import fp5 from "fastify-plugin";
+
+// src/server/routes/__schemas__/invites.ts
+import { z as z5 } from "zod";
+var createInviteBody = z5.object({
+  email: z5.string().email("email must be a valid email address"),
+  role: z5.enum(["owner", "editor", "viewer"])
+}).strict();
+var acceptInviteQuery = z5.object({
+  invite_token: z5.string().min(1, "invite_token is required")
+}).strict();
+var tokenBody = z5.object({
+  token: z5.string().min(1, "token is required")
+}).strict();
+
+// src/server/routes/invites.ts
+function buildTransport(config) {
+  if (!config.auth.mail) return null;
+  const env = process.env.NODE_ENV === "production" ? "production" : process.env.NODE_ENV === "test" ? "test" : "development";
+  return createMailTransport(config.auth.mail.transportUrl, config.auth.mail.from, env);
+}
+var inviteRoutesPlugin = async (app, opts) => {
+  const store = app.workspaceStore;
+  const transport = buildTransport(app.config);
+  const idempotencyStore = opts.idempotencyStore ?? (() => {
+    const db = app.db;
+    return db ? createDrizzleIdempotencyStore(db) : null;
+  })();
+  const idem = idempotencyStore ? createIdempotencyMiddleware(idempotencyStore) : null;
+  if (idem) {
+    app.addHook("onSend", idem.onSendCapture);
+  }
+  app.get(
+    "/api/v1/workspaces/:id/invites",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id } = request.params;
+      const invites = await store.listInvites(id);
+      return { invites };
+    }
+  );
+  app.post(
+    "/api/v1/workspaces/:id/invites",
+    {
+      preHandler: idem ? [requireWorkspaceMember("owner"), idem.guard("invites")] : requireWorkspaceMember("owner")
+    },
+    async (request, reply) => {
+      const { id } = request.params;
+      const parsed = createInviteBody.safeParse(request.body);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+          requestId: request.id
+        });
+      }
+      const { invite, rawToken } = await store.createInvite(
+        id,
+        parsed.data.email,
+        parsed.data.role,
+        request.user.id,
+        { ttlDays: app.config.features.inviteTtlDays }
+      );
+      if (transport) {
+        const workspace = await store.get(id);
+        const acceptUrl = `${app.config.auth.url}/api/v1/workspaces/${id}/invites/${invite.id}/accept?invite_token=${rawToken}`;
+        try {
+          const email = await renderWorkspaceInvite({
+            to: parsed.data.email,
+            acceptUrl,
+            inviterName: request.user.name ?? request.user.email,
+            workspaceName: workspace?.name ?? "Workspace",
+            role: parsed.data.role,
+            expiresInDays: app.config.features.inviteTtlDays
+          });
+          await transport.send(email);
+        } catch (err) {
+          request.log.warn({ workspaceId: id, inviteId: invite.id, err }, "invite.email.send.failed");
+        }
+      }
+      request.log.info({ workspaceId: id, inviteId: invite.id, email: parsed.data.email }, "invite.create");
+      reply.status(201);
+      if (!transport) {
+        return { invite, warning: "mail_disabled" };
+      }
+      return { invite };
+    }
+  );
+  app.post(
+    "/api/v1/workspaces/:id/invites/:inviteId/accept",
+    async (request) => {
+      const { id, inviteId } = request.params;
+      const user = request.user;
+      if (!user) {
+        throw new HttpError({
+          status: 401,
+          code: ERROR_CODES.UNAUTHORIZED,
+          message: "Authentication required",
+          requestId: request.id
+        });
+      }
+      const parsed = acceptInviteQuery.safeParse(request.query);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: "invite_token query parameter is required",
+          requestId: request.id
+        });
+      }
+      const tokenHash = createHash2("sha256").update(parsed.data.invite_token).digest("hex");
+      const invite = await store.getInviteByTokenHash(tokenHash);
+      if (!invite || invite.id !== inviteId || invite.workspaceId !== id) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.INVITE_NOT_FOUND,
+          message: "Invite not found",
+          requestId: request.id
+        });
+      }
+      if (invite.lockedUntil && new Date(invite.lockedUntil) > /* @__PURE__ */ new Date()) {
+        throw new HttpError({
+          status: 423,
+          code: ERROR_CODES.INVITE_LOCKED,
+          message: "Invite token is locked",
+          requestId: request.id
+        });
+      }
+      if (invite.acceptedAt) {
+        throw new HttpError({
+          status: 410,
+          code: ERROR_CODES.INVITE_ALREADY_ACCEPTED,
+          message: "Invite already accepted",
+          requestId: request.id
+        });
+      }
+      if (new Date(invite.expiresAt) <= /* @__PURE__ */ new Date()) {
+        await store.incrementInviteFailedAttempts(invite.id);
+        throw new HttpError({
+          status: 410,
+          code: ERROR_CODES.INVITE_EXPIRED,
+          message: "Invite expired",
+          requestId: request.id
+        });
+      }
+      try {
+        const result = await store.acceptInvite(id, inviteId, user.id);
+        await store.resetInviteFailedAttempts(invite.id);
+        request.log.info({ workspaceId: id, inviteId, userId: user.id }, "invite.accept");
+        return { invite: result.invite, member: result.member };
+      } catch (err) {
+        if (err instanceof HttpError) {
+          if (err.code === ERROR_CODES.INVITE_EMAIL_MISMATCH) {
+            await store.incrementInviteFailedAttempts(invite.id);
+          }
+          throw err;
+        }
+        throw err;
+      }
+    }
+  );
+  app.delete(
+    "/api/v1/workspaces/:id/invites/:inviteId",
+    { preHandler: requireWorkspaceMember("owner") },
+    async (request) => {
+      const { id, inviteId } = request.params;
+      const revoked = await store.revokeInvite(id, inviteId);
+      if (!revoked) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_FOUND,
+          message: "Invite not found",
+          requestId: request.id
+        });
+      }
+      request.log.info({ workspaceId: id, inviteId }, "invite.revoke");
+      return { revoked: true };
+    }
+  );
+  app.post("/api/v1/invites/resolve", async (request) => {
+    const parsed = tokenBody.safeParse(request.body);
+    if (!parsed.success) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: "token is required",
+        requestId: request.id
+      });
+    }
+    const tokenHash = createHash2("sha256").update(parsed.data.token).digest("hex");
+    const invite = await store.getInviteByTokenHash(tokenHash);
+    if (!invite) {
+      throw new HttpError({
+        status: 404,
+        code: ERROR_CODES.INVITE_NOT_FOUND,
+        message: "Invite not found",
+        requestId: request.id
+      });
+    }
+    if (invite.lockedUntil && new Date(invite.lockedUntil) > /* @__PURE__ */ new Date()) {
+      throw new HttpError({
+        status: 423,
+        code: ERROR_CODES.INVITE_LOCKED,
+        message: "Invite token is locked",
+        requestId: request.id
+      });
+    }
+    if (invite.acceptedAt || new Date(invite.expiresAt) <= /* @__PURE__ */ new Date()) {
+      await store.incrementInviteFailedAttempts(invite.id);
+      throw new HttpError({
+        status: 404,
+        code: ERROR_CODES.INVITE_NOT_FOUND,
+        message: "Invite not found",
+        requestId: request.id
+      });
+    }
+    const workspace = await store.get(invite.workspaceId);
+    return {
+      workspaceName: workspace?.name ?? "Workspace",
+      role: invite.role,
+      expiresAt: invite.expiresAt
+    };
+  });
+  app.post("/api/v1/invites/accept", async (request) => {
+    const user = request.user;
+    if (!user) {
+      throw new HttpError({
+        status: 401,
+        code: ERROR_CODES.UNAUTHORIZED,
+        message: "Authentication required",
+        requestId: request.id
+      });
+    }
+    const parsed = tokenBody.safeParse(request.body);
+    if (!parsed.success) {
+      throw new HttpError({
+        status: 400,
+        code: ERROR_CODES.VALIDATION_FAILED,
+        message: "token is required",
+        requestId: request.id
+      });
+    }
+    const tokenHash = createHash2("sha256").update(parsed.data.token).digest("hex");
+    const invite = await store.getInviteByTokenHash(tokenHash);
+    if (!invite) {
+      throw new HttpError({
+        status: 404,
+        code: ERROR_CODES.INVITE_NOT_FOUND,
+        message: "Invite not found",
+        requestId: request.id
+      });
+    }
+    if (invite.lockedUntil && new Date(invite.lockedUntil) > /* @__PURE__ */ new Date()) {
+      throw new HttpError({
+        status: 423,
+        code: ERROR_CODES.INVITE_LOCKED,
+        message: "Invite token is locked",
+        requestId: request.id
+      });
+    }
+    if (invite.acceptedAt) {
+      await store.incrementInviteFailedAttempts(invite.id);
+      throw new HttpError({
+        status: 409,
+        code: ERROR_CODES.INVITE_ALREADY_ACCEPTED,
+        message: "Invite already accepted",
+        requestId: request.id
+      });
+    }
+    if (new Date(invite.expiresAt) <= /* @__PURE__ */ new Date()) {
+      await store.incrementInviteFailedAttempts(invite.id);
+      throw new HttpError({
+        status: 410,
+        code: ERROR_CODES.INVITE_EXPIRED,
+        message: "Invite expired",
+        requestId: request.id
+      });
+    }
+    try {
+      const result = await store.acceptInvite(invite.workspaceId, invite.id, user.id);
+      await store.resetInviteFailedAttempts(invite.id);
+      request.log.info({ inviteId: invite.id, userId: user.id }, "invite.token.accept");
+      return { workspace: await store.get(invite.workspaceId), member: result.member };
+    } catch (err) {
+      if (err instanceof HttpError) {
+        if (err.code === ERROR_CODES.INVITE_EMAIL_MISMATCH) {
+          await store.incrementInviteFailedAttempts(invite.id);
+        }
+        throw err;
+      }
+      throw err;
+    }
+  });
+};
+var registerInviteRoutes = fp5(inviteRoutesPlugin, { name: "invite-routes" });
+
+// src/server/routes/settings.ts
+import fp6 from "fastify-plugin";
+
+// src/server/routes/__schemas__/settings.ts
+import { z as z6 } from "zod";
+var putSettingsBody = z6.record(
+  z6.string().min(1, "Key must be at least 1 character").max(128, "Key must be 128 characters or fewer"),
+  z6.string().min(1, "Value must not be empty").max(1e4, "Value must be 10000 characters or fewer")
+).refine((obj) => Object.keys(obj).length > 0, { message: "At least one setting is required" }).refine((obj) => Object.keys(obj).length <= 50, { message: "Maximum 50 settings per request" });
+
+// src/server/routes/settings.ts
+var settingsRoutesPlugin = async (app) => {
+  const store = app.workspaceStore;
+  app.get(
+    "/api/v1/workspaces/:id/settings",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id } = request.params;
+      const settings = await store.getWorkspaceSettings(id);
+      return { settings };
+    }
+  );
+  app.put(
+    "/api/v1/workspaces/:id/settings",
+    { preHandler: requireWorkspaceMember("editor") },
+    async (request) => {
+      const { id } = request.params;
+      const parsed = putSettingsBody.safeParse(request.body);
+      if (!parsed.success) {
+        throw new HttpError({
+          status: 400,
+          code: ERROR_CODES.VALIDATION_FAILED,
+          message: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "),
+          requestId: request.id
+        });
+      }
+      const settings = await store.putWorkspaceSettings(id, parsed.data);
+      return { settings };
+    }
+  );
+  app.get(
+    "/api/v1/workspaces/:id/runtime",
+    { preHandler: requireWorkspaceMember() },
+    async (request) => {
+      const { id } = request.params;
+      const runtime = await store.getWorkspaceRuntime(id);
+      if (!runtime) {
+        throw new HttpError({
+          status: 404,
+          code: ERROR_CODES.NOT_FOUND,
+          message: "Workspace not found",
+          requestId: request.id
+        });
+      }
+      return { runtime };
+    }
+  );
+  app.post(
+    "/api/v1/workspaces/:id/runtime/retry",
+    { preHandler: requireWorkspaceMember("owner") },
+    async (request) => {
+      const { id } = request.params;
+      const provisioner = app.provisioner;
+      const runtime = await store.getWorkspaceRuntime(id);
+      if (!runtime || !provisioner) {
+        throw new HttpError({
+          status: 409,
+          code: ERROR_CODES.RUNTIME_UNMANAGED,
+          message: "No managed runtime for this workspace",
+          requestId: request.id
+        });
+      }
+      if (runtime.state !== "error" || runtime.lastErrorOp !== "provision") {
+        throw new HttpError({
+          status: 409,
+          code: ERROR_CODES.INVALID_RETRY_STATE,
+          message: "Runtime must be in error state with last_error_op=provision to retry",
+          requestId: request.id
+        });
+      }
+      await store.putWorkspaceRuntime(id, { state: "pending", lastError: null, lastErrorOp: null });
+      try {
+        const ws = await store.get(id);
+        const result = await provisioner.provision({
+          workspaceId: id,
+          workspaceName: ws?.name ?? id,
+          ownerId: request.user.id,
+          appId: app.config.appId
+        });
+        const updated = await store.putWorkspaceRuntime(id, {
+          state: "ready",
+          volumePath: result.volumePath
+        });
+        request.log.info({ workspaceId: id }, "workspace.provision.retry.success");
+        return { runtime: updated };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        await store.putWorkspaceRuntime(id, {
+          state: "error",
+          lastError: message,
+          lastErrorOp: "provision"
+        });
+        request.log.error({ workspaceId: id, err }, "workspace.provision.retry.failed");
+        throw new HttpError({
+          status: 500,
+          code: ERROR_CODES.PROVISION_FAILED,
+          message: "Workspace provisioning failed",
+          requestId: request.id
+        });
+      }
+    }
+  );
+};
+var registerSettingsRoutes = fp6(settingsRoutesPlugin, { name: "settings-routes" });
+
+// src/server/runtime/WorkspaceRuntimeSandboxHandleStore.ts
+var SANDBOX_RESOURCE = {
+  kind: "sandbox",
+  purpose: "main",
+  provider: "vercel"
+};
+var WorkspaceRuntimeSandboxHandleStore = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async get(workspaceId) {
+    const resource = await this.store.getWorkspaceRuntimeResource?.(workspaceId, SANDBOX_RESOURCE);
+    const handle = resourceToHandle(resource);
+    if (handle) return handle;
+    const runtime = await this.store.getWorkspaceRuntime(workspaceId);
+    return runtimeToHandle(runtime);
+  }
+  async put(record) {
+    const seenAt = (/* @__PURE__ */ new Date()).toISOString();
+    const selector = {
+      ...SANDBOX_RESOURCE,
+      provider: record.provider ?? SANDBOX_RESOURCE.provider
+    };
+    const previousResource = await this.store.getWorkspaceRuntimeResource?.(
+      record.workspaceId,
+      selector
+    );
+    let resourceWritten = false;
+    if (this.store.putWorkspaceRuntimeResource) {
+      await this.store.putWorkspaceRuntimeResource(
+        record.workspaceId,
+        handleToResourceInput(record, seenAt)
+      );
+      resourceWritten = true;
+    }
+    try {
+      await this.store.putWorkspaceRuntime(record.workspaceId, {
+        sandboxProvider: record.provider ?? "vercel",
+        sandboxId: record.sandboxId,
+        sandboxSnapshotId: record.snapshotId ?? null,
+        sandboxCreatedAt: record.createdAt,
+        sandboxLastUsedAt: record.lastUsedAt,
+        sandboxLastSeenAt: seenAt,
+        state: "ready",
+        lastError: null,
+        lastErrorOp: null
+      });
+    } catch (error) {
+      if (resourceWritten) {
+        await this.restoreRuntimeResource(record.workspaceId, selector, previousResource);
+      }
+      throw error;
+    }
+  }
+  async restoreRuntimeResource(workspaceId, selector, previousResource) {
+    try {
+      if (previousResource && this.store.putWorkspaceRuntimeResource) {
+        await this.store.putWorkspaceRuntimeResource(
+          workspaceId,
+          resourceToInput(previousResource)
+        );
+        return;
+      }
+      await this.store.deleteWorkspaceRuntimeResource?.(workspaceId, selector);
+    } catch {
+    }
+  }
+  async delete(workspaceId) {
+    await this.store.deleteWorkspaceRuntimeResource?.(workspaceId, SANDBOX_RESOURCE);
+    const existing = await this.store.getWorkspaceRuntime(workspaceId);
+    if (!existing) return;
+    await this.store.putWorkspaceRuntime(workspaceId, {
+      sandboxId: null,
+      sandboxStatus: null,
+      sandboxSnapshotId: null,
+      sandboxCreatedAt: null,
+      sandboxLastUsedAt: null,
+      sandboxLastSeenAt: null,
+      sandboxExpiresAt: null
+    });
+  }
+  async list() {
+    if (this.store.listWorkspaceRuntimeResources) {
+      const resources = await this.store.listWorkspaceRuntimeResources();
+      const handles = resources.filter(
+        (resource) => resource.kind === SANDBOX_RESOURCE.kind && resource.purpose === SANDBOX_RESOURCE.purpose && resource.provider === SANDBOX_RESOURCE.provider && resource.state !== "deleted"
+      ).map((resource) => resourceToHandle(resource)).filter((record) => record !== null);
+      if (handles.length > 0) return handles;
+    }
+    if (!this.store.listWorkspaceRuntimes) return [];
+    const runtimes = await this.store.listWorkspaceRuntimes();
+    return runtimes.map((runtime) => runtimeToHandle(runtime)).filter((record) => record !== null);
+  }
+};
+function handleToResourceInput(record, seenAt) {
+  return {
+    ...SANDBOX_RESOURCE,
+    provider: record.provider ?? SANDBOX_RESOURCE.provider,
+    handleKind: record.handleKind ?? "session",
+    stableKey: record.stableKey ?? null,
+    providerResourceId: record.sandboxId,
+    state: "ready",
+    persistenceMode: record.persistenceMode ?? (record.snapshotId ? "snapshot" : "ephemeral"),
+    providerMeta: {
+      ...record.providerMeta ?? {},
+      ...record.snapshotId ? { snapshotId: record.snapshotId } : {}
+    },
+    lastSeenAt: seenAt,
+    lastUsedAt: record.lastUsedAt
+  };
+}
+function resourceToInput(resource) {
+  return {
+    id: resource.id,
+    kind: resource.kind,
+    purpose: resource.purpose,
+    provider: resource.provider,
+    handleKind: resource.handleKind,
+    stableKey: resource.stableKey,
+    providerResourceId: resource.providerResourceId,
+    parentResourceId: resource.parentResourceId,
+    state: resource.state,
+    persistenceMode: resource.persistenceMode,
+    config: resource.config,
+    providerMeta: resource.providerMeta,
+    lastError: resource.lastError,
+    lastErrorCode: resource.lastErrorCode,
+    lastSeenAt: resource.lastSeenAt,
+    lastUsedAt: resource.lastUsedAt,
+    expiresAt: resource.expiresAt,
+    generation: resource.generation
+  };
+}
+function resourceToHandle(resource) {
+  if (!resource?.providerResourceId || resource.state === "deleted") return null;
+  const snapshotId = typeof resource.providerMeta.snapshotId === "string" ? resource.providerMeta.snapshotId : void 0;
+  return {
+    workspaceId: resource.workspaceId,
+    sandboxId: resource.providerResourceId,
+    snapshotId,
+    provider: resource.provider,
+    handleKind: resource.handleKind,
+    stableKey: resource.stableKey ?? void 0,
+    persistenceMode: resource.persistenceMode,
+    providerMeta: resource.providerMeta,
+    createdAt: resource.createdAt,
+    lastUsedAt: resource.lastUsedAt ?? resource.updatedAt
+  };
+}
+function runtimeToHandle(runtime) {
+  if (!runtime?.sandboxId) return null;
+  return {
+    workspaceId: runtime.workspaceId,
+    sandboxId: runtime.sandboxId,
+    snapshotId: runtime.sandboxSnapshotId ?? void 0,
+    createdAt: runtime.sandboxCreatedAt ?? runtime.updatedAt,
+    lastUsedAt: runtime.sandboxLastUsedAt ?? runtime.updatedAt
+  };
+}
+
+export {
+  coreConfigSchema,
+  loadConfig,
+  validateConfig,
+  buildRuntimeConfigPayload,
+  createCoreApp,
+  registerRoutes,
+  MailDeliveryError,
+  createMailTransport,
+  renderVerifyEmail,
+  renderResetPassword,
+  renderMagicLink,
+  renderWorkspaceInvite,
+  renderWelcome,
+  createPostSignupHook,
+  validatePasswordStrength,
+  createAuth,
+  authHook,
+  requireWorkspaceMember,
+  registerWorkspaceRoutes,
+  registerMemberRoutes,
+  createDrizzleIdempotencyStore,
+  createIdempotencyMiddleware,
+  registerInviteRoutes,
+  registerSettingsRoutes,
+  WorkspaceRuntimeSandboxHandleStore
+};