@getstrata/bootstrap 0.2.22 → 0.2.25

package/dist/index.js

@@ -1,4 +1,7 @@
 // @bun
+// ../../src/bootstrap/public-api.ts
+import { appSchedule as appSchedule2, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
+
 // ../../src/core/scheduler/schedule.ts
 class Schedule {
   tasks = [];
@@ -503,157 +506,107 @@ async function scheduleRunCommand() {
   }
   await runDueScheduledTasks(appSchedule);
 }
-// ../../src/core/contracts/di.ts
-var requiredDependencyKeys = [
-  "container",
-  "cache",
-  "storage"
-];
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-function assertAppDependenciesComplete(dependencies) {
-  for (const key of requiredDependencyKeys) {
-    getRequiredDependency(dependencies, key);
-  }
-}
-function resolveService(dependencies, token) {
-  return dependencies.container.resolve(token);
-}
+// ../../src/bootstrap/applicationRegistry.ts
+import {
+  resolveApplicationAuth,
+  resolveApplicationCache,
+  resolveApplicationConfig,
+  resolveApplicationDependencies,
+  resolveApplicationEventBus,
+  resolveApplicationLogger,
+  resolveApplicationPolicyGate,
+  resolveApplicationQueue,
+  setActiveApplicationContext
+} from "@getstrata/core/runtime/applicationRegistry.ts";
+// ../../src/bootstrap/buildModuleRoutes.ts
+import { conditionalJsonResponse } from "@getstrata/core/http";
+import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_CONFIG_TOKEN = "core.config";
-var CORE_CACHE_TOKEN = "core.cache";
-var CORE_QUEUE_TOKEN = "core.queue";
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
-var CORE_POLICY_GATE_TOKEN = "core.policyGate";
-var CORE_AUTH_TOKEN = "core.auth";
-var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
 
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function setActiveApplicationContext(context) {
-  activeContext = context;
-  globalThis[APPLICATION_CONTEXT_KEY] = context;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
   }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationQueue() {
-  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
-}
-function resolveApplicationEventBus() {
-  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
-}
-function resolveApplicationAuth() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
-}
-function resolveApplicationPolicyGate() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
-}
-function resolveApplicationConfig() {
-  return requireActiveApplicationContext().config;
-}
-function resolveApplicationLogger() {
-  return appLogger;
-}
-function resolveApplicationDependencies() {
-  return requireActiveApplicationContext().dependencies;
-}
-// ../../src/bootstrap/discoverModules.ts
-import { readdirSync } from "fs";
-import { join } from "path";
-import { pathToFileURL } from "url";
-var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
-function readDiscoverModulesState() {
-  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
-  if (existing) {
-    return existing;
+  if (mode === "spa-react") {
+    return "spa-react";
   }
-  const state = { appModules: [] };
-  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
-  return state;
+  return "api";
 }
-function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
 }
-function resolveModulesDirectory(options) {
-  const state = readDiscoverModulesState();
-  if (options?.modulesDir) {
-    return options.modulesDir;
-  }
-  if (state.configuredModulesDir) {
-    return state.configuredModulesDir;
-  }
-  return join(import.meta.dir, "../modules");
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
 }
-async function loadDiscoveredModules(options) {
-  const modulesDirectory = resolveModulesDirectory(options);
-  let moduleNames;
-  try {
-    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return [];
-    }
-    throw error;
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
   }
-  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
-    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
-    const loaded = await import(moduleUrl);
-    return loaded.default;
-  }));
-  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+  return Math.trunc(parsed);
 }
-async function ensureModulesLoaded(options) {
-  const state = readDiscoverModulesState();
-  if (state.appModules.length > 0) {
-    return state.appModules;
-  }
-  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
-    state.appModules.splice(0, state.appModules.length, ...modules);
-    return state.appModules;
-  });
-  return state.modulesReady;
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
 }
-function discoverModules() {
-  return readDiscoverModulesState().appModules;
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
 }
 
-// ../../src/bootstrap/cache/modelCacheTags.ts
-function cacheTagsForModelWrite(tableName, action) {
-  const module = discoverModules().find((entry) => entry.tableName === tableName);
-  const baseTags = module?.cacheTags ?? [`${tableName}s`];
-  const isDelete = action === "deleted" || action === "force-deleted";
-  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
-  return [...new Set([...baseTags, ...extraTags])];
-}
-function discoverModelTableNames() {
-  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
-}
 // ../../src/bootstrap/config.ts
+import {
+  CORE_AUTH_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens.ts";
 var APP_PORT_CONFIG_KEY = "app.port";
 var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
 var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
@@ -666,70 +619,354 @@ var DEFAULT_CACHE_MAX_ENTRIES = 100;
 var DEFAULT_CACHE_DRIVER = "array";
 var DEFAULT_API_TOKEN = "";
 var DEFAULT_QUEUE_DRIVER = "sync";
-// ../../src/core/contracts/container.ts
-class ServiceContainer {
-  services = new Map;
-  singletonFactories = new Map;
-  bindings = new Map;
-  set(key, value) {
-    this.singletonFactories.delete(key);
-    this.bindings.delete(key);
-    this.services.set(key, value);
-    return value;
-  }
-  singleton(key, factory) {
-    this.bindings.delete(key);
-    this.services.delete(key);
-    this.singletonFactories.set(key, factory);
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
   }
-  bind(key, factory) {
-    this.singletonFactories.delete(key);
-    this.services.delete(key);
-    this.bindings.set(key, factory);
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
   }
-  get(key) {
-    if (this.services.has(key)) {
-      return this.services.get(key);
-    }
-    const singletonFactory = this.singletonFactories.get(key);
-    if (singletonFactory) {
-      const value = singletonFactory(this);
-      this.services.set(key, value);
-      return value;
-    }
-    const binding = this.bindings.get(key);
-    if (binding) {
-      return binding(this);
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
     }
-    throw new Error(`Service "${key}" is not registered.`);
   }
-  resolve(key) {
-    return this.get(key);
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
   }
-  has(key) {
-    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
   }
-}
-
-class ConfigStore {
-  values = new Map;
-  set(key, value) {
-    this.values.set(key, value);
-    return value;
+  wrapWeb(handler) {
+    return handler;
   }
-  get(key) {
-    return this.values.get(key);
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
+function readDiscoverModulesState() {
+  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = { appModules: [] };
+  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
+  return state;
+}
+function configureModulesDirectory(modulesDir) {
+  readDiscoverModulesState().configuredModulesDir = modulesDir;
+}
+function resolveModulesDirectory(options) {
+  const state = readDiscoverModulesState();
+  if (options?.modulesDir) {
+    return options.modulesDir;
+  }
+  if (state.configuredModulesDir) {
+    return state.configuredModulesDir;
+  }
+  return join(import.meta.dir, "../modules");
+}
+async function loadDiscoveredModules(options) {
+  const modulesDirectory = resolveModulesDirectory(options);
+  let moduleNames;
+  try {
+    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+async function ensureModulesLoaded(options) {
+  const state = readDiscoverModulesState();
+  if (state.appModules.length > 0) {
+    return state.appModules;
+  }
+  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
+    state.appModules.splice(0, state.appModules.length, ...modules);
+    return state.appModules;
+  });
+  return state.modulesReady;
+}
+function discoverModules() {
+  return readDiscoverModulesState().appModules;
+}
+// ../../src/bootstrap/prefixRouteMap.ts
+function prefixRouteMap(prefix, routes) {
+  const normalizedPrefix = prefix.replace(/\/$/, "");
+  const prefixed = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
+  }
+  return prefixed;
+}
+
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
+
+// ../../src/bootstrap/buildModuleRoutes.ts
+function registerOpenApiRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function registerOpenApiRouteMap(routes, middleware) {
+  const registered = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methodMap = handler;
+      registered[path] = methodMap;
+      for (const method of Object.keys(methodMap)) {
+        registerOpenApiRoute(method.toUpperCase(), path, middleware);
+      }
+      continue;
+    }
+    registered[path] = handler;
+    registerOpenApiRoute("GET", path, middleware);
+  }
+  return registered;
+}
+function createCachedJson(dependencies) {
+  return async (cacheKey, loader, tags = [], request) => {
+    const data = tags.length > 0 ? await dependencies.cache.tags(...tags).remember(cacheKey, loader) : await dependencies.cache.remember(cacheKey, loader);
+    return conditionalJsonResponse(request, data);
+  };
+}
+function buildModuleRoutes(dependencies, options = {}) {
+  const { apiPrefix = "", modules = discoverModules(), clearRegistry = true } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
   }
-  require(key) {
-    if (!this.values.has(key)) {
-      throw new Error(`Config key "${key}" is not defined.`);
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const cachedJson = createCachedJson(dependencies);
+  const moduleRoutes = {};
+  for (const module of modules) {
+    if (!module.routes) {
+      continue;
     }
-    return this.values.get(key);
+    Object.assign(moduleRoutes, module.routes({ dependencies, cachedJson, kernel }));
+  }
+  const prefixedModuleRoutes = prefixRouteMap(apiPrefix, moduleRoutes);
+  return applyMiddlewareToRoutes(registerOpenApiRouteMap(prefixedModuleRoutes, ["global", "api"]), middleware);
+}
+// ../../src/bootstrap/buildWebModuleRoutes.ts
+import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/core/http/middleware";
+function buildWebModuleRoutes(dependencies, options = {}) {
+  const { modules = discoverModules(), clearRegistry = true, seedRoutes = {} } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
   }
-  has(key) {
-    return this.values.has(key);
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const moduleRoutes = { ...seedRoutes };
+  for (const module of modules) {
+    if (!module.webRoutes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.webRoutes({
+      dependencies,
+      cachedJson: async () => new Response(""),
+      kernel
+    }));
   }
+  return applyMiddlewareToRoutes2(registerOpenApiRouteMap(moduleRoutes, ["global", "web"]), middleware);
+}
+// ../../src/bootstrap/cache/modelCacheTags.ts
+function cacheTagsForModelWrite(tableName, action) {
+  const module = discoverModules().find((entry) => entry.tableName === tableName);
+  const baseTags = module?.cacheTags ?? [`${tableName}s`];
+  const isDelete = action === "deleted" || action === "force-deleted";
+  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
+  return [...new Set([...baseTags, ...extraTags])];
 }
+function discoverModelTableNames() {
+  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
+}
+// ../../src/bootstrap/contracts.ts
+import {
+  ConfigStore,
+  ServiceContainer
+} from "@getstrata/core/contracts/container";
+import {
+  assertAppDependenciesComplete,
+  getRequiredDependency,
+  resolveService
+} from "@getstrata/core/contracts/di";
+
 // ../../src/config/auth.ts
 var authConfig = {
   allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
@@ -835,7 +1072,6 @@ var db = new Proxy(function database() {}, {
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
-var connection_default = db;
 
 // ../../src/modules/user/apiTokenTable.ts
 import { defineTable } from "@getstrata/core/database";
@@ -1667,9 +1903,6 @@ var queueConfig = {
 };
 
 // ../../src/core/config/envSchema.ts
-function defineEnvSchema(schema) {
-  return schema;
-}
 function validateEnv(schema, env = process.env) {
   const resolved = {};
   for (const [name, rule] of Object.entries(schema)) {
@@ -1698,6 +1931,7 @@ function validateEnv(schema, env = process.env) {
 }
 
 // ../../src/bootstrap/env.ts
+import { defineEnvSchema } from "@getstrata/core/config/envSchema";
 var appEnvSchema = defineEnvSchema({
   DATABASE_URL: { required: true, pattern: /^postgres(ql)?:\/\// },
   PORT: {
@@ -3947,22 +4181,65 @@ class DispatchWebhookJob extends Job {
 }
 var dispatchWebhookJob_default = DispatchWebhookJob;
 
-// ../../src/bootstrap/queue/defaultJobs.ts
-function registerDefaultJobs() {
-  jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache());
-  });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
+// ../../src/core/contracts/di.ts
+function getRequiredDependency2(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
 }
 
-// ../../src/bootstrap/providers/queue.ts
-var queueProvider = {
-  name: "core.queue",
-  register({ container, config }) {
-    const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
-    const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
-    config.set("queue.driver", driver);
-    const failedJobs = createFailedJobService();
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_POLICY_GATE_TOKEN2 = "core.policyGate";
+var CORE_AUTH_TOKEN2 = "core.auth";
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
+  }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
+  }
+  return activeContext;
+}
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return context;
+}
+function resolveApplicationCache2() {
+  return getRequiredDependency2(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationAuth2() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN2);
+}
+function resolveApplicationPolicyGate2() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN2);
+}
+
+// ../../src/bootstrap/queue/defaultJobs.ts
+function registerDefaultJobs() {
+  jobRegistry.register("cache.invalidate-tags", () => {
+    return new invalidateCacheTagsJob_default(resolveApplicationCache2());
+  });
+  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
+}
+
+// ../../src/bootstrap/providers/queue.ts
+var queueProvider = {
+  name: "core.queue",
+  register({ container, config }) {
+    const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
+    const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
+    config.set("queue.driver", driver);
+    const failedJobs = createFailedJobService();
     container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
     container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs, registerDefaultJobs));
   }
@@ -4091,21 +4368,6 @@ var storageProvider = {
 };
 var storage_default = storageProvider;
 
-// ../../src/config/frontend.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
-  }
-  return "api";
-}
-function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
-}
-
 // ../../src/core/http/requestMetaContext.ts
 var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
 function currentRequestMeta() {
@@ -4147,16 +4409,6 @@ class EtaViewEngine {
     });
   }
 }
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -4445,352 +4697,25 @@ function createAppContext() {
 }
 // ../../src/bootstrap/createWebRoutes.ts
 import { join as join5 } from "path";
-
-// ../../src/core/http/middleware.ts
-function isRouteHandler(value) {
-  return typeof value === "function";
-}
-function isMethodRouteMap(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const entries = Object.entries(value);
-  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
-}
-function composeMiddleware(...middleware) {
-  return (handler) => {
-    return async (request) => {
-      let index = 0;
-      const dispatch = async () => {
-        if (index >= middleware.length) {
-          return await handler(request);
-        }
-        const current = middleware[index];
-        index += 1;
-        if (!current) {
-          return await handler(request);
-        }
-        return await current(request, dispatch);
-      };
-      return await dispatch();
-    };
-  };
-}
-function wrapRouteHandler(handler, middleware) {
-  if (isMethodRouteMap(handler)) {
-    const wrapped = {};
-    for (const [method, routeHandler] of Object.entries(handler)) {
-      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
-    }
-    return wrapped;
-  }
-  if (isRouteHandler(handler)) {
-    return composeMiddleware(...middleware)(handler);
-  }
-  return handler;
-}
-function applyMiddlewareToRoutes(routes, middleware) {
-  const wrapped = {};
-  for (const [path, routeHandler] of Object.entries(routes)) {
-    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
-  }
-  return wrapped;
-}
-
-// ../../src/bootstrap/httpKernel.ts
-import {
-  createAuthMiddleware,
-  createAuthorizeMiddleware,
-  createBodySizeLimitMiddleware,
-  createCorsMiddleware,
-  createCsrfMiddleware,
-  createFlashMiddleware,
-  createLoginThrottleMiddleware,
-  createMembershipMiddleware,
-  createMemoryThrottleMiddleware,
-  createMetricsMiddleware,
-  createRequestLoggingMiddleware,
-  createRequireAbilityMiddleware,
-  createRequireAuthMiddleware,
-  createRequireGlobalAdminMiddleware,
-  createRequireWebAuthMiddleware,
-  createSecurityHeadersMiddleware,
-  createTenantMiddleware,
-  createThrottleMiddleware,
-  createTracingMiddleware,
-  isPublicReadsEnabled,
-  requestIdMiddleware,
-  withMiddleware
-} from "@getstrata/core";
-
-// ../../src/config/rateLimit.ts
-var LOCAL_LOGIN_RATE_LIMIT = {
-  maxAttempts: 100,
-  decaySeconds: 60
-};
-var PRODUCTION_LOGIN_RATE_LIMIT = {
-  maxAttempts: 5,
-  decaySeconds: 900
-};
-function isLocalAppEnv() {
-  return (process.env.APP_ENV ?? "local") === "local";
-}
-function parsePositiveInt(value, fallback) {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    return fallback;
-  }
-  return Math.trunc(parsed);
-}
-function resolveLoginRateLimit() {
-  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
-  return {
-    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
-  };
-}
-function resolveRegisterRateLimit() {
-  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
-  return {
-    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
-  };
-}
-
-// ../../src/bootstrap/httpKernel.ts
-class HttpKernel {
-  dependencies;
-  constructor(dependencies) {
-    this.dependencies = dependencies;
-  }
-  globalMiddleware() {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return [
-      createCorsMiddleware(),
-      createSecurityHeadersMiddleware(),
-      createBodySizeLimitMiddleware(),
-      createTracingMiddleware(),
-      createMetricsMiddleware(),
-      createRequestLoggingMiddleware(),
-      requestIdMiddleware,
-      createAuthMiddleware(auth),
-      createMembershipMiddleware(),
-      createTenantMiddleware()
-    ];
-  }
-  group(name) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    switch (name) {
-      case "authenticated":
-        return [createRequireAuthMiddleware(auth)];
-      case "web":
-        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
-      case "api": {
-        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
-        }
-        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-        if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
-          return [
-            createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
-              decaySeconds: 60
-            })
-          ];
-        }
-        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
-        return [
-          createThrottleMiddleware({
-            redisUrl,
-            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
-            decaySeconds: 60
-          })
-        ];
-      }
-      default:
-        throw new Error(`Unknown middleware group "${name}".`);
-    }
-  }
-  wrap(groups, handler) {
-    const names = Array.isArray(groups) ? groups : [groups];
-    const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
-    }
-    return withMiddleware(...middleware)(handler);
-  }
-  wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
-  }
-  wrapWeb(handler) {
-    return handler;
-  }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
-      return this.wrapWeb(handler);
-    }
-    return this.wrapWebAuthenticated(handler);
-  }
-  wrapWebAuthenticated(handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
-  }
-  wrapWebAbility(ability, handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
-    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
-  }
-  wrapWebGlobalAdmin(handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
-  }
-  wrapAuthenticated(handler) {
-    return this.wrap("authenticated", handler);
-  }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
-      return handler;
-    }
-    return this.wrapAuthenticated(handler);
-  }
-  wrapGlobalAdmin(handler) {
-    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
-  }
-  wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
-    const middleware = [...this.group("authenticated"), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
-  }
-  wrapPolicy(resource, action, handler) {
-    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
-    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
-  }
-  wrapLogin(handler) {
-    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
-  }
-  wrapRegister(handler) {
-    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
-  }
-  wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
-    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
-        maxAttempts: rateLimit.maxAttempts,
-        decaySeconds: rateLimit.decaySeconds,
-        keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
-    }
-    return withMiddleware(...middleware)(handler);
-  }
-}
-function createHttpKernel(dependencies) {
-  return new HttpKernel(dependencies);
-}
-
-// ../../src/bootstrap/routeRegistry.ts
-class RouteRegistry {
-  routes = [];
-  register(route) {
-    this.routes.push(route);
-  }
-  clear() {
-    this.routes.length = 0;
-  }
-  list() {
-    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
-  }
-}
-var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
-function readSharedRouteRegistry() {
-  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new RouteRegistry;
-  globalThis[ROUTE_REGISTRY_KEY] = registry;
-  return registry;
-}
-var routeRegistry = readSharedRouteRegistry();
-
-// ../../src/bootstrap/createWebRoutes.ts
+import { htmlResponse as htmlResponse2 } from "@getstrata/core/view";
 function registerRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
-function registerRouteMap(routes, middleware) {
-  const registered = {};
-  for (const [path, handler] of Object.entries(routes)) {
-    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
-      const methodMap = handler;
-      registered[path] = methodMap;
-      for (const method of Object.keys(methodMap)) {
-        registerRoute(method.toUpperCase(), path, middleware);
-      }
-      continue;
-    }
-    registered[path] = handler;
-    registerRoute("GET", path, middleware);
-  }
-  return registered;
-}
 function createWebRoutes(dependencies) {
-  const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
-  const moduleRoutes = {
-    "/": () => Response.redirect("/organizations", 302)
-  };
-  registerRoute("GET", "/", ["global", "web"]);
-  for (const module of discoverModules()) {
-    if (!module.webRoutes) {
-      continue;
+  const wrappedRoutes = buildWebModuleRoutes(dependencies, {
+    clearRegistry: false,
+    seedRoutes: {
+      "/": () => Response.redirect("/organizations", 302)
     }
-    Object.assign(moduleRoutes, module.webRoutes({
-      dependencies,
-      cachedJson: async () => htmlResponse(""),
-      kernel
-    }));
-  }
-  const wrappedRoutes = applyMiddlewareToRoutes(registerRouteMap(moduleRoutes, ["global", "web"]), middleware);
+  });
+  registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
     const file = Bun.file(join5(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
-      return htmlResponse("Not Found", { status: 404 });
+      return htmlResponse2("Not Found", { status: 404 });
     }
     return new Response(file);
   };
@@ -4921,8 +4846,8 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
   return async (request) => {
     const id = parsePositiveIntParam(String(request.params[param]), String(param));
     const model = await resolver(id, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth = resolveApplicationAuth();
+    const gate = resolveApplicationPolicyGate2();
+    const auth = resolveApplicationAuth2();
     const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
@@ -4944,8 +4869,8 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
       throw new BadRequestError(`Missing route parameter "${String(param)}".`);
     }
     const model = await resolver(key, request);
-    const gate = resolveApplicationPolicyGate();
-    const auth = resolveApplicationAuth();
+    const gate = resolveApplicationPolicyGate2();
+    const auth = resolveApplicationAuth2();
     const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
@@ -4960,158 +4885,8 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     return response;
   };
 }
-// ../../src/core/auth/accessControl.ts
-var ROLE_RANK = {
-  member: 1,
-  admin: 2,
-  owner: 3
-};
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function hasMinimumOrgRole(role, minimum) {
-  if (!role) {
-    return false;
-  }
-  return ROLE_RANK[role] >= ROLE_RANK[minimum];
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var membershipRepository = new memberRepository_default;
-
-// ../../src/core/auth/membershipService.ts
-class MembershipService {
-  members;
-  constructor(members = membershipRepository) {
-    this.members = members;
-  }
-  async listOrganizationIdsForUser(userId) {
-    const memberships = await this.members.listForUser(userId);
-    return memberships.map((membership) => membership.organization_id);
-  }
-  async getOrgRole(userId, organizationId) {
-    const membership = await this.members.findMembership(userId, organizationId);
-    return membership?.role ?? null;
-  }
-  async requireOrgAccess(organizationId, minimumRole = "member", user = currentAuthUser()) {
-    if (!user) {
-      throw new ForbiddenError("Authentication required.");
-    }
-    if (isGlobalAdmin(user)) {
-      return "owner";
-    }
-    const role = await this.getOrgRole(resolveUserId(user), organizationId);
-    if (!role || !hasMinimumOrgRole(role, minimumRole)) {
-      throw new ForbiddenError("Organization membership required.");
-    }
-    return role;
-  }
-  async filterAccessibleOrganizationIds(organizationIds, user = currentAuthUser()) {
-    if (!user) {
-      return [];
-    }
-    if (isGlobalAdmin(user)) {
-      return organizationIds;
-    }
-    const allowed = new Set(await this.listOrganizationIdsForUser(resolveUserId(user)));
-    return organizationIds.filter((organizationId) => allowed.has(organizationId));
-  }
-  async addOwnerOnOrganizationCreate(organizationId, userId) {
-    await this.members.addMember({
-      organizationId,
-      userId,
-      role: "owner"
-    });
-  }
-  listMembersForOrganization(organizationId) {
-    return this.members.listForOrganization(organizationId);
-  }
-  addMember(input) {
-    return this.members.addMember(input);
-  }
-  removeMember(organizationId, userId) {
-    return this.members.removeMember(organizationId, userId);
-  }
-}
-var membershipService_default = MembershipService;
-
-// ../../src/core/auth/resolveMembershipService.ts
-function resolveMembershipService() {
-  const dependencies = resolveApplicationDependencies();
-  if (dependencies.container.has("core.membership")) {
-    return dependencies.container.resolve("core.membership");
-  }
-  return new membershipService_default;
-}
-// ../../src/bootstrap/prefixRouteMap.ts
-function prefixRouteMap(prefix, routes) {
-  const normalizedPrefix = prefix.replace(/\/$/, "");
-  const prefixed = {};
-  for (const [path, handler] of Object.entries(routes)) {
-    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
-  }
-  return prefixed;
-}
+// ../../src/bootstrap/membershipService.ts
+import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
 // ../../src/core/http/csrfProtection.ts
 var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
 function createCsrfProtection(secret, options = {}) {
@@ -5206,7 +4981,7 @@ function createRouteKernel(dependencies) {
   return createHttpKernel(dependencies);
 }
 // ../../src/bootstrap/web/server.ts
-function wrapRouteHandler2(handler) {
+function wrapRouteHandler(handler) {
   return async (request) => {
     const response = await handler(request);
     return response ?? new Response("Not Found", { status: 404 });
@@ -5216,7 +4991,7 @@ function convertAppRoutesToBunRoutes(routes) {
   const bunRoutes = {};
   for (const [path, handler] of Object.entries(routes)) {
     if (typeof handler === "function") {
-      bunRoutes[path] = { GET: wrapRouteHandler2(handler) };
+      bunRoutes[path] = { GET: wrapRouteHandler(handler) };
       continue;
     }
     if (handler && typeof handler === "object" && !Array.isArray(handler)) {
@@ -5225,7 +5000,7 @@ function convertAppRoutesToBunRoutes(routes) {
         if (typeof methodHandler !== "function") {
           continue;
         }
-        methods[method.toUpperCase()] = wrapRouteHandler2(methodHandler);
+        methods[method.toUpperCase()] = wrapRouteHandler(methodHandler);
       }
       if (Object.keys(methods).length > 0) {
         bunRoutes[path] = methods;
@@ -5340,7 +5115,7 @@ export {
   securedBindRouteModel,
   scheduleRunCommand,
   runProviderPhase,
-  runDueScheduledTasks,
+  runDueScheduledTasks2 as runDueScheduledTasks,
   routeRegistry,
   routeParams,
   resolveService,
@@ -5372,11 +5147,13 @@ export {
   configureModulesDirectory,
   collectProviders,
   cacheTagsForModelWrite,
+  buildWebModuleRoutes,
+  buildModuleRoutes,
   assertProductionSecrets,
   assertAppDependenciesComplete,
-  appSchedule,
+  appSchedule2 as appSchedule,
   ServiceContainer,
-  Schedule,
+  Schedule2 as Schedule,
   RouteRegistry,
   REDIS_URL_CONFIG_KEY,
   DEFAULT_APP_PORT,