@getstrata/bootstrap 0.2.23 → 0.2.25

package/dist/entries/createWebRoutes.js

@@ -1,6 +1,7 @@
 // @bun
 // ../../src/bootstrap/createWebRoutes.ts
-import { join as join3 } from "path";
+import { join as join2 } from "path";
+import { htmlResponse } from "@getstrata/core/view";
 
 // ../../src/config/frontend.ts
 function readFrontendMode() {
@@ -17,672 +18,13 @@ function isViewsEnabled() {
   return readFrontendMode() === "server-htmx";
 }
 
-// ../../src/core/http/middleware.ts
-function isRouteHandler(value) {
-  return typeof value === "function";
-}
-function isMethodRouteMap(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const entries = Object.entries(value);
-  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
-}
-function composeMiddleware(...middleware) {
-  return (handler) => {
-    return async (request) => {
-      let index = 0;
-      const dispatch = async () => {
-        if (index >= middleware.length) {
-          return await handler(request);
-        }
-        const current = middleware[index];
-        index += 1;
-        if (!current) {
-          return await handler(request);
-        }
-        return await current(request, dispatch);
-      };
-      return await dispatch();
-    };
-  };
-}
-function wrapRouteHandler(handler, middleware) {
-  if (isMethodRouteMap(handler)) {
-    const wrapped = {};
-    for (const [method, routeHandler] of Object.entries(handler)) {
-      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
-    }
-    return wrapped;
-  }
-  if (isRouteHandler(handler)) {
-    return composeMiddleware(...middleware)(handler);
-  }
-  return handler;
-}
-function applyMiddlewareToRoutes(routes, middleware) {
-  const wrapped = {};
-  for (const [path, routeHandler] of Object.entries(routes)) {
-    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
-  }
-  return wrapped;
-}
-
-// ../../src/core/view/etaViewEngine.ts
-import { join } from "path";
-import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-// ../../src/bootstrap/config.ts
-import {
-  CORE_AUTH_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens.ts";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
-// ../../src/modules/user/provider.ts
-import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
-import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
-import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/modules/user/apiTokenRepository.ts
-import { BaseRepository } from "@getstrata/core/database";
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/user/apiTokenTable.ts
-import { defineTable } from "@getstrata/core/database";
-var apiTokenTable = defineTable({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/authService.ts
-import { verifyPassword } from "@getstrata/core/auth/password";
-import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError } from "@getstrata/core/errors/http";
-import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
-import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
-import { verifyTotp } from "@getstrata/core/security/totp";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/domain/abilities.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
-  "auth:tokens:read",
-  "auth:tokens:write"
-];
-var ADMIN_ABILITIES = [
-  ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
-  "webhooks:read",
-  "webhooks:write",
-  "audit:read"
-];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
-// ../../src/modules/user/notificationRepository.ts
-import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
-
-// ../../src/modules/user/notificationTable.ts
-import { defineTable as defineTable2 } from "@getstrata/core/database";
-var notificationTable = defineTable2({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
+// ../../src/bootstrap/buildWebModuleRoutes.ts
+import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/core/http/middleware";
 
-// ../../src/modules/user/notificationService.ts
-import { NotFoundError } from "@getstrata/core/errors/http";
+// ../../src/bootstrap/buildModuleRoutes.ts
+import { conditionalJsonResponse } from "@getstrata/core/http";
+import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
-// ../../src/modules/user/oauthIdentityRepository.ts
-import { BaseRepository as BaseRepository3, defineTable as defineTable3 } from "@getstrata/core/database";
-var oauthIdentityTable = defineTable3({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/repository.ts
-import {
-  emailLookupForQuery,
-  protectEmail,
-  revealEmail
-} from "@getstrata/core/crypto/fieldEncryption";
-import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
-import { BaseRepository as BaseRepository4 } from "@getstrata/core/database";
-import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/user/table.ts
-import { defineTable as defineTable4 } from "@getstrata/core/database";
-var userTable = defineTable4({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/tokenService.ts
-import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
-import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
-
-// ../../src/modules/user/provider.ts
-var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
-
-// ../../src/core/auth/authContext.ts
-var authContext = createAsyncContextStore("@getstrata/authContext");
-function currentAuthUser() {
-  return authContext.getStore() ?? null;
-}
-
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
-    }
-  }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
-  }
-  return null;
-}
-
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  return {
-    token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
-  }
-  return createCsrfTokenCookie();
-}
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
-  }
-  return resolveCsrfToken(request).token;
-}
-
-// ../../src/core/http/flashSession.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
-  }
-  return parseFlashCookie(cookieValue);
-}
-
-// ../../src/core/view/webLayoutData.ts
-async function resolveWebLayoutData(container, request) {
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return { authUser: null, csrfToken, flash };
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return { authUser: null, csrfToken, flash };
-  }
-  if (!container.has(tokenServiceToken)) {
-    return {
-      authUser: {
-        id: userId,
-        email: "",
-        role: authUser.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  }
-  const tokenService = container.resolve(tokenServiceToken);
-  try {
-    const user = await tokenService.findByIdOrThrow(userId);
-    return {
-      authUser: {
-        id: userId,
-        email: user.email ?? "",
-        role: authUser.role ?? user.role ?? "member"
-      },
-      csrfToken,
-      flash
-    };
-  } catch {
-    return { authUser: null, csrfToken, flash };
-  }
-}
 // ../../src/bootstrap/httpKernel.ts
 import {
   createAuthMiddleware,
@@ -743,6 +85,30 @@ function resolveRegisterRateLimit() {
   };
 }
 
+// ../../src/bootstrap/config.ts
+import {
+  CORE_AUTH_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens.ts";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -909,7 +275,7 @@ function createHttpKernel(dependencies) {
 
 // ../../src/bootstrap/discoverModules.ts
 import { readdirSync } from "fs";
-import { join as join2 } from "path";
+import { join } from "path";
 import { pathToFileURL } from "url";
 var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
 function readDiscoverModulesState() {
@@ -932,7 +298,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join2(import.meta.dir, "../modules");
+  return join(import.meta.dir, "../modules");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -946,7 +312,7 @@ async function loadDiscoveredModules(options) {
     throw error;
   }
   const modules = await Promise.all(moduleNames.map(async (moduleName) => {
-    const moduleUrl = pathToFileURL(join2(modulesDirectory, moduleName, "index.ts")).href;
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
     const loaded = await import(moduleUrl);
     return loaded.default;
   }));
@@ -966,6 +332,17 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+// ../../src/bootstrap/prefixRouteMap.ts
+function prefixRouteMap(prefix, routes) {
+  const normalizedPrefix = prefix.replace(/\/$/, "");
+  const prefixed = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
+  }
+  return prefixed;
+}
+
 // ../../src/bootstrap/routeRegistry.ts
 class RouteRegistry {
   routes = [];
@@ -991,49 +368,90 @@ function readSharedRouteRegistry() {
 }
 var routeRegistry = readSharedRouteRegistry();
 
-// ../../src/bootstrap/createWebRoutes.ts
-function registerRoute(method, path, middleware) {
+// ../../src/bootstrap/buildModuleRoutes.ts
+function registerOpenApiRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
-function registerRouteMap(routes, middleware) {
+function registerOpenApiRouteMap(routes, middleware) {
   const registered = {};
   for (const [path, handler] of Object.entries(routes)) {
     if (handler && typeof handler === "object" && !Array.isArray(handler)) {
       const methodMap = handler;
       registered[path] = methodMap;
       for (const method of Object.keys(methodMap)) {
-        registerRoute(method.toUpperCase(), path, middleware);
+        registerOpenApiRoute(method.toUpperCase(), path, middleware);
       }
       continue;
     }
     registered[path] = handler;
-    registerRoute("GET", path, middleware);
+    registerOpenApiRoute("GET", path, middleware);
   }
   return registered;
 }
-function createWebRoutes(dependencies) {
+function createCachedJson(dependencies) {
+  return async (cacheKey, loader, tags = [], request) => {
+    const data = tags.length > 0 ? await dependencies.cache.tags(...tags).remember(cacheKey, loader) : await dependencies.cache.remember(cacheKey, loader);
+    return conditionalJsonResponse(request, data);
+  };
+}
+function buildModuleRoutes(dependencies, options = {}) {
+  const { apiPrefix = "", modules = discoverModules(), clearRegistry = true } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
+  }
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const cachedJson = createCachedJson(dependencies);
+  const moduleRoutes = {};
+  for (const module of modules) {
+    if (!module.routes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.routes({ dependencies, cachedJson, kernel }));
+  }
+  const prefixedModuleRoutes = prefixRouteMap(apiPrefix, moduleRoutes);
+  return applyMiddlewareToRoutes(registerOpenApiRouteMap(prefixedModuleRoutes, ["global", "api"]), middleware);
+}
+
+// ../../src/bootstrap/buildWebModuleRoutes.ts
+function buildWebModuleRoutes(dependencies, options = {}) {
+  const { modules = discoverModules(), clearRegistry = true, seedRoutes = {} } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
+  }
   const kernel = createHttpKernel(dependencies);
   const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
-  const moduleRoutes = {
-    "/": () => Response.redirect("/organizations", 302)
-  };
-  registerRoute("GET", "/", ["global", "web"]);
-  for (const module of discoverModules()) {
+  const moduleRoutes = { ...seedRoutes };
+  for (const module of modules) {
     if (!module.webRoutes) {
       continue;
     }
     Object.assign(moduleRoutes, module.webRoutes({
       dependencies,
-      cachedJson: async () => htmlResponse(""),
+      cachedJson: async () => new Response(""),
       kernel
     }));
   }
-  const wrappedRoutes = applyMiddlewareToRoutes(registerRouteMap(moduleRoutes, ["global", "web"]), middleware);
+  return applyMiddlewareToRoutes2(registerOpenApiRouteMap(moduleRoutes, ["global", "web"]), middleware);
+}
+
+// ../../src/bootstrap/createWebRoutes.ts
+function registerRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function createWebRoutes(dependencies) {
+  const wrappedRoutes = buildWebModuleRoutes(dependencies, {
+    clearRegistry: false,
+    seedRoutes: {
+      "/": () => Response.redirect("/organizations", 302)
+    }
+  });
+  registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join3(process.cwd(), "public", relativePath));
+    const file = Bun.file(join2(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
       return htmlResponse("Not Found", { status: 404 });
     }