@getstrata/bootstrap 0.2.65 → 0.2.68

package/dist/entries/createRoutes.js

@@ -2,8 +2,7 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/createRoutes.ts
-import { applyMiddlewareToRoutes as applyMiddlewareToRoutes3 } from "@getstrata/core/http/middleware";
-import { jsonResponse as jsonResponse4 } from "@getstrata/core/http/response";
+import { jsonResponse as jsonResponse3 } from "@getstrata/core/http/response";
 import { isSpaEnabled as isSpaEnabled2, isViewsEnabled as isViewsEnabled3 } from "@getstrata/core/runtime/frontendMode";
 import { notFoundHtmlResponse as notFoundHtmlResponse2 } from "@getstrata/core/view";
 
@@ -12,35 +11,13 @@ var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true",
-    registration: (process.env.FEATURE_REGISTRATION ?? "true") !== "false"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
@@ -79,7 +56,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -125,32 +128,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -221,7 +198,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -381,7 +358,12 @@ function readDiscoverModulesState() {
   return state;
 }
 function configureModulesDirectory(modulesDir) {
-  readDiscoverModulesState().configuredModulesDir = modulesDir;
+  const state = readDiscoverModulesState();
+  if (state.configuredModulesDir !== modulesDir) {
+    state.appModules.length = 0;
+    state.modulesReady = undefined;
+  }
+  state.configuredModulesDir = modulesDir;
 }
 function resolveModulesDirectory(options) {
   const state = readDiscoverModulesState();
@@ -391,7 +373,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -582,12 +564,10 @@ function buildWebModuleRoutes(dependencies, options = {}) {
 function registerRoute(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
-function createWebRoutes(dependencies) {
+function createWebRoutes(dependencies, options = {}) {
   const wrappedRoutes = buildWebModuleRoutes(dependencies, {
     clearRegistry: false,
-    seedRoutes: {
-      "/": () => Response.redirect("/organizations", 302)
-    }
+    modules: options.modules
   });
   registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {
@@ -603,16 +583,25 @@ function createWebRoutes(dependencies) {
   registerRoute("GET", "/assets/*", ["global", "web"]);
   return wrappedRoutes;
 }
-function mergeWebRoutes(dependencies, routes) {
+function mergeWebRoutes(dependencies, routes, options = {}) {
   if (!isViewsEnabled2()) {
     return routes;
   }
   return {
-    ...createWebRoutes(dependencies),
+    ...createWebRoutes(dependencies, options),
     ...routes
   };
 }
 
+// ../../src/bootstrap/dogfoodApp.ts
+function readDogfoodApp() {
+  const value = (process.env.DOGFOOD_APP ?? "hiroapp").trim().toLowerCase();
+  return value === "workhub" ? "workhub" : "hiroapp";
+}
+function isHiroappDogfood() {
+  return readDogfoodApp() === "hiroapp";
+}
+
 // ../../src/bootstrap/health.ts
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
@@ -748,840 +737,31 @@ function createMetricsRoutes() {
   };
 }
 
-// ../../src/bootstrap/scimRoutes.ts
-import { createScimAuthMiddleware } from "@getstrata/core/auth/scimAuthMiddleware";
-import { withMiddleware as withMiddleware2 } from "@getstrata/core/http/routeMiddleware";
-import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
-
-// ../../src/modules/scim/controller.ts
-import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
-
-// ../../src/modules/scim/scimResponse.ts
-import {
-  applyConditionalGet,
-  assertIfMatch,
-  etagFromResource,
-  isEtagEnabled
-} from "@getstrata/core/http/etag";
-import { jsonResponse as jsonResponse3 } from "@getstrata/core/http/response";
-function scimResponse(data, options = {}) {
-  const status = options.status ?? 200;
-  const response = jsonResponse3(data, {
-    status,
-    headers: {
-      "content-type": "application/scim+json"
-    }
-  });
-  if (!isEtagEnabled() || !options.etagSource) {
-    return response;
-  }
-  const etag = etagFromResource(options.etagSource);
-  if (options.request) {
-    return applyConditionalGet(options.request, response, etag);
-  }
-  const headers = new Headers(response.headers);
-  headers.set("ETag", etag);
-  headers.set("Cache-Control", "private, must-revalidate");
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function assertScimIfMatch(request, etagSource) {
-  if (!isEtagEnabled()) {
-    return;
-  }
-  assertIfMatch(request, etagFromResource(etagSource), { required: true });
-}
-
-// ../../src/modules/scim/service.ts
-import { hashPassword as hashPassword3 } from "@getstrata/core/auth/password";
-import { resolveService } from "@getstrata/core/contracts/di";
-import { NotFoundError as NotFoundError7 } from "@getstrata/core/errors/http";
-import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/domain/scim.ts
-var SCIM_SCHEMAS = {
-  user: "urn:ietf:params:scim:schemas:core:2.0:User",
-  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
-  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
-  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
-  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-};
-
-// ../../src/modules/organization/memberRepository.ts
-import { NotFoundError } from "@getstrata/core/errors/http";
-
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async updateMemberRole(organizationId, userId, role) {
-    const rows = await connection_default`
-      UPDATE organization_member
-      SET role = ${role}
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new NotFoundError(`Organization member ${userId} not found.`);
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/modules/organization/repository.ts
-import { BaseRepository } from "@getstrata/core/database/baseRepository";
-import { NotFoundError as NotFoundError2 } from "@getstrata/core/errors/http";
-import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/organization/table.ts
-import { defineTable } from "@getstrata/core/database/table";
-
-// ../../src/domain/workhub.ts
-var ORGANIZATION_TABLE = "organization";
-
-// ../../src/modules/organization/table.ts
-var organizationTable = defineTable({
-  name: ORGANIZATION_TABLE,
-  primaryKey: "id",
-  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
-  softDeletes: true,
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/organization/repository.ts
-class OrganizationRepository extends BaseRepository {
-  constructor() {
-    super(organizationTable);
-  }
-  async findBySlug(slug) {
-    return await this.firstOrNull({ slug });
-  }
-  async listForTenant(options) {
-    return await this.findAll({
-      limit: options.limit,
-      offset: options.offset,
-      where: { tenant_id: options.tenantId ?? currentTenantId() }
-    });
-  }
-  async countForTenant(tenantId = currentTenantId()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
-    const organization = await this.findById(id);
-    if (!organization || organization.tenant_id !== tenantId) {
-      throw new NotFoundError2(`SCIM group ${id} not found.`);
-    }
-    return organization;
-  }
-}
-var repository_default = OrganizationRepository;
-
-// ../../src/modules/user/provider.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN as CORE_ABILITY_CHECKER_TOKEN2,
-  CORE_AUTH_USER_DIRECTORY_TOKEN as CORE_AUTH_USER_DIRECTORY_TOKEN2,
-  CORE_TOKEN_SERVICE_TOKEN as CORE_TOKEN_SERVICE_TOKEN2
-} from "@getstrata/bootstrap/config";
-import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";
-import { GitHubOAuthProvider, MockOAuthProvider } from "@getstrata/core/auth/oauth/providers";
-import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
-import { getRequiredDependency } from "@getstrata/core/contracts/di";
-
-// ../../src/modules/user/apiTokenRepository.ts
-import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
-
-// ../../src/modules/user/apiTokenTable.ts
-import { defineTable as defineTable2 } from "@getstrata/core/database/table";
-var apiTokenTable = defineTable2({
-  name: "api_token",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "user_id",
-    "name",
-    "token_hash",
-    "abilities",
-    "last_used_at",
-    "expires_at",
-    "created_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/authService.ts
-import { currentAuthUser } from "@getstrata/core/auth/authContext";
-import { hashPassword, verifyPassword } from "@getstrata/core/auth/password";
-import { normalizeEmail } from "@getstrata/core/crypto/fieldEncryption";
-import { protectMfaSecret, revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
-import { UnauthorizedError as UnauthorizedError2, ValidationError } from "@getstrata/core/errors/http";
-import {
-  generateRecoveryCodes,
-  hashRecoveryCode,
-  recoveryCodeMatches
-} from "@getstrata/core/security/recoveryCodes";
-import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
-import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
-import { buildOtpauthUrl, generateTotpSecret, verifyTotp } from "@getstrata/core/security/totp";
-import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/core/auth/abilityCatalog.ts
-var MEMBER_ABILITIES = [
-  "organizations:read",
-  "organizations:create",
-  "projects:read",
-  "projects:create",
-  "tasks:read",
-  "tasks:create",
-  "comments:read",
-  "comments:create",
-  "attachments:read",
-  "attachments:create",
-  "auth:tokens:read",
-  "auth:tokens:write",
-  "auth:tokens:delete"
-];
-var ADMIN_ABILITIES = [
-  ...MEMBER_ABILITIES,
-  "organizations:create",
-  "organizations:update",
-  "organizations:delete",
-  "projects:update",
-  "projects:delete",
-  "tasks:update",
-  "tasks:delete",
-  "comments:update",
-  "comments:delete",
-  "attachments:delete",
-  "webhooks:read",
-  "webhooks:write",
-  "audit:read"
-];
-// ../../src/modules/user/mfaRequiredError.ts
-import { UnauthorizedError } from "@getstrata/core/errors/http";
-
-// ../../src/modules/user/currentOrganizationService.ts
-import { assertResourceInCurrentTenant } from "@getstrata/core/auth/membershipScope";
-import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
-import { NotFoundError as NotFoundError3 } from "@getstrata/core/errors/http";
-
-// ../../src/modules/user/notificationRepository.ts
-import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
-
-// ../../src/modules/user/notificationTable.ts
-import { defineTable as defineTable3 } from "@getstrata/core/database/table";
-var notificationTable = defineTable3({
-  name: "notification",
-  primaryKey: "id",
-  columns: ["id", "user_id", "tenant_id", "type", "title", "body", "data", "read_at", "created_at"],
-  defaultOrderBy: { column: "created_at", direction: "DESC" }
-});
-
-// ../../src/modules/user/notificationService.ts
-import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
-
-// ../../src/modules/user/oauthIdentityRepository.ts
-import { BaseRepository as BaseRepository4 } from "@getstrata/core/database/baseRepository";
-import { defineTable as defineTable4 } from "@getstrata/core/database/table";
-var oauthIdentityTable = defineTable4({
-  name: "oauth_identity",
-  primaryKey: "id",
-  columns: ["id", "user_id", "provider", "provider_user_id", "email", "created_at"]
-});
-
-// ../../src/modules/user/passwordResetService.ts
-import { hashPassword as hashPassword2 } from "@getstrata/core/auth/password";
-import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
-import { ValidationError as ValidationError2 } from "@getstrata/core/errors/http";
-import { absoluteTemporarySignedUrl } from "@getstrata/core/http/signedUrl";
-import { mailer } from "@getstrata/core/mail/mailer";
-import { sendMarkdownMail } from "@getstrata/core/mail/markdownMailable";
-import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
-import { logSecurityEvent as logSecurityEvent2 } from "@getstrata/core/security/securityEvents";
-import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
-var RESET_TTL_SECONDS = 60 * 60;
-var VERIFY_TTL_SECONDS = 60 * 60 * 24;
-
-// ../../src/modules/user/profilePhotoService.ts
-import { BadRequestError, NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
-import { isImageMimeType, resizeImageContents } from "@getstrata/core/media/imageTransform";
-
-// ../../src/modules/user/repository.ts
-import {
-  emailLookupForQuery,
-  protectEmail,
-  revealEmail
-} from "@getstrata/core/crypto/fieldEncryption";
-import { revealMfaSecret as revealMfaSecret2 } from "@getstrata/core/crypto/mfaSecret";
-import { BaseRepository as BaseRepository5 } from "@getstrata/core/database/baseRepository";
-import { currentTenantId as currentTenantId3 } from "@getstrata/core/tenant/tenantContext";
-
-// ../../src/modules/user/table.ts
-import { defineTable as defineTable5 } from "@getstrata/core/database/table";
-var userTable = defineTable5({
-  name: "users",
-  primaryKey: "id",
-  columns: [
-    "id",
-    "name",
-    "email",
-    "email_lookup",
-    "role",
-    "tenant_id",
-    "password_hash",
-    "email_verified_at",
-    "mfa_secret",
-    "mfa_enabled",
-    "mfa_recovery_codes",
-    "profile_photo_path",
-    "session_valid_after",
-    "current_organization_id",
-    "created_at",
-    "updated_at"
-  ],
-  defaultOrderBy: { column: "id", direction: "ASC" }
-});
-
-// ../../src/modules/user/repository.ts
-class UserRepository extends BaseRepository5 {
-  constructor() {
-    super(userTable);
-  }
-  decode(record) {
-    return {
-      ...record,
-      email: revealEmail(record.email),
-      mfa_secret: revealMfaSecret2(record.mfa_secret)
-    };
-  }
-  async findById(id) {
-    const record = await super.findById(id);
-    return record ? this.decode(record) : null;
-  }
-  async findAll(options = {}) {
-    const records = await super.findAll(options);
-    return records.map((record) => this.decode(record));
-  }
-  async create(values) {
-    const email = values.email;
-    if (!email) {
-      throw new Error("Email is required.");
-    }
-    const protectedEmail = protectEmail(email);
-    const record = await super.create({
-      ...values,
-      tenant_id: values.tenant_id ?? currentTenantId3(),
-      email: protectedEmail.storedEmail,
-      email_lookup: protectedEmail.emailLookup,
-      password_hash: values.password_hash ?? ""
-    });
-    return this.decode(record);
-  }
-  async updateByIdOrThrow(id, values, errorFactory) {
-    const changes = { ...values };
-    if (values.email !== undefined) {
-      const protectedEmail = protectEmail(values.email);
-      changes.email = protectedEmail.storedEmail;
-      changes.email_lookup = protectedEmail.emailLookup;
-    }
-    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
-    return this.decode(record);
-  }
-  async findByEmail(email) {
-    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
-    const record = records[0];
-    return record ? this.decode(record) : null;
-  }
-  async countForTenant(tenantId = currentTenantId3()) {
-    return await this.countWhere({ tenant_id: tenantId });
-  }
-}
-var repository_default2 = UserRepository;
-
-// ../../src/modules/user/tokenService.ts
-import { ADMIN_ABILITIES as ADMIN_ABILITIES2 } from "@getstrata/core/auth/abilityCatalog";
-import { hashApiToken as hashApiToken2 } from "@getstrata/core/auth/tokenHash";
-import { ForbiddenError, NotFoundError as NotFoundError6, ValidationError as ValidationError3 } from "@getstrata/core/errors/http";
-import { resolveDefaultTokenExpiryDays as resolveDefaultTokenExpiryDays2 } from "@getstrata/core/security/tokenExpiry";
-
-// ../../src/modules/user/provider.ts
-var userRepositoryToken = "user.repository";
-
-// ../../src/modules/scim/service.ts
-class ScimService {
-  users;
-  organizations;
-  members;
-  constructor(users, organizations, members) {
-    this.users = users;
-    this.organizations = organizations;
-    this.members = members;
-  }
-  serviceProviderConfig() {
-    return {
-      schemas: [SCIM_SCHEMAS.serviceProviderConfig],
-      patch: { supported: true },
-      bulk: { supported: false },
-      filter: { supported: false },
-      changePassword: { supported: false },
-      sort: { supported: false },
-      etag: { supported: true },
-      authenticationSchemes: [
-        {
-          type: "oauthbearertoken",
-          name: "OAuth Bearer Token",
-          description: "SCIM bearer token authentication"
-        }
-      ]
-    };
-  }
-  async listUsers(startIndex = 1, count = 100) {
-    const tenantId = currentTenantId4();
-    const offset = Math.max(startIndex - 1, 0);
-    const records = await this.users.findAll({
-      limit: count,
-      offset,
-      where: { tenant_id: tenantId }
-    });
-    const total = await this.users.countForTenant(tenantId);
-    return {
-      schemas: [SCIM_SCHEMAS.listResponse],
-      totalResults: total,
-      startIndex,
-      itemsPerPage: records.length,
-      Resources: records.map((user) => this.toScimUser(user))
-    };
-  }
-  async getUser(id) {
-    const user = await this.findUserRecord(id);
-    return this.toScimUser(user);
-  }
-  async findUserRecord(id) {
-    const user = await this.users.findById(id);
-    if (!user || user.tenant_id !== currentTenantId4()) {
-      throw new NotFoundError7(`SCIM user ${id} not found.`);
-    }
-    return user;
-  }
-  async createUser(payload) {
-    const email = payload.userName ?? payload.emails?.find((entry) => entry.primary)?.value ?? payload.emails?.[0]?.value;
-    if (!email) {
-      throw new Error("SCIM userName or email is required.");
-    }
-    const passwordHash = await hashPassword3(crypto.randomUUID());
-    const user = await this.users.create({
-      name: payload.name?.formatted ?? email.split("@")[0] ?? "SCIM User",
-      email,
-      role: "member",
-      tenant_id: currentTenantId4(),
-      password_hash: passwordHash,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    return this.toScimUser(user);
-  }
-  async patchUser(id, operations) {
-    const user = await this.findUserRecord(id);
-    const changes = { updated_at: new Date };
-    for (const operation of operations) {
-      if (operation.op.toLowerCase() === "replace" && operation.path === "active") {
-        continue;
-      }
-      if (operation.op.toLowerCase() === "replace" && operation.path === "displayName") {
-        changes.name = String(operation.value ?? user.name);
-      }
-      if (operation.op.toLowerCase() === "replace" && (operation.path === "userName" || operation.path === 'emails[type eq "work"].value')) {
-        changes.email = String(operation.value ?? user.email);
-      }
-    }
-    const updated = await this.users.updateByIdOrThrow(id, changes);
-    return this.toScimUser(updated);
-  }
-  async deleteUser(id) {
-    const user = await this.findUserRecord(id);
-    const deleted = await this.users.deleteById(id);
-    if (!deleted) {
-      throw new NotFoundError7(`SCIM user ${id} not found.`);
-    }
-    return { id: user.id, updated_at: user.updated_at };
-  }
-  async listGroups(startIndex = 1, count = 100) {
-    const tenantId = currentTenantId4();
-    const offset = Math.max(startIndex - 1, 0);
-    const rows = await this.organizations.listForTenant({ limit: count, offset, tenantId });
-    const total = await this.organizations.countForTenant(tenantId);
-    const resources = await Promise.all(rows.map((row) => this.toScimGroup(row)));
-    return {
-      schemas: [SCIM_SCHEMAS.listResponse],
-      totalResults: total,
-      startIndex,
-      itemsPerPage: resources.length,
-      Resources: resources
-    };
-  }
-  async getGroup(id) {
-    const organization = await this.findOrganizationRecord(id);
-    return await this.toScimGroup(organization);
-  }
-  async findOrganizationRecord(id) {
-    return await this.organizations.findForTenantOrThrow(id, currentTenantId4());
-  }
-  async patchGroup(id, operations) {
-    for (const operation of operations) {
-      if (operation.op.toLowerCase() !== "add" || operation.path !== "members") {
-        continue;
-      }
-      const members = Array.isArray(operation.value) ? operation.value : operation.value ? [operation.value] : [];
-      for (const member of members) {
-        const userId = Number.parseInt(String(member.value ?? ""), 10);
-        if (Number.isInteger(userId) && userId > 0) {
-          await this.members.addMember({ organizationId: id, userId, role: "member" });
-        }
-      }
-    }
-    const organization = await this.findOrganizationRecord(id);
-    return await this.toScimGroup(organization);
-  }
-  async toScimGroup(organization) {
-    const members = await this.members.listForOrganization(organization.id);
-    return {
-      schemas: [SCIM_SCHEMAS.group],
-      id: String(organization.id),
-      displayName: organization.name,
-      externalId: organization.slug,
-      members: members.map((member) => ({
-        value: String(member.user_id),
-        display: String(member.user_id)
-      })),
-      meta: {
-        resourceType: "Group",
-        lastModified: organization.updated_at.toISOString()
-      }
-    };
-  }
-  toScimUser(user) {
-    return {
-      schemas: [SCIM_SCHEMAS.user],
-      id: String(user.id),
-      userName: user.email,
-      name: { formatted: user.name },
-      displayName: user.name,
-      active: true,
-      emails: [{ value: user.email, primary: true, type: "work" }],
-      roles: [{ value: user.role, primary: true }],
-      meta: {
-        resourceType: "User",
-        created: user.created_at?.toISOString(),
-        lastModified: user.updated_at?.toISOString()
-      }
-    };
-  }
-}
-function createScimService(dependencies) {
-  return new ScimService(resolveService(dependencies, userRepositoryToken), new repository_default, new memberRepository_default);
-}
-
-// ../../src/modules/scim/controller.ts
-class ScimController {
-  service;
-  constructor(dependencies, service = createScimService(dependencies)) {
-    this.service = service;
-  }
-  serviceProviderConfig = withErrorHandling2(async () => {
-    return scimResponse(this.service.serviceProviderConfig());
-  });
-  listUsers = withErrorHandling2(async (request) => {
-    const url = new URL(request.url);
-    const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
-    const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
-    return scimResponse(await this.service.listUsers(startIndex, count));
-  });
-  createUser = withErrorHandling2(async (request) => {
-    const payload = await request.json();
-    const user = await this.service.createUser(payload);
-    const id = Number.parseInt(user.id, 10);
-    const record = await this.service.findUserRecord(id);
-    return scimResponse(user, { status: 201, etagSource: record });
-  });
-  showUser = withErrorHandling2(async (request) => {
-    const params = request.params;
-    const id = Number.parseInt(params?.id ?? "", 10);
-    const record = await this.service.findUserRecord(id);
-    const user = await this.service.getUser(id);
-    return scimResponse(user, { request, etagSource: record });
-  });
-  patchUser = withErrorHandling2(async (request) => {
-    const params = request.params;
-    const id = Number.parseInt(params?.id ?? "", 10);
-    const record = await this.service.findUserRecord(id);
-    assertScimIfMatch(request, record);
-    const body = await request.json();
-    const user = await this.service.patchUser(id, body.Operations ?? []);
-    const updated = await this.service.findUserRecord(id);
-    return scimResponse(user, { etagSource: updated });
-  });
-  deleteUser = withErrorHandling2(async (request) => {
-    const params = request.params;
-    const id = Number.parseInt(params?.id ?? "", 10);
-    const record = await this.service.findUserRecord(id);
-    assertScimIfMatch(request, record);
-    await this.service.deleteUser(id);
-    return new Response(null, { status: 204 });
-  });
-  listGroups = withErrorHandling2(async (request) => {
-    const url = new URL(request.url);
-    const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
-    const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
-    return scimResponse(await this.service.listGroups(startIndex, count));
-  });
-  showGroup = withErrorHandling2(async (request) => {
-    const params = request.params;
-    const id = Number.parseInt(params?.id ?? "", 10);
-    const record = await this.service.findOrganizationRecord(id);
-    const group = await this.service.getGroup(id);
-    return scimResponse(group, { request, etagSource: record });
-  });
-  patchGroup = withErrorHandling2(async (request) => {
-    const params = request.params;
-    const id = Number.parseInt(params?.id ?? "", 10);
-    const record = await this.service.findOrganizationRecord(id);
-    assertScimIfMatch(request, record);
-    const body = await request.json();
-    const group = await this.service.patchGroup(id, body.Operations ?? []);
-    const updated = await this.service.findOrganizationRecord(id);
-    return scimResponse(group, { etagSource: updated });
-  });
-}
-var controller_default = ScimController;
-
-// ../../src/bootstrap/scimRoutes.ts
-function createScimRoutes(dependencies) {
-  const redisUrl = process.env.REDIS_URL?.trim() ?? "";
-  const secured = withMiddleware2(createScimThrottleMiddleware({
-    redisUrl: redisUrl || undefined,
-    maxAttempts: Number(process.env.SCIM_RATE_LIMIT_PER_MINUTE ?? "60"),
-    decaySeconds: 60
-  }), createScimAuthMiddleware());
-  const bind = (method) => {
-    return secured(async (request) => {
-      const controller = new controller_default(dependencies);
-      return await method(controller)(request);
-    });
-  };
-  return {
-    "/scim/v2/ServiceProviderConfig": {
-      GET: bind((controller) => controller.serviceProviderConfig)
-    },
-    "/scim/v2/Users": {
-      GET: bind((controller) => controller.listUsers),
-      POST: bind((controller) => controller.createUser)
-    },
-    "/scim/v2/Users/:id": {
-      GET: bind((controller) => controller.showUser),
-      PATCH: bind((controller) => controller.patchUser),
-      DELETE: bind((controller) => controller.deleteUser)
-    },
-    "/scim/v2/Groups": {
-      GET: bind((controller) => controller.listGroups)
-    },
-    "/scim/v2/Groups/:id": {
-      GET: bind((controller) => controller.showGroup),
-      PATCH: bind((controller) => controller.patchGroup)
-    }
-  };
-}
-
 // ../../src/bootstrap/createRoutes.ts
 function registerRoute2(method, path, middleware) {
   routeRegistry.register({ method, path, middleware });
 }
 function createRoutes(dependencies) {
-  const kernel = createHttpKernel(dependencies);
+  const apiPrefix = isHiroappDogfood() ? "" : appConfig.apiPrefix;
   const wrappedModuleRoutes = buildModuleRoutes(dependencies, {
-    apiPrefix: appConfig.apiPrefix,
-    clearRegistry: true
+    apiPrefix,
+    clearRegistry: true,
+    modules: []
   });
   const healthRoutes = createHealthRoutes(dependencies);
   const metricsRoutes = createMetricsRoutes();
-  const scimRoutes = isFeatureEnabled("scim") ? applyMiddlewareToRoutes3(registerOpenApiRouteMap(createScimRoutes(dependencies), ["global", "scim"]), kernel.globalMiddleware()) : {};
   registerRoute2("GET", "/health", []);
   registerRoute2("GET", "/ready", []);
   registerRoute2("GET", "/metrics", []);
+  const notFoundApiPath = `${apiPrefix || "/api"}/*`;
   const baseRoutes = {
     ...healthRoutes,
     ...metricsRoutes,
-    ...scimRoutes,
     ...isViewsEnabled3() || isSpaEnabled2() ? {} : { "/": strata_default },
     ...wrappedModuleRoutes,
-    [`${appConfig.apiPrefix}/*`]: async () => {
-      registerRoute2("GET", `${appConfig.apiPrefix}/*`, ["global", "api"]);
-      return jsonResponse4({ error: "Not Found" }, { status: 404 });
+    [notFoundApiPath]: async () => {
+      registerRoute2("GET", notFoundApiPath, ["global", "api"]);
+      return jsonResponse3({ error: "Not Found" }, { status: 404 });
     },
     "/*": async () => {
       registerRoute2("GET", "/*", []);
@@ -1589,9 +769,9 @@ function createRoutes(dependencies) {
         return notFoundHtmlResponse2();
       }
       if (isSpaEnabled2()) {
-        return jsonResponse4({ error: "Not Found" }, { status: 404 });
+        return jsonResponse3({ error: "Not Found" }, { status: 404 });
       }
-      return jsonResponse4({ error: "Not Found" }, { status: 404 });
+      return jsonResponse3({ error: "Not Found" }, { status: 404 });
     }
   };
   return mergeSpaRoutes(dependencies, mergeWebRoutes(dependencies, baseRoutes));