@getstrata/bootstrap 0.2.65 → 0.2.68

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.68
+
+- `configureModulesDirectory()` clears the discovered-module cache when the directory changes, so OpenAPI/`createApp` can load HiroApp after core tests pointed at empty fixtures.
+- `createWebRoutes()` / `mergeWebRoutes()` accept optional `{ modules }` so leftover bootstrap route assembly does not pick up the dogfood app's modules. `CreateWebRoutesOptions` is exported from the public API.
+
+## 0.2.67
+
+- `CookieSessionStore.create()` records optional browser metadata (`userAgent`, `ipAddress`, `last_active_at`).
+- `CookieSessionStore` can list live sessions, touch `last_active_at`, and destroy every session except the current cookie (`listForUser`, `touch`, `destroyOtherSessions`).
+- `CookieSessionAuthManager.signIn()` / `signInRedirect()` accept the same metadata. Apps that use cookie sessions (HiroApp) must have `user_agent`, `ip_address`, and `last_active_at` on `sessions`.
+
+## 0.2.66
+
+- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply WorkHub’s encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. WorkHub’s extra production profile lives in the app (`src/config/productionSecrets.ts`).
+- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (WorkHub already does).
+- `createWebRoutes()` no longer seeds a `/` → `/organizations` redirect. The in-repo app owns `/` via its organization module.
+
 ## 0.2.65
 
 - App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds WorkHub registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).

package/README.md

@@ -28,14 +28,14 @@ import {
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+`createAppContext()` does not call `assertProductionSecrets`. That helper is feature-gated for every app (tokens, CORS, OAuth, encryption only when those features are on). WorkHub also runs its own production extras from `App.serve()` / `queue:work`. Sibling HTMX apps can call the published helper without API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
-Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema. WorkHub’s table is `sessions` (`0031_create_sessions`); its loader is `loadWorkhubSessionUser` (maps `users.role`, decrypts email). WorkHub web login itself stays on HMAC `SessionGuard`.
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
 
-`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. WorkHub webhook dispatch is `registerWebhookJobs()` in the app webhook provider.
+`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks should call `registerWebhookJobs()` themselves.
 
-These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
+These subpaths assemble the in-repo dogfood app and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (discovers app `webRoutes`; `/` is owned by the app). Sibling apps should use `buildWebModuleRoutes` / `buildModuleRoutes`.
 
 See the [strata](https://github.com/EyK-26/strata) monorepo reference app for full module patterns.

package/dist/bootstrap/createWebRoutes.d.ts

@@ -1,4 +1,8 @@
-import type { AppDependencies, AppRouteMap } from "./contracts";
-declare function createWebRoutes(dependencies: AppDependencies): AppRouteMap;
-declare function mergeWebRoutes(dependencies: AppDependencies, routes: AppRouteMap): AppRouteMap;
+import type { AppDependencies, AppModule, AppRouteMap } from "./contracts";
+interface CreateWebRoutesOptions {
+    modules?: AppModule[];
+}
+declare function createWebRoutes(dependencies: AppDependencies, options?: CreateWebRoutesOptions): AppRouteMap;
+declare function mergeWebRoutes(dependencies: AppDependencies, routes: AppRouteMap, options?: CreateWebRoutesOptions): AppRouteMap;
+export type { CreateWebRoutesOptions };
 export { createWebRoutes, mergeWebRoutes };

package/dist/bootstrap/dogfoodApp.d.ts

@@ -0,0 +1,7 @@
+type DogfoodApp = "workhub" | "hiroapp";
+declare function readDogfoodApp(): DogfoodApp;
+declare function isHiroappDogfood(): boolean;
+declare function hiroappSourcePath(...segments: string[]): string;
+declare function importHiroappModule<T = unknown>(relativeFromApp: string): Promise<T>;
+export type { DogfoodApp };
+export { hiroappSourcePath, importHiroappModule, isHiroappDogfood, readDogfoodApp };

package/dist/bootstrap/public-api.d.ts

@@ -13,6 +13,7 @@ export { APP_PORT_CONFIG_KEY, CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_
 export { collectProviders, createAppContext, runProviderPhase } from "./context.ts";
 export type { AppContext, AppDependencies, AppModule, AppRouteMap, CachedJson, ConfigStore, ModuleRouteContext, MutableAppDependencies, ProviderContext, ServiceFactory, ServiceProvider, } from "./contracts.ts";
 export { assertAppDependenciesComplete, getRequiredDependency, resolveService, ServiceContainer, } from "./contracts.ts";
+export type { CreateWebRoutesOptions } from "./createWebRoutes.ts";
 export { createWebRoutes, mergeWebRoutes } from "./createWebRoutes.ts";
 export { createAppDependencies } from "./dependencies.ts";
 export type { DiscoverModulesOptions } from "./discoverModules.ts";

package/dist/bootstrap/rateLimit.d.ts

@@ -0,0 +1,10 @@
+interface LoginRateLimitConfig {
+    maxAttempts: number;
+    decaySeconds: number;
+}
+declare const LOCAL_LOGIN_RATE_LIMIT: LoginRateLimitConfig;
+declare const PRODUCTION_LOGIN_RATE_LIMIT: LoginRateLimitConfig;
+declare function resolveLoginRateLimit(): LoginRateLimitConfig;
+declare function resolveRegisterRateLimit(): LoginRateLimitConfig;
+export type { LoginRateLimitConfig };
+export { LOCAL_LOGIN_RATE_LIMIT, PRODUCTION_LOGIN_RATE_LIMIT, resolveLoginRateLimit, resolveRegisterRateLimit, };

package/dist/bootstrap/web/session.d.ts

@@ -12,6 +12,18 @@ type SqlClient = {
 };
 type SqlSource = SqlClient | (() => SqlClient);
 export type LoadSessionUser = (sql: SqlClient, sessionId: string) => Promise<SessionUser | null>;
+export interface SessionCreateMeta {
+    userAgent?: string | null;
+    ipAddress?: string | null;
+}
+export interface BrowserSessionRecord {
+    id: string;
+    user_id: number;
+    user_agent: string | null;
+    ip_address: string | null;
+    last_active_at: Date | string | null;
+    expires_at: Date | string;
+}
 declare function defaultSessionSql(): SqlClient;
 export type MapSessionUser = (user: SessionUser) => AuthUser;
 declare function defaultMapSessionUser(user: SessionUser): AuthUser;
@@ -27,8 +39,11 @@ export declare class CookieSessionStore {
     sessionIdFromRequest(request: Request): string | null;
     private withSecureFlag;
     private sql;
-    create(user: SessionUser): Promise<string>;
+    create(user: SessionUser, meta?: SessionCreateMeta): Promise<string>;
     destroy(sessionId: string): Promise<void>;
+    destroyOtherSessions(userId: number, keepSessionId: string): Promise<void>;
+    listForUser(userId: number): Promise<BrowserSessionRecord[]>;
+    touch(sessionId: string): Promise<void>;
     read(request: Request): Promise<SessionUser | null>;
     private sign;
 }
@@ -41,14 +56,14 @@ export declare class CookieSessionGuard implements AuthGuard {
 export declare class CookieSessionAuthManager extends AuthManager {
     readonly store: CookieSessionStore;
     constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
-    signIn(user: SessionUser): Promise<{
+    signIn(user: SessionUser, meta?: SessionCreateMeta): Promise<{
         sessionId: string;
         setCookie: string;
     }>;
     signOut(request: Request): Promise<{
         setCookie: string;
     }>;
-    signInRedirect(user: SessionUser, location: string, status?: number): Promise<Response>;
+    signInRedirect(user: SessionUser, location: string, status?: number, meta?: SessionCreateMeta): Promise<Response>;
     signOutRedirect(request: Request, location: string, status?: number): Promise<Response>;
 }
 export interface CreateCookieSessionAuthManagerOptions {

package/dist/entries/buildModuleRoutes.js

@@ -39,7 +39,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -85,32 +111,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -181,7 +181,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -341,7 +341,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -351,7 +356,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/buildWebModuleRoutes.js

@@ -42,7 +42,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -88,32 +114,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -184,7 +184,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -344,7 +344,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -354,7 +359,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/cache/modelCacheTags.js

@@ -16,7 +16,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -26,7 +31,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/context.js

@@ -40,7 +40,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -50,7 +55,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -170,7 +175,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -480,7 +485,6 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
-import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
@@ -492,148 +496,6 @@ import {
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
-
-// ../../src/modules/organization/repository.ts
-import { BaseRepository } from "@getstrata/core/database/baseRepository";
-import { NotFoundError } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/organization/table.ts
-import { defineTable } from "@getstrata/core/database/table";
-
-// ../../src/domain/workhub.ts
-var ORGANIZATION_TABLE = "organization";
-
-// ../../src/modules/organization/table.ts
-var organizationTable = defineTable({
-  name: ORGANIZATION_TABLE,
-  primaryKey: "id",
-  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
-  softDeletes: true,
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/organization/repository.ts
-class OrganizationRepository extends BaseRepository {
-  constructor() {
-    super(organizationTable);
-  }
-  async findBySlug(slug) {
-    return await this.firstOrNull({ slug });
-  }
-  async listForTenant(options) {
-    return await this.findAll({
-      limit: options.limit,
-      offset: options.offset,
-      where: { tenant_id: options.tenantId ?? currentTenantId() }
-    });
-  }
-  async countForTenant(tenantId = currentTenantId()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
-    const organization = await this.findById(id);
-    if (!organization || organization.tenant_id !== tenantId) {
-      throw new NotFoundError(`SCIM group ${id} not found.`);
-    }
-    return organization;
-  }
-}
-var repository_default = OrganizationRepository;
-
-// ../../src/modules/user/repository.ts
-import {
-  emailLookupForQuery,
-  protectEmail,
-  revealEmail
-} from "@getstrata/core/crypto/fieldEncryption";
-import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
-import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/user/table.ts
-import { defineTable as defineTable2 } from "@getstrata/core/database/table";
-var userTable = defineTable2({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "mfa_recovery_codes",
-    "profile_photo_path",
-    "session_valid_after",
-    "current_organization_id",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/repository.ts
-class UserRepository extends BaseRepository2 {
-  constructor() {
-    super(userTable);
-  }
-  decode(record) {
-    return {
-      ...record,
-      email: revealEmail(record.email),
-      mfa_secret: revealMfaSecret(record.mfa_secret)
-    };
-  }
-  async findById(id) {
-    const record = await super.findById(id);
-    return record ? this.decode(record) : null;
-  }
-  async findAll(options = {}) {
-    const records = await super.findAll(options);
-    return records.map((record) => this.decode(record));
-  }
-  async create(values) {
-    const email = values.email;
-    if (!email) {
-      throw new Error("Email is required.");
-    }
-    const protectedEmail = protectEmail(email);
-    const record = await super.create({
-      ...values,
-      tenant_id: values.tenant_id ?? currentTenantId2(),
-      email: protectedEmail.storedEmail,
-      email_lookup: protectedEmail.emailLookup,
-      password_hash: values.password_hash ?? ""
-    });
-    return this.decode(record);
-  }
-  async updateByIdOrThrow(id, values, errorFactory) {
-    const changes = { ...values };
-    if (values.email !== undefined) {
-      const protectedEmail = protectEmail(values.email);
-      changes.email = protectedEmail.storedEmail;
-      changes.email_lookup = protectedEmail.emailLookup;
-    }
-    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
-    return this.decode(record);
-  }
-  async findByEmail(email) {
-    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
-    const record = records[0];
-    return record ? this.decode(record) : null;
-  }
-  async countForTenant(tenantId = currentTenantId2()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-}
-var repository_default2 = UserRepository;
-
-// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -647,23 +509,11 @@ var viewProvider = {
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
     configureWebLayoutData({
-      extra: async (user) => {
-        const appName = appDisplayName();
-        if (!user || typeof user.id !== "number") {
-          return { appName, currentOrganization: null, organizations: [] };
-        }
-        try {
-          const record = await new repository_default2().findByIdOrThrow(user.id);
-          const memberships = await resolveMembershipLookup().listForUser(record.id);
-          const organizationsRepo = new repository_default;
-          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
-          const currentId = record.current_organization_id ?? null;
-          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
-          return { appName, currentOrganization, organizations };
-        } catch {
-          return { appName, currentOrganization: null, organizations: [] };
-        }
-      }
+      extra: async () => ({
+        appName: appDisplayName(),
+        currentOrganization: null,
+        organizations: []
+      })
     });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {