# TASK METADATA

- **Target Files:** `server/main.ts`, `server/routes/admin.ts`,
  `server/routes/auth.ts`, `server/middleware.ts`, `server/rpc.ts`,
  `server/main.test.ts`
- **Core Objective:** Phase 3 (Server Route Modularization): Decompose the
  2,100-line `server/main.ts` entrypoint into modular feature routers
  (`routes/admin.ts`, `routes/auth.ts`), dedicated middleware
  (`server/middleware.ts`), and RPC configuration (`server/rpc.ts`).
- **Dependencies:**
  `tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.md`
- **Additional Important Notes:** Must preserve exact HTTP routes, status codes,
  zero-trust scope guards, and passing tests in `server/main.test.ts`.

---

### 2. Architectural Considerations & Risks

- **Risks:**
  - Route mounting order changes in Hono could alter middleware execution (e.g.
    rate limiting or auth resolution).
  - Circular dependencies between route modules and `auth-session.ts`.
- **Alternatives:**
  - Keeping all routes in `main.ts`; rejected because 2,100+ lines violate
    Single Responsibility Principle.

### 3. Proposed Implementation

1. **Extract Feature Routers (`server/routes/`):**
   - `server/routes/admin.ts`: Extract all `/api/admin/*` CRUD endpoints (users,
     apps, roles, grants, invites, recovery, audit logs).
   - `server/routes/auth.ts`: Extract WebAuthn passkey registration
     challenge/verify, login challenge/verify, PRF evaluation, and
     `/api/passkeys/*` endpoints.
2. **Extract Infrastructure & Middleware Modules:**
   - `server/middleware.ts`: Extract rate limiting, CORS, security headers, and
     request logging.
   - `server/rpc.ts`: Extract ConnectRPC daemon service registration and SPIFFE
     mTLS listener setup.
3. **Slim Down `server/main.ts`:**
   - Retain `main.ts` purely as the application entrypoint assembling the
     sub-routers and serving the HTTP listener.
4. **Quality Gates & Validation:**
   - Run `deno fmt`, `deno task lint`, `deno task check`.
   - Run `deno test --allow-all` to ensure all API routes resolve with 100%
     fidelity.