@getstrata/bootstrap 0.2.6 → 0.2.8

package/dist/entries/createWebRoutes.js

@@ -0,0 +1,996 @@
+// @bun
+// ../../src/bootstrap/createWebRoutes.ts
+import { join as join3 } from "path";
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/core/http/middleware.ts
+function isRouteHandler(value) {
+  return typeof value === "function";
+}
+function isMethodRouteMap(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const entries = Object.entries(value);
+  return entries.length > 0 && entries.every(([, handler]) => isRouteHandler(handler));
+}
+function composeMiddleware(...middleware) {
+  return (handler) => {
+    return async (request) => {
+      let index = 0;
+      const dispatch = async () => {
+        if (index >= middleware.length) {
+          return await handler(request);
+        }
+        const current = middleware[index];
+        index += 1;
+        if (!current) {
+          return await handler(request);
+        }
+        return await current(request, dispatch);
+      };
+      return await dispatch();
+    };
+  };
+}
+function wrapRouteHandler(handler, middleware) {
+  if (isMethodRouteMap(handler)) {
+    const wrapped = {};
+    for (const [method, routeHandler] of Object.entries(handler)) {
+      wrapped[method] = composeMiddleware(...middleware)(routeHandler);
+    }
+    return wrapped;
+  }
+  if (isRouteHandler(handler)) {
+    return composeMiddleware(...middleware)(handler);
+  }
+  return handler;
+}
+function applyMiddlewareToRoutes(routes, middleware) {
+  const wrapped = {};
+  for (const [path, routeHandler] of Object.entries(routes)) {
+    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+  }
+  return wrapped;
+}
+
+// ../../src/core/view/etaViewEngine.ts
+import { join } from "path";
+import { Eta } from "eta";
+var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
+var DEFAULT_LAYOUT = "layouts/app.eta";
+
+class EtaViewEngine {
+  eta;
+  resolveLayoutData;
+  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
+    this.eta = new Eta({
+      views: viewsDirectory,
+      autoTrim: false
+    });
+    this.resolveLayoutData = resolveLayoutData;
+  }
+  async render(name, data = {}, options = {}) {
+    const template = name.endsWith(".eta") ? name : `${name}.eta`;
+    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
+    const mergedData = { ...layoutData, ...data };
+    const body = await this.eta.renderAsync(template, mergedData);
+    const layout = options.layout ?? DEFAULT_LAYOUT;
+    if (layout === false) {
+      return body;
+    }
+    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
+    return await this.eta.renderAsync(layoutTemplate, {
+      ...mergedData,
+      body
+    });
+  }
+}
+// ../../src/core/view/htmlResponse.ts
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/modules/user/provider.ts
+import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
+import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
+import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/modules/user/apiTokenRepository.ts
+import { BaseRepository } from "@getstrata/core/database";
+
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var activeConnection = new AsyncLocalStorage;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/modules/user/apiTokenTable.ts
+import { defineTable } from "@getstrata/core/database";
+var apiTokenTable = defineTable({
+  name: "api_token",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "user_id",
+    "name",
+    "token_hash",
+    "abilities",
+    "last_used_at",
+    "expires_at",
+    "created_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/authService.ts
+import { verifyPassword } from "@getstrata/core/auth/password";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
+import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
+import { verifyTotp } from "@getstrata/core/security/totp";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/domain/abilities.ts
+var MEMBER_ABILITIES = [
+  "organizations:read",
+  "projects:read",
+  "projects:create",
+  "tasks:read",
+  "tasks:create",
+  "comments:read",
+  "comments:create",
+  "attachments:read",
+  "attachments:create",
+  "auth:tokens:read",
+  "auth:tokens:write"
+];
+var ADMIN_ABILITIES = [
+  ...MEMBER_ABILITIES,
+  "organizations:create",
+  "organizations:update",
+  "organizations:delete",
+  "projects:update",
+  "projects:delete",
+  "tasks:update",
+  "tasks:delete",
+  "comments:update",
+  "comments:delete",
+  "attachments:delete",
+  "webhooks:read",
+  "webhooks:write",
+  "audit:read"
+];
+var PLATFORM_ADMIN_ABILITIES = ["*"];
+function resolveAbilitiesForRole(role) {
+  if (role === "admin") {
+    return [...PLATFORM_ADMIN_ABILITIES];
+  }
+  return [...MEMBER_ABILITIES];
+}
+
+// ../../src/modules/user/authService.ts
+class AuthService {
+  users;
+  tokens;
+  oauthIdentities;
+  oauthProviders = new Map;
+  constructor(users, tokens, oauthIdentities) {
+    this.users = users;
+    this.tokens = tokens;
+    this.oauthIdentities = oauthIdentities;
+  }
+  registerOAuthProvider(provider) {
+    this.oauthProviders.set(provider.name, provider);
+  }
+  getOAuthProvider(name) {
+    return this.oauthProviders.get(name);
+  }
+  async loginWithPassword(email, password, options = {}) {
+    const user = await this.users.findByEmail(email);
+    if (!user?.password_hash) {
+      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
+      throw new UnauthorizedError("Invalid credentials.");
+    }
+    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
+      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
+      throw new UnauthorizedError("Email address is not verified.");
+    }
+    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
+      const mfaSecret = revealMfaSecret(user.mfa_secret);
+      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
+        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
+        throw new UnauthorizedError("Invalid MFA code.");
+      }
+    }
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
+    return await this.tokens.createToken(user.id, {
+      name: "password-login",
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  async loginWithOAuth(providerName, code) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    const profile = await provider.exchangeCode(code);
+    const user = await this.findOrCreateOAuthUser(providerName, profile);
+    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
+    return await this.tokens.createToken(user.id, {
+      name: `${providerName}-oauth`,
+      abilities: resolveAbilitiesForRole(user.role),
+      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
+    });
+  }
+  buildOAuthAuthorizationUrl(providerName, state) {
+    const provider = this.oauthProviders.get(providerName);
+    if (!provider) {
+      throw new UnauthorizedError("Unsupported OAuth provider.");
+    }
+    return provider.getAuthorizationUrl(state);
+  }
+  async findOrCreateOAuthUser(providerName, profile) {
+    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
+    if (existingIdentity) {
+      return await this.users.findByIdOrThrow(existingIdentity.user_id);
+    }
+    const existingUser = await this.users.findByEmail(profile.email);
+    const user = existingUser ?? await this.users.create({
+      name: profile.name,
+      email: profile.email,
+      role: "member",
+      tenant_id: currentTenantId(),
+      email_verified_at: new Date,
+      created_at: new Date,
+      updated_at: new Date
+    });
+    await this.oauthIdentities.create({
+      user_id: user.id,
+      provider: providerName,
+      provider_user_id: profile.providerUserId,
+      email: profile.email,
+      created_at: new Date
+    });
+    return user;
+  }
+}
+
+// ../../src/modules/user/notificationRepository.ts
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database";
+
+// ../../src/modules/user/notificationTable.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database";
+var notificationTable = defineTable2({
+  name: "notification",
+  primaryKey: "id",
+  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
+  defaultOrderBy: { column: "created_at", direction: "DESC" }
+});
+
+// ../../src/modules/user/notificationService.ts
+import { NotFoundError } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/oauthIdentityRepository.ts
+import { BaseRepository as BaseRepository3, defineTable as defineTable3 } from "@getstrata/core/database";
+var oauthIdentityTable = defineTable3({
+  name: "oauth_identity",
+  primaryKey: "id",
+  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
+});
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository4 } from "@getstrata/core/database";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable4 } from "@getstrata/core/database";
+var userTable = defineTable4({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/tokenService.ts
+import { hashApiToken } from "@getstrata/core/auth/tokenHash";
+import { ForbiddenError, NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
+import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
+
+// ../../src/modules/user/provider.ts
+var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
+
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var authContext = new AsyncLocalStorage2;
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+
+// ../../src/core/http/requestMetaContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+var requestMetaContext = new AsyncLocalStorage3;
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
+// ../../src/core/http/csrfToken.ts
+var CSRF_COOKIE = "workhub_csrf";
+var CSRF_TTL_MS = 60 * 60 * 1000;
+function resolveCsrfSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
+}
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
+}
+function createCsrfTokenCookie() {
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
+  return {
+    token,
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
+  };
+}
+function resolveCsrfToken(request) {
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
+  }
+  return createCsrfTokenCookie();
+}
+function resolveCsrfTokenForRequest(request) {
+  const metaToken = currentRequestMeta().csrfToken;
+  if (metaToken) {
+    return metaToken;
+  }
+  return resolveCsrfToken(request).token;
+}
+
+// ../../src/core/http/flashSession.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var FLASH_COOKIE = "workhub_flash";
+var FLASH_TTL_MS = 60 * 1000;
+function resolveFlashSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
+}
+function signFlashPayload(payload, issuedAt) {
+  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  return `${payload}.${issuedAt}.${signature}`;
+}
+function readFlashCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === FLASH_COOKIE) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function parseFlashCookie(cookieValue) {
+  const parts = cookieValue.split(".");
+  if (parts.length < 3) {
+    return null;
+  }
+  const signature = parts.pop();
+  const issuedAtRaw = parts.pop();
+  const payload = parts.join(".");
+  if (!signature || !issuedAtRaw || !payload) {
+    return null;
+  }
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
+    return null;
+  }
+  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
+  if (!expectedSignature) {
+    return null;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return null;
+  }
+  if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (!parsed?.message || typeof parsed.message !== "string") {
+      return null;
+    }
+    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function pullFlash(request) {
+  const cookieValue = readFlashCookie(request);
+  if (!cookieValue) {
+    return null;
+  }
+  return parseFlashCookie(cookieValue);
+}
+
+// ../../src/core/view/webLayoutData.ts
+async function resolveWebLayoutData(container, request) {
+  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
+  const flash = request ? currentRequestMeta().flash ?? pullFlash(request) : null;
+  const authUser = currentAuthUser();
+  if (!authUser) {
+    return { authUser: null, csrfToken, flash };
+  }
+  const userId = Number(authUser.id);
+  if (!Number.isInteger(userId) || userId <= 0) {
+    return { authUser: null, csrfToken, flash };
+  }
+  if (!container.has(tokenServiceToken)) {
+    return {
+      authUser: {
+        id: userId,
+        email: "",
+        role: authUser.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  }
+  const tokenService = container.resolve(tokenServiceToken);
+  try {
+    const user = await tokenService.findByIdOrThrow(userId);
+    return {
+      authUser: {
+        id: userId,
+        email: user.email ?? "",
+        role: authUser.role ?? user.role ?? "member"
+      },
+      csrfToken,
+      flash
+    };
+  } catch {
+    return { authUser: null, csrfToken, flash };
+  }
+}
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
+}
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL } from "url";
+async function loadDiscoveredModules() {
+  const modulesDirectory = join2(import.meta.dir, "../modules");
+  let moduleNames;
+  try {
+    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join2(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+var appModules = await loadDiscoveredModules();
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var routeRegistry = new RouteRegistry;
+
+// ../../src/bootstrap/createWebRoutes.ts
+function registerRoute(method, path, middleware) {
+  routeRegistry.register({ method, path, middleware });
+}
+function registerRouteMap(routes, middleware) {
+  const registered = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methodMap = handler;
+      registered[path] = methodMap;
+      for (const method of Object.keys(methodMap)) {
+        registerRoute(method.toUpperCase(), path, middleware);
+      }
+      continue;
+    }
+    registered[path] = handler;
+    registerRoute("GET", path, middleware);
+  }
+  return registered;
+}
+function createWebRoutes(dependencies) {
+  const kernel = createHttpKernel(dependencies);
+  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const moduleRoutes = {
+    "/": () => Response.redirect("/organizations", 302)
+  };
+  registerRoute("GET", "/", ["global", "web"]);
+  for (const module of appModules) {
+    if (!module.webRoutes) {
+      continue;
+    }
+    Object.assign(moduleRoutes, module.webRoutes({
+      dependencies,
+      cachedJson: async () => htmlResponse(""),
+      kernel
+    }));
+  }
+  const wrappedRoutes = applyMiddlewareToRoutes(registerRouteMap(moduleRoutes, ["global", "web"]), middleware);
+  wrappedRoutes["/assets/*"] = async (request) => {
+    registerRoute("GET", "/assets/*", ["global", "web"]);
+    const pathname = new URL(request.url).pathname;
+    const relativePath = pathname.replace(/^\//, "");
+    const file = Bun.file(join3(process.cwd(), "public", relativePath));
+    if (!await file.exists()) {
+      return htmlResponse("Not Found", { status: 404 });
+    }
+    return new Response(file);
+  };
+  registerRoute("GET", "/assets/*", ["global", "web"]);
+  return wrappedRoutes;
+}
+function mergeWebRoutes(dependencies, routes) {
+  if (!isViewsEnabled()) {
+    return routes;
+  }
+  return {
+    ...createWebRoutes(dependencies),
+    ...routes
+  };
+}
+export {
+  mergeWebRoutes,
+  createWebRoutes
+};