@getstrata/bootstrap 0.2.28 → 0.2.30

package/dist/entries/createRoutes.js

@@ -0,0 +1,1468 @@
+// @bun
+var __jsonParse = (a) => JSON.parse(a);
+
+// ../../src/bootstrap/createRoutes.ts
+import { jsonResponse as jsonResponse4 } from "@getstrata/core/http";
+import { applyMiddlewareToRoutes as applyMiddlewareToRoutes3 } from "@getstrata/core/http/middleware";
+import { htmlResponse as htmlResponse2 } from "@getstrata/core/view";
+
+// ../../index.html
+var strata_default = __jsonParse("{\"index\":\"../../index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"../../index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
+
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+function isSpaEnabled() {
+  return readFrontendMode() === "spa-react";
+}
+
+// ../../src/bootstrap/buildModuleRoutes.ts
+import { conditionalJsonResponse } from "@getstrata/core/http";
+import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
+
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
+}
+
+// ../../src/bootstrap/config.ts
+import {
+  CORE_AUTH_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
+function readDiscoverModulesState() {
+  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = { appModules: [] };
+  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
+  return state;
+}
+function configureModulesDirectory(modulesDir) {
+  readDiscoverModulesState().configuredModulesDir = modulesDir;
+}
+function resolveModulesDirectory(options) {
+  const state = readDiscoverModulesState();
+  if (options?.modulesDir) {
+    return options.modulesDir;
+  }
+  if (state.configuredModulesDir) {
+    return state.configuredModulesDir;
+  }
+  return join(import.meta.dir, "../modules");
+}
+async function loadDiscoveredModules(options) {
+  const modulesDirectory = resolveModulesDirectory(options);
+  let moduleNames;
+  try {
+    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+async function ensureModulesLoaded(options) {
+  const state = readDiscoverModulesState();
+  if (state.appModules.length > 0) {
+    return state.appModules;
+  }
+  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
+    state.appModules.splice(0, state.appModules.length, ...modules);
+    return state.appModules;
+  });
+  return state.modulesReady;
+}
+function discoverModules() {
+  return readDiscoverModulesState().appModules;
+}
+// ../../src/bootstrap/prefixRouteMap.ts
+function prefixRouteMap(prefix, routes) {
+  const normalizedPrefix = prefix.replace(/\/$/, "");
+  const prefixed = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+    prefixed[`${normalizedPrefix}${normalizedPath}`] = handler;
+  }
+  return prefixed;
+}
+
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
+
+// ../../src/bootstrap/buildModuleRoutes.ts
+function registerOpenApiRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function registerOpenApiRouteMap(routes, middleware) {
+  const registered = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methodMap = handler;
+      registered[path] = methodMap;
+      for (const method of Object.keys(methodMap)) {
+        registerOpenApiRoute(method.toUpperCase(), path, middleware);
+      }
+      continue;
+    }
+    registered[path] = handler;
+    registerOpenApiRoute("GET", path, middleware);
+  }
+  return registered;
+}
+function createCachedJson(dependencies) {
+  return async (cacheKey, loader, tags = [], request) => {
+    const data = tags.length > 0 ? await dependencies.cache.tags(...tags).remember(cacheKey, loader) : await dependencies.cache.remember(cacheKey, loader);
+    return conditionalJsonResponse(request, data);
+  };
+}
+function buildModuleRoutes(dependencies, options = {}) {
+  const { apiPrefix = "", modules = discoverModules(), clearRegistry = true } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
+  }
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("api")];
+  const cachedJson = createCachedJson(dependencies);
+  const moduleRoutes = {};
+  for (const module of modules) {
+    if (!module.routes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.routes({ dependencies, cachedJson, kernel }));
+  }
+  const prefixedModuleRoutes = prefixRouteMap(apiPrefix, moduleRoutes);
+  return applyMiddlewareToRoutes(registerOpenApiRouteMap(prefixedModuleRoutes, ["global", "api"]), middleware);
+}
+
+// ../../src/bootstrap/createSpaRoutes.ts
+import { join as join2 } from "path";
+import { jsonResponse } from "@getstrata/core/http";
+var SPA_DIST_DIRECTORY = join2(process.cwd(), "frontend/dist");
+var SPA_INDEX_FILE = join2(SPA_DIST_DIRECTORY, "index.html");
+function createSpaRoutes(_dependencies) {
+  return {
+    "/app/*": async (request) => {
+      const pathname = new URL(request.url).pathname;
+      const relativePath = pathname.replace(/^\/app\//, "");
+      const assetFile = Bun.file(join2(SPA_DIST_DIRECTORY, relativePath));
+      if (relativePath.length > 0 && await assetFile.exists()) {
+        return new Response(assetFile);
+      }
+      const indexFile = Bun.file(SPA_INDEX_FILE);
+      if (await indexFile.exists()) {
+        return new Response(indexFile, {
+          headers: { "Content-Type": "text/html; charset=utf-8" }
+        });
+      }
+      return jsonResponse({
+        error: "SPA build not found. Run `cd frontend && bun install && bun run build`."
+      }, { status: 503 });
+    },
+    "/": async () => Response.redirect("/app/", 302)
+  };
+}
+function mergeSpaRoutes(dependencies, routes) {
+  if (!isSpaEnabled()) {
+    return routes;
+  }
+  return {
+    ...createSpaRoutes(dependencies),
+    ...routes
+  };
+}
+
+// ../../src/bootstrap/createWebRoutes.ts
+import { join as join3 } from "path";
+import { htmlResponse } from "@getstrata/core/view";
+
+// ../../src/bootstrap/buildWebModuleRoutes.ts
+import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/core/http/middleware";
+function buildWebModuleRoutes(dependencies, options = {}) {
+  const { modules = discoverModules(), clearRegistry = true, seedRoutes = {} } = options;
+  if (clearRegistry) {
+    routeRegistry.clear();
+  }
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const moduleRoutes = { ...seedRoutes };
+  for (const module of modules) {
+    if (!module.webRoutes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.webRoutes({
+      dependencies,
+      cachedJson: async () => new Response(""),
+      kernel
+    }));
+  }
+  return applyMiddlewareToRoutes2(registerOpenApiRouteMap(moduleRoutes, ["global", "web"]), middleware);
+}
+
+// ../../src/bootstrap/createWebRoutes.ts
+function registerRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function createWebRoutes(dependencies) {
+  const wrappedRoutes = buildWebModuleRoutes(dependencies, {
+    clearRegistry: false,
+    seedRoutes: {
+      "/": () => Response.redirect("/organizations", 302)
+    }
+  });
+  registerRoute("GET", "/", ["global", "web"]);
+  wrappedRoutes["/assets/*"] = async (request) => {
+    registerRoute("GET", "/assets/*", ["global", "web"]);
+    const pathname = new URL(request.url).pathname;
+    const relativePath = pathname.replace(/^\//, "");
+    const file = Bun.file(join3(process.cwd(), "public", relativePath));
+    if (!await file.exists()) {
+      return htmlResponse("Not Found", { status: 404 });
+    }
+    return new Response(file);
+  };
+  registerRoute("GET", "/assets/*", ["global", "web"]);
+  return wrappedRoutes;
+}
+function mergeWebRoutes(dependencies, routes) {
+  if (!isViewsEnabled()) {
+    return routes;
+  }
+  return {
+    ...createWebRoutes(dependencies),
+    ...routes
+  };
+}
+
+// ../../src/bootstrap/health.ts
+import { jsonResponse as jsonResponse2 } from "@getstrata/core/http";
+var {RedisClient } = globalThis.Bun;
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+async function pingDatabase(connection = getDatabase()) {
+  try {
+    await connection`SELECT 1`;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureDatabaseConnection() {
+  if (await pingDatabase()) {
+    return getDatabase();
+  }
+  await getDatabase().close().catch(() => {
+    return;
+  });
+  connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  registerDefaultDatabasePool(connectionHolder.connection);
+  return getDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/bootstrap/health.ts
+function resolveRedisUrl(dependencies) {
+  if (!dependencies.container.has(CORE_CONFIG_TOKEN)) {
+    return process.env.REDIS_URL?.trim() || undefined;
+  }
+  const config = dependencies.container.resolve(CORE_CONFIG_TOKEN);
+  const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim();
+  return redisUrl || undefined;
+}
+async function checkDatabase() {
+  await ensureDatabaseConnection();
+  return await pingDatabase();
+}
+async function checkRedis(redisUrl) {
+  try {
+    const client = new RedisClient(redisUrl);
+    const response = await client.ping();
+    return response === "PONG";
+  } catch {
+    return false;
+  }
+}
+function createHealthRoutes(dependencies) {
+  return {
+    "/health": async () => jsonResponse2({ status: "ok" }),
+    "/ready": async () => {
+      const checks = {
+        database: await checkDatabase() ? "ok" : "error"
+      };
+      const redisUrl = resolveRedisUrl(dependencies);
+      if (redisUrl) {
+        checks.redis = await checkRedis(redisUrl) ? "ok" : "error";
+      } else {
+        checks.redis = "skipped";
+      }
+      const ready = checks.database === "ok" && (checks.redis === "ok" || checks.redis === "skipped");
+      return jsonResponse2({
+        status: ready ? "ready" : "not_ready",
+        checks
+      }, { status: ready ? 200 : 503 });
+    }
+  };
+}
+
+// ../../src/bootstrap/metricsRoutes.ts
+import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";
+function createMetricsRoutes() {
+  return {
+    "/metrics": async () => new Response(prometheusRegistry.renderMetrics(), {
+      status: 200,
+      headers: {
+        "content-type": "text/plain; version=0.0.4; charset=utf-8"
+      }
+    })
+  };
+}
+
+// ../../src/bootstrap/scimRoutes.ts
+import {
+  createScimAuthMiddleware,
+  createScimThrottleMiddleware,
+  withMiddleware as withMiddleware2
+} from "@getstrata/core";
+
+// ../../src/modules/scim/controller.ts
+import { withErrorHandling } from "@getstrata/core/http";
+
+// ../../src/modules/scim/scimResponse.ts
+import {
+  applyConditionalGet,
+  assertIfMatch,
+  etagFromResource,
+  isEtagEnabled
+} from "@getstrata/core";
+import { jsonResponse as jsonResponse3 } from "@getstrata/core/http";
+function scimResponse(data, options = {}) {
+  const status = options.status ?? 200;
+  const response = jsonResponse3(data, {
+    status,
+    headers: {
+      "content-type": "application/scim+json"
+    }
+  });
+  if (!isEtagEnabled() || !options.etagSource) {
+    return response;
+  }
+  const etag = etagFromResource(options.etagSource);
+  if (options.request) {
+    return applyConditionalGet(options.request, response, etag);
+  }
+  const headers = new Headers(response.headers);
+  headers.set("ETag", etag);
+  headers.set("Cache-Control", "private, must-revalidate");
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function assertScimIfMatch(request, etagSource) {
+  if (!isEtagEnabled()) {
+    return;
+  }
+  assertIfMatch(request, etagFromResource(etagSource), { required: true });
+}
+
+// ../../src/modules/scim/service.ts
+import { currentTenantId as currentTenantId4 } from "@getstrata/core";
+import { hashPassword } from "@getstrata/core/auth/password";
+import { resolveService } from "@getstrata/core/contracts/di";
+import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+var SCIM_SCHEMAS = {
+  user: "urn:ietf:params:scim:schemas:core:2.0:User",
+  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
+  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
+  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
+  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
+};
+
+// ../../src/modules/organization/memberRepository.ts
+class OrganizationMemberRepository {
+  constructor() {}
+  async findMembership(userId, organizationId) {
+    const rows = await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId} AND organization_id = ${organizationId}
+      LIMIT 1
+    `;
+    return rows[0] ?? null;
+  }
+  async listForUser(userId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE user_id = ${userId}
+      ORDER BY organization_id
+    `;
+  }
+  async listForOrganization(organizationId) {
+    return await connection_default`
+      SELECT id, organization_id, user_id, role, created_at
+      FROM organization_member
+      WHERE organization_id = ${organizationId}
+      ORDER BY id
+    `;
+  }
+  async addMember(input) {
+    const rows = await connection_default`
+      INSERT INTO organization_member (organization_id, user_id, role)
+      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
+      RETURNING id, organization_id, user_id, role, created_at
+    `;
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Organization member insert did not return a row.");
+    }
+    return row;
+  }
+  async removeMember(organizationId, userId) {
+    const rows = await connection_default`
+      DELETE FROM organization_member
+      WHERE organization_id = ${organizationId} AND user_id = ${userId}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+}
+var memberRepository_default = OrganizationMemberRepository;
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/provider.ts
+import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
+import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
+import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+
+// ../../src/modules/user/apiTokenRepository.ts
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
+
+// ../../src/modules/user/apiTokenTable.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database";
+var apiTokenTable = defineTable2({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/authService.ts
+import { verifyPassword } from "@getstrata/core/auth/password";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
+import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
+import { verifyTotp } from "@getstrata/core/security/totp";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId2(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationRepository.ts
+import { BaseRepository as BaseRepository3 } from "@getstrata/core/database";
+
+// ../../src/modules/user/notificationTable.ts
+import { defineTable as defineTable3 } from "@getstrata/core/database";
+var notificationTable = defineTable3({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/notificationService.ts
+import { NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+import { BaseRepository as BaseRepository4, defineTable as defineTable4 } from "@getstrata/core/database";
+var oauthIdentityTable = defineTable4({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository5 } from "@getstrata/core/database";
+import { currentTenantId as currentTenantId3 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable5 } from "@getstrata/core/database";
+var userTable = defineTable5({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/tokenService.ts
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { ForbiddenError, NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
+
+// ../../src/modules/user/provider.ts
+var userRepositoryToken = "user.repository";
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/modules/scim/service.ts
+class ScimService {
+  users;
+  organizations;
+  members;
+  constructor(users, organizations, members) {
+    this.users = users;
+    this.organizations = organizations;
+    this.members = members;
+  }
+  serviceProviderConfig() {
+    return {
+      schemas: [SCIM_SCHEMAS.serviceProviderConfig],
+      patch: { supported: true },
+      bulk: { supported: false },
+      filter: { supported: false },
+      changePassword: { supported: false },
+      sort: { supported: false },
+      etag: { supported: true },
+      authenticationSchemes: [
+        {
+          type: "oauthbearertoken",
+          name: "OAuth Bearer Token",
+          description: "SCIM bearer token authentication"
+        }
+      ]
+    };
+  }
+  async listUsers(startIndex = 1, count = 100) {
+    const tenantId = currentTenantId4();
+    const offset = Math.max(startIndex - 1, 0);
+    const records = await this.users.findAll({
+      limit: count,
+      offset,
+      where: { tenant_id: tenantId }
+    });
+    const total = await this.users.countForTenant(tenantId);
+    return {
+      schemas: [SCIM_SCHEMAS.listResponse],
+      totalResults: total,
+      startIndex,
+      itemsPerPage: records.length,
+      Resources: records.map((user) => this.toScimUser(user))
+    };
+  }
+  async getUser(id) {
+    const user = await this.findUserRecord(id);
+    return this.toScimUser(user);
+  }
+  async findUserRecord(id) {
+    const user = await this.users.findById(id);
+    if (!user || user.tenant_id !== currentTenantId4()) {
+      throw new NotFoundError4(`SCIM user ${id} not found.`);
+    }
+    return user;
+  }
+  async createUser(payload) {
+    const email = payload.userName ?? payload.emails?.find((entry) => entry.primary)?.value ?? payload.emails?.[0]?.value;
+    if (!email) {
+      throw new Error("SCIM userName or email is required.");
+    }
+    const passwordHash = await hashPassword(crypto.randomUUID());
+    const user = await this.users.create({
+      name: payload.name?.formatted ?? email.split("@")[0] ?? "SCIM User",
+      email,
+      role: "member",
+      tenant_id: currentTenantId4(),
+      password_hash: passwordHash,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    return this.toScimUser(user);
+  }
+  async patchUser(id, operations) {
+    const user = await this.findUserRecord(id);
+    const changes = { updated_at: new Date };
+    for (const operation of operations) {
+      if (operation.op.toLowerCase() === "replace" && operation.path === "active") {
+        continue;
+      }
+      if (operation.op.toLowerCase() === "replace" && operation.path === "displayName") {
+        changes.name = String(operation.value ?? user.name);
+      }
+      if (operation.op.toLowerCase() === "replace" && (operation.path === "userName" || operation.path === 'emails[type eq "work"].value')) {
+        changes.email = String(operation.value ?? user.email);
+      }
+    }
+    const updated = await this.users.updateByIdOrThrow(id, changes);
+    return this.toScimUser(updated);
+  }
+  async deleteUser(id) {
+    const user = await this.findUserRecord(id);
+    const deleted = await this.users.deleteById(id);
+    if (!deleted) {
+      throw new NotFoundError4(`SCIM user ${id} not found.`);
+    }
+    return { id: user.id, updated_at: user.updated_at };
+  }
+  async listGroups(startIndex = 1, count = 100) {
+    const tenantId = currentTenantId4();
+    const offset = Math.max(startIndex - 1, 0);
+    const rows = await this.organizations.listForTenant({ limit: count, offset, tenantId });
+    const total = await this.organizations.countForTenant(tenantId);
+    const resources = await Promise.all(rows.map((row) => this.toScimGroup(row)));
+    return {
+      schemas: [SCIM_SCHEMAS.listResponse],
+      totalResults: total,
+      startIndex,
+      itemsPerPage: resources.length,
+      Resources: resources
+    };
+  }
+  async getGroup(id) {
+    const organization = await this.findOrganizationRecord(id);
+    return await this.toScimGroup(organization);
+  }
+  async findOrganizationRecord(id) {
+    return await this.organizations.findForTenantOrThrow(id, currentTenantId4());
+  }
+  async patchGroup(id, operations) {
+    for (const operation of operations) {
+      if (operation.op.toLowerCase() !== "add" || operation.path !== "members") {
+        continue;
+      }
+      const members = Array.isArray(operation.value) ? operation.value : operation.value ? [operation.value] : [];
+      for (const member of members) {
+        const userId = Number.parseInt(String(member.value ?? ""), 10);
+        if (Number.isInteger(userId) && userId > 0) {
+          await this.members.addMember({ organizationId: id, userId, role: "member" });
+        }
+      }
+    }
+    const organization = await this.findOrganizationRecord(id);
+    return await this.toScimGroup(organization);
+  }
+  async toScimGroup(organization) {
+    const members = await this.members.listForOrganization(organization.id);
+    return {
+      schemas: [SCIM_SCHEMAS.group],
+      id: String(organization.id),
+      displayName: organization.name,
+      externalId: organization.slug,
+      members: members.map((member) => ({
+        value: String(member.user_id),
+        display: String(member.user_id)
+      })),
+      meta: {
+        resourceType: "Group",
+        lastModified: organization.updated_at.toISOString()
+      }
+    };
+  }
+  toScimUser(user) {
+    return {
+      schemas: [SCIM_SCHEMAS.user],
+      id: String(user.id),
+      userName: user.email,
+      name: { formatted: user.name },
+      displayName: user.name,
+      active: true,
+      emails: [{ value: user.email, primary: true, type: "work" }],
+      roles: [{ value: user.role, primary: true }],
+      meta: {
+        resourceType: "User",
+        created: user.created_at?.toISOString(),
+        lastModified: user.updated_at?.toISOString()
+      }
+    };
+  }
+}
+function createScimService(dependencies) {
+  return new ScimService(resolveService(dependencies, userRepositoryToken), new repository_default, new memberRepository_default);
+}
+
+// ../../src/modules/scim/controller.ts
+class ScimController {
+  service;
+  constructor(dependencies, service = createScimService(dependencies)) {
+    this.service = service;
+  }
+  serviceProviderConfig = withErrorHandling(async () => {
+    return scimResponse(this.service.serviceProviderConfig());
+  });
+  listUsers = withErrorHandling(async (request) => {
+    const url = new URL(request.url);
+    const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
+    const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
+    return scimResponse(await this.service.listUsers(startIndex, count));
+  });
+  createUser = withErrorHandling(async (request) => {
+    const payload = await request.json();
+    const user = await this.service.createUser(payload);
+    const id = Number.parseInt(user.id, 10);
+    const record = await this.service.findUserRecord(id);
+    return scimResponse(user, { status: 201, etagSource: record });
+  });
+  showUser = withErrorHandling(async (request) => {
+    const params = request.params;
+    const id = Number.parseInt(params?.id ?? "", 10);
+    const record = await this.service.findUserRecord(id);
+    const user = await this.service.getUser(id);
+    return scimResponse(user, { request, etagSource: record });
+  });
+  patchUser = withErrorHandling(async (request) => {
+    const params = request.params;
+    const id = Number.parseInt(params?.id ?? "", 10);
+    const record = await this.service.findUserRecord(id);
+    assertScimIfMatch(request, record);
+    const body = await request.json();
+    const user = await this.service.patchUser(id, body.Operations ?? []);
+    const updated = await this.service.findUserRecord(id);
+    return scimResponse(user, { etagSource: updated });
+  });
+  deleteUser = withErrorHandling(async (request) => {
+    const params = request.params;
+    const id = Number.parseInt(params?.id ?? "", 10);
+    const record = await this.service.findUserRecord(id);
+    assertScimIfMatch(request, record);
+    await this.service.deleteUser(id);
+    return new Response(null, { status: 204 });
+  });
+  listGroups = withErrorHandling(async (request) => {
+    const url = new URL(request.url);
+    const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
+    const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
+    return scimResponse(await this.service.listGroups(startIndex, count));
+  });
+  showGroup = withErrorHandling(async (request) => {
+    const params = request.params;
+    const id = Number.parseInt(params?.id ?? "", 10);
+    const record = await this.service.findOrganizationRecord(id);
+    const group = await this.service.getGroup(id);
+    return scimResponse(group, { request, etagSource: record });
+  });
+  patchGroup = withErrorHandling(async (request) => {
+    const params = request.params;
+    const id = Number.parseInt(params?.id ?? "", 10);
+    const record = await this.service.findOrganizationRecord(id);
+    assertScimIfMatch(request, record);
+    const body = await request.json();
+    const group = await this.service.patchGroup(id, body.Operations ?? []);
+    const updated = await this.service.findOrganizationRecord(id);
+    return scimResponse(group, { etagSource: updated });
+  });
+}
+var controller_default = ScimController;
+
+// ../../src/bootstrap/scimRoutes.ts
+function createScimRoutes(dependencies) {
+  const redisUrl = process.env.REDIS_URL?.trim() ?? "";
+  const secured = withMiddleware2(createScimThrottleMiddleware({
+    redisUrl: redisUrl || undefined,
+    maxAttempts: Number(process.env.SCIM_RATE_LIMIT_PER_MINUTE ?? "60"),
+    decaySeconds: 60
+  }), createScimAuthMiddleware());
+  const bind = (method) => {
+    return secured(async (request) => {
+      const controller = new controller_default(dependencies);
+      return await method(controller)(request);
+    });
+  };
+  return {
+    "/scim/v2/ServiceProviderConfig": {
+      GET: bind((controller) => controller.serviceProviderConfig)
+    },
+    "/scim/v2/Users": {
+      GET: bind((controller) => controller.listUsers),
+      POST: bind((controller) => controller.createUser)
+    },
+    "/scim/v2/Users/:id": {
+      GET: bind((controller) => controller.showUser),
+      PATCH: bind((controller) => controller.patchUser),
+      DELETE: bind((controller) => controller.deleteUser)
+    },
+    "/scim/v2/Groups": {
+      GET: bind((controller) => controller.listGroups)
+    },
+    "/scim/v2/Groups/:id": {
+      GET: bind((controller) => controller.showGroup),
+      PATCH: bind((controller) => controller.patchGroup)
+    }
+  };
+}
+
+// ../../src/bootstrap/createRoutes.ts
+function registerRoute2(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function createRoutes(dependencies) {
+  const kernel = createHttpKernel(dependencies);
+  const wrappedModuleRoutes = buildModuleRoutes(dependencies, {
+    apiPrefix: appConfig.apiPrefix,
+    clearRegistry: true
+  });
+  const healthRoutes = createHealthRoutes(dependencies);
+  const metricsRoutes = createMetricsRoutes();
+  const scimRoutes = isFeatureEnabled("scim") ? applyMiddlewareToRoutes3(registerOpenApiRouteMap(createScimRoutes(dependencies), ["global", "scim"]), kernel.globalMiddleware()) : {};
+  registerRoute2("GET", "/health", []);
+  registerRoute2("GET", "/ready", []);
+  registerRoute2("GET", "/metrics", []);
+  const baseRoutes = {
+    ...healthRoutes,
+    ...metricsRoutes,
+    ...scimRoutes,
+    ...isViewsEnabled() || isSpaEnabled() ? {} : { "/": strata_default },
+    ...wrappedModuleRoutes,
+    [`${appConfig.apiPrefix}/*`]: async () => {
+      registerRoute2("GET", `${appConfig.apiPrefix}/*`, ["global", "api"]);
+      return jsonResponse4({ error: "Not Found" }, { status: 404 });
+    },
+    "/*": async () => {
+      registerRoute2("GET", "/*", []);
+      if (isViewsEnabled()) {
+        return htmlResponse2("Not Found", { status: 404 });
+      }
+      if (isSpaEnabled()) {
+        return jsonResponse4({ error: "Not Found" }, { status: 404 });
+      }
+      return jsonResponse4({ error: "Not Found" }, { status: 404 });
+    }
+  };
+  return mergeSpaRoutes(dependencies, mergeWebRoutes(dependencies, baseRoutes));
+}
+export {
+  createRoutes
+};