@getstrata/bootstrap 0.2.62 → 0.2.63

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.63
+
+- `HttpKernel.wrapWebGuest()` `home` accepts `string | ((user) => string | Promise<string>)` so signed-in guest redirects can follow the current team. Default remains `/organizations`.
+
 ## 0.2.62
 
 - `HttpKernel.wrapWebPasswordConfirm()` is Laravel `password.confirm` for HTML routes. Peer `@getstrata/core` `^0.5.75`.

package/README.md

@@ -32,7 +32,7 @@ import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bo
 
 Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema. WorkHub’s table is `sessions` (`0031_create_sessions`); its loader is `loadWorkhubSessionUser` (maps `users.role`, decrypts email). WorkHub web login itself stays on HMAC `SessionGuard`.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
 
 These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
 

package/dist/bootstrap/httpKernel.d.ts

@@ -1,7 +1,9 @@
+import type { AuthUser } from "@getstrata/core/auth/authContext";
 import type { Policy } from "@getstrata/core/auth/policy";
 import type { Middleware, RouteHandler } from "@getstrata/core/http/middleware";
 import type { AppDependencies } from "./contracts";
 type MiddlewareGroupName = "api" | "authenticated" | "web";
+type WebGuestHome = string | ((user: AuthUser) => string | Promise<string>);
 declare class HttpKernel {
     private readonly dependencies;
     constructor(dependencies: AppDependencies);
@@ -11,7 +13,7 @@ declare class HttpKernel {
     wrapApi(handler: RouteHandler): RouteHandler;
     wrapWeb(handler: RouteHandler): RouteHandler;
     /** Laravel `guest` / `RedirectIfAuthenticated` — signed-in users go to `home`. */
-    wrapWebGuest(handler: RouteHandler, home?: string): RouteHandler;
+    wrapWebGuest(handler: RouteHandler, home?: WebGuestHome): RouteHandler;
     wrapWebPublicRead(handler: RouteHandler): RouteHandler;
     wrapWebAuthenticated(handler: RouteHandler): RouteHandler;
     /** Signed-in HTML without Laravel `verified` (logout, verification notice). */
@@ -36,5 +38,5 @@ declare class HttpKernel {
     private wrapThrottle;
 }
 declare function createHttpKernel(dependencies: AppDependencies): HttpKernel;
-export type { MiddlewareGroupName };
+export type { MiddlewareGroupName, WebGuestHome };
 export { createHttpKernel, HttpKernel };

package/dist/entries/buildModuleRoutes.js

@@ -189,7 +189,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });

package/dist/entries/buildWebModuleRoutes.js

@@ -192,7 +192,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });

package/dist/entries/context.js

@@ -475,15 +475,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -496,6 +641,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/createRoutes.js

@@ -229,7 +229,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -797,7 +798,7 @@ function assertScimIfMatch(request, etagSource) {
 // ../../src/modules/scim/service.ts
 import { hashPassword as hashPassword3 } from "@getstrata/core/auth/password";
 import { resolveService } from "@getstrata/core/contracts/di";
-import { NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError7 } from "@getstrata/core/errors/http";
 import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/domain/scim.ts
@@ -1050,6 +1051,7 @@ import {
 import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
 import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
 import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
+import { getRequiredDependency } from "@getstrata/core/contracts/di";
 
 // ../../src/modules/user/apiTokenRepository.ts
 import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
@@ -1073,9 +1075,16 @@ var apiTokenTable = defineTable2({
 });
 
 // ../../src/modules/user/authService.ts
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";
+import { normalizeEmail } from "@getstrata/core/crypto/fieldEncryption";
 import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError, ValidationError } from "@getstrata/core/errors/http";
+import { UnauthorizedError as UnauthorizedError2, ValidationError } from "@getstrata/core/errors/http";
+import {
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  recoveryCodeMatches
+} from "@getstrata/core/security/recoveryCodes";
 import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
 import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";
@@ -1084,6 +1093,7 @@ import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tena
 // ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
+  "organizations:create",
   "projects:read",
   "projects:create",
   "tasks:read",
@@ -1093,7 +1103,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,
@@ -1111,6 +1122,14 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
+// ../../src/modules/user/mfaRequiredError.ts
+import { UnauthorizedError } from "@getstrata/core/errors/http";
+
+// ../../src/modules/user/currentOrganizationService.ts
+import { assertResourceInCurrentTenant } from "@getstrata/core/auth/membershipScope";
+import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
+import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
 
@@ -1124,7 +1143,7 @@ var notificationTable = defineTable3({
 });
 
 // ../../src/modules/user/notificationService.ts
-import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
+import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
 
 // ../../src/modules/user/oauthIdentityRepository.ts
 import { BaseRepository as BaseRepository4 } from "@getstrata/core/database/baseRepository";
@@ -1143,11 +1162,16 @@ import { ValidationError as ValidationError2 } from "@getstrata/core/errors/http
 import { absoluteTemporarySignedUrl } from "@getstrata/core/http/signedUrl";
 import { mailer } from "@getstrata/core/mail/mailer";
 import { sendMarkdownMail } from "@getstrata/core/mail/markdownMailable";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { logSecurityEvent as logSecurityEvent2 } from "@getstrata/core/security/securityEvents";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 var RESET_TTL_SECONDS = 60 * 60;
 var VERIFY_TTL_SECONDS = 60 * 60 * 24;
 
+// ../../src/modules/user/profilePhotoService.ts
+import { BadRequestError, NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
+import { isImageMimeType, resizeImageContents } from "@getstrata/core/media/imageTransform";
+
 // ../../src/modules/user/repository.ts
 import {
   emailLookupForQuery,
@@ -1174,15 +1198,76 @@ var userTable = defineTable5({
     "email_verified_at",
     "mfa_secret",
     "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
     "created_at",
     "updated_at"
   ],
   defaultOrderBy: { column: "id", direction: "ASC" }
 });
 
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository5 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret2(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId3(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId3()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
 // ../../src/modules/user/tokenService.ts
+import { ADMIN_ABILITIES as ADMIN_ABILITIES2 } from "@getstrata/core/auth/abilityCatalog";
 import { hashApiToken as hashApiToken2 } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
+import { ForbiddenError, NotFoundError as NotFoundError6, ValidationError as ValidationError3 } from "@getstrata/core/errors/http";
 import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
 
 // ../../src/modules/user/provider.ts
@@ -1240,7 +1325,7 @@ class ScimService {
   async findUserRecord(id) {
     const user = await this.users.findById(id);
     if (!user || user.tenant_id !== currentTenantId4()) {
-      throw new NotFoundError5(`SCIM user ${id} not found.`);
+      throw new NotFoundError7(`SCIM user ${id} not found.`);
     }
     return user;
   }
@@ -1282,7 +1367,7 @@ class ScimService {
     const user = await this.findUserRecord(id);
     const deleted = await this.users.deleteById(id);
     if (!deleted) {
-      throw new NotFoundError5(`SCIM user ${id} not found.`);
+      throw new NotFoundError7(`SCIM user ${id} not found.`);
     }
     return { id: user.id, updated_at: user.updated_at };
   }

package/dist/entries/createWebRoutes.js

@@ -197,7 +197,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });

package/dist/entries/dependencies.js

@@ -475,15 +475,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -496,6 +641,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/httpKernel.js

@@ -185,7 +185,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });

package/dist/entries/providers/view.js

@@ -2,15 +2,160 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -23,6 +168,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/providers.js

@@ -465,15 +465,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -486,6 +631,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/web/routing.js

@@ -194,7 +194,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });

package/dist/index.js

@@ -201,7 +201,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -865,15 +866,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled as isViewsEnabled2 } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -886,6 +1032,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.62",
+  "version": "0.2.63",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -173,7 +173,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {