@getstrata/bootstrap 0.2.16 → 0.2.17

package/dist/entries/cache/modelCacheTags.js

@@ -0,0 +1,22 @@
+// @bun
+// ../../src/bootstrap/discoverModules.ts
+var appModules = [];
+function discoverModules() {
+  return appModules;
+}
+
+// ../../src/bootstrap/cache/modelCacheTags.ts
+function cacheTagsForModelWrite(tableName, action) {
+  const module = discoverModules().find((entry) => entry.tableName === tableName);
+  const baseTags = module?.cacheTags ?? [`${tableName}s`];
+  const isDelete = action === "deleted" || action === "force-deleted";
+  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
+  return [...new Set([...baseTags, ...extraTags])];
+}
+function discoverModelTableNames() {
+  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
+}
+export {
+  discoverModelTableNames,
+  cacheTagsForModelWrite
+};

package/dist/entries/web/forms.js

@@ -0,0 +1,53 @@
+// @bun
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+
+// ../../src/bootstrap/web/forms.ts
+async function parseFormBody(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  const fields = {};
+  const files = {};
+  if (contentType.includes("application/x-www-form-urlencoded")) {
+    const text = await request.text();
+    for (const pair of text.split("&")) {
+      const idx = pair.indexOf("=");
+      if (idx === -1)
+        continue;
+      const key = decodeURIComponent(pair.slice(0, idx).replace(/\+/g, " "));
+      const value = decodeURIComponent(pair.slice(idx + 1).replace(/\+/g, " "));
+      fields[key] = value;
+    }
+    return { fields, files };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const form = await request.formData();
+    for (const [key, value] of form.entries()) {
+      if (value instanceof File) {
+        files[key] = value;
+      } else {
+        fields[key] = String(value);
+      }
+    }
+  }
+  return { fields, files };
+}
+export {
+  parseFormBody,
+  createCsrfProtection
+};

package/dist/entries/web/routing.js

@@ -0,0 +1,624 @@
+// @bun
+// ../../src/bootstrap/web/routing.ts
+import { withErrorHandling } from "@getstrata/core";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/contracts/applicationContext.ts
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${String(key)}" is not registered.`);
+  }
+  return dependency;
+}
+
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
+  }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
+  }
+  return activeContext;
+}
+function setActiveApplicationContext(context) {
+  activeContext = context;
+  globalThis[APPLICATION_CONTEXT_KEY] = context;
+}
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return context;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
+
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+
+// ../../src/core/http/validation.ts
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
+// ../../src/config/frontend.ts
+function readFrontendMode() {
+  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
+  if (mode === "server-htmx") {
+    return "server-htmx";
+  }
+  if (mode === "spa-react") {
+    return "spa-react";
+  }
+  return "api";
+}
+function isViewsEnabled() {
+  return readFrontendMode() === "server-htmx";
+}
+
+// ../../src/config/rateLimit.ts
+var LOCAL_LOGIN_RATE_LIMIT = {
+  maxAttempts: 100,
+  decaySeconds: 60
+};
+var PRODUCTION_LOGIN_RATE_LIMIT = {
+  maxAttempts: 5,
+  decaySeconds: 900
+};
+function isLocalAppEnv() {
+  return (process.env.APP_ENV ?? "local") === "local";
+}
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.trunc(parsed);
+}
+function resolveLoginRateLimit() {
+  const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
+  return {
+    maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+  };
+}
+function resolveRegisterRateLimit() {
+  const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
+  return {
+    maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
+    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+  };
+}
+
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/httpKernel.ts
+class HttpKernel {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  globalMiddleware() {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return [
+      createCorsMiddleware(),
+      createSecurityHeadersMiddleware(),
+      createBodySizeLimitMiddleware(),
+      createTracingMiddleware(),
+      createMetricsMiddleware(),
+      createRequestLoggingMiddleware(),
+      requestIdMiddleware,
+      createAuthMiddleware(auth),
+      createMembershipMiddleware(),
+      createTenantMiddleware()
+    ];
+  }
+  group(name) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    switch (name) {
+      case "authenticated":
+        return [createRequireAuthMiddleware(auth)];
+      case "web":
+        return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
+      case "api": {
+        if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+          return [];
+        }
+        const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+        const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+        if (!redisUrl) {
+          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          return [
+            createMemoryThrottleMiddleware({
+              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              decaySeconds: 60
+            })
+          ];
+        }
+        const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+        return [
+          createThrottleMiddleware({
+            redisUrl,
+            maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
+            decaySeconds: 60
+          })
+        ];
+      }
+      default:
+        throw new Error(`Unknown middleware group "${name}".`);
+    }
+  }
+  wrap(groups, handler) {
+    const names = Array.isArray(groups) ? groups : [groups];
+    const middleware = names.flatMap((name) => this.group(name));
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapApi(handler) {
+    return this.wrap(["api", "authenticated"], handler);
+  }
+  wrapWeb(handler) {
+    return handler;
+  }
+  wrapWebPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return this.wrapWeb(handler);
+    }
+    return this.wrapWebAuthenticated(handler);
+  }
+  wrapWebAuthenticated(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+  }
+  wrapWebAbility(ability, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapWebGlobalAdmin(handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAuthenticated(handler) {
+    return this.wrap("authenticated", handler);
+  }
+  wrapPublicRead(handler) {
+    if (isPublicReadsEnabled()) {
+      return handler;
+    }
+    return this.wrapAuthenticated(handler);
+  }
+  wrapGlobalAdmin(handler) {
+    const middleware = [...this.group("authenticated"), createRequireGlobalAdminMiddleware()];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapAbility(ability, handler) {
+    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const requireAbility = createRequireAbilityMiddleware(abilityChecker);
+    const middleware = [...this.group("authenticated"), requireAbility(ability)];
+    return withMiddleware(...middleware)(handler);
+  }
+  wrapPolicy(resource, action, handler) {
+    const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
+    const gate = this.dependencies.container.resolve(CORE_POLICY_GATE_TOKEN);
+    return withMiddleware(createAuthorizeMiddleware(gate, auth, resource, action))(handler);
+  }
+  wrapLogin(handler) {
+    return this.wrapThrottle("login", resolveLoginRateLimit(), handler);
+  }
+  wrapRegister(handler) {
+    return this.wrapThrottle("register", resolveRegisterRateLimit(), handler);
+  }
+  wrapThrottle(scope, rateLimit, handler) {
+    const middleware = [];
+    const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
+    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
+      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
+      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
+      if (redisUrl) {
+        const throttle = scope === "login" ? createLoginThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds
+        }) : createThrottleMiddleware({
+          redisUrl,
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        });
+        middleware.push(throttle);
+      } else {
+        middleware.push(createMemoryThrottleMiddleware({
+          maxAttempts: rateLimit.maxAttempts,
+          decaySeconds: rateLimit.decaySeconds,
+          keyPrefix: memoryKeyPrefix
+        }));
+      }
+    } else {
+      middleware.push(createMemoryThrottleMiddleware({
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds,
+        keyPrefix: memoryKeyPrefix
+      }));
+    }
+    if (middleware.length === 0) {
+      return handler;
+    }
+    return withMiddleware(...middleware)(handler);
+  }
+}
+function createHttpKernel(dependencies) {
+  return new HttpKernel(dependencies);
+}
+
+// ../../src/bootstrap/web/routing.ts
+function routeParams(request) {
+  const normalized = {};
+  const raw = request.params;
+  if (raw && typeof raw === "object") {
+    for (const [key, value] of Object.entries(raw)) {
+      normalized[key] = decodeURIComponent(String(value));
+    }
+  }
+  return normalized;
+}
+function toRouteRequest(request) {
+  const params = routeParams(request);
+  Object.defineProperty(request, "params", {
+    value: params,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+  return request;
+}
+function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
+  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  return async (request) => bound(toRouteRequest(request));
+}
+function wrapWebLogin(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+}
+function wrapWebRegister(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+}
+function wrapWebThrottle(kernel, scope, handler, onThrottled) {
+  const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);
+  return async (request) => {
+    const response = await throttled(request);
+    if (response.status === 429) {
+      return onThrottled(request);
+    }
+    return response;
+  };
+}
+function createRouteKernel(dependencies) {
+  return createHttpKernel(dependencies);
+}
+export {
+  wrapWebRegister,
+  wrapWebLogin,
+  wrapSecuredRouteModelByKey,
+  toRouteRequest,
+  routeParams,
+  createRouteKernel
+};

package/dist/entries/web/server.js

@@ -0,0 +1,57 @@
+// @bun
+// ../../src/bootstrap/web/server.ts
+function wrapRouteHandler(handler) {
+  return async (request) => {
+    const response = await handler(request);
+    return response ?? new Response("Not Found", { status: 404 });
+  };
+}
+function convertAppRoutesToBunRoutes(routes) {
+  const bunRoutes = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (typeof handler === "function") {
+      bunRoutes[path] = { GET: wrapRouteHandler(handler) };
+      continue;
+    }
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methods = {};
+      for (const [method, methodHandler] of Object.entries(handler)) {
+        if (typeof methodHandler !== "function") {
+          continue;
+        }
+        methods[method.toUpperCase()] = wrapRouteHandler(methodHandler);
+      }
+      if (Object.keys(methods).length > 0) {
+        bunRoutes[path] = methods;
+      }
+    }
+  }
+  return bunRoutes;
+}
+function createWebServer(options) {
+  const publicDir = options.publicDir ?? "./public";
+  const bunRoutes = options.routes ? convertAppRoutesToBunRoutes(options.routes) : undefined;
+  return Bun.serve({
+    port: options.port,
+    ...bunRoutes ? { routes: bunRoutes } : {},
+    async fetch(request) {
+      await options.onRequest?.(request);
+      const url = new URL(request.url);
+      if (url.pathname.startsWith("/assets/")) {
+        const file = Bun.file(`${publicDir}${url.pathname}`);
+        if (await file.exists()) {
+          return new Response(file);
+        }
+      }
+      if (options.handle) {
+        const response = await options.handle(request);
+        return response ?? new Response("Not Found", { status: 404 });
+      }
+      return new Response("Not Found", { status: 404 });
+    }
+  });
+}
+export {
+  createWebServer,
+  convertAppRoutesToBunRoutes
+};

package/dist/entries/web/session.js

@@ -0,0 +1,99 @@
+// @bun
+// ../../src/bootstrap/web/session.ts
+import { createHash, randomBytes } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+
+// ../../src/bootstrap/web/session.ts
+class CookieSessionStore {
+  sql;
+  secret;
+  cookieName;
+  maxAgeSeconds;
+  constructor(sql, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
+    this.sql = sql;
+    this.secret = secret;
+    this.cookieName = cookieName;
+    this.maxAgeSeconds = maxAgeSeconds;
+  }
+  cookieHeader(_user, sessionId) {
+    const payload = `${sessionId}.${this.sign(sessionId)}`;
+    return this.withSecureFlag(`${this.cookieName}=${payload}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${this.maxAgeSeconds}`);
+  }
+  clearCookieHeader() {
+    return this.withSecureFlag(`${this.cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
+  }
+  withSecureFlag(header) {
+    if (true) {
+      return header;
+    }
+    return header.includes("Secure") ? header : `${header}; Secure`;
+  }
+  async create(user) {
+    const id = randomBytes(32).toString("hex");
+    const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
+    await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
+      id,
+      user.id,
+      expires
+    ]);
+    return id;
+  }
+  async destroy(sessionId) {
+    await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
+  }
+  async read(request) {
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
+    if (!raw)
+      return null;
+    const [sessionId, signature] = raw.split(".");
+    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+      return null;
+    }
+    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+              COALESCE(u.is_admin, false) AS is_admin
+       FROM sessions s
+       INNER JOIN users u ON u.id = s.user_id
+       WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+    const row = rows[0];
+    if (!row)
+      return null;
+    return {
+      id: row.user_id,
+      name: row.name,
+      email: row.email,
+      learn_subscriber: row.learn_subscriber,
+      is_admin: row.is_admin
+    };
+  }
+  sign(value) {
+    return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
+  }
+}
+export {
+  CookieSessionStore
+};

package/dist/entries/web/slug.js

@@ -0,0 +1,8 @@
+// @bun
+// ../../src/bootstrap/web/slug.ts
+function slugify(value) {
+  return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+}
+export {
+  slugify
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -20,6 +20,11 @@
       "import": "./dist/entries/applicationRegistry.js",
       "default": "./dist/entries/applicationRegistry.js"
     },
+    "./cache/modelCacheTags": {
+      "types": "./dist/bootstrap/cache/modelCacheTags.d.ts",
+      "import": "./dist/entries/cache/modelCacheTags.js",
+      "default": "./dist/entries/cache/modelCacheTags.js"
+    },
     "./config": {
       "types": "./dist/bootstrap/config.d.ts",
       "import": "./dist/entries/config.js",
@@ -69,6 +74,31 @@
       "types": "./dist/bootstrap/providers/view/index.d.ts",
       "import": "./dist/entries/providers/view.js",
       "default": "./dist/entries/providers/view.js"
+    },
+    "./web/forms": {
+      "types": "./dist/bootstrap/web/forms.d.ts",
+      "import": "./dist/entries/web/forms.js",
+      "default": "./dist/entries/web/forms.js"
+    },
+    "./web/routing": {
+      "types": "./dist/bootstrap/web/routing.d.ts",
+      "import": "./dist/entries/web/routing.js",
+      "default": "./dist/entries/web/routing.js"
+    },
+    "./web/server": {
+      "types": "./dist/bootstrap/web/server.d.ts",
+      "import": "./dist/entries/web/server.js",
+      "default": "./dist/entries/web/server.js"
+    },
+    "./web/session": {
+      "types": "./dist/bootstrap/web/session.d.ts",
+      "import": "./dist/entries/web/session.js",
+      "default": "./dist/entries/web/session.js"
+    },
+    "./web/slug": {
+      "types": "./dist/bootstrap/web/slug.d.ts",
+      "import": "./dist/entries/web/slug.js",
+      "default": "./dist/entries/web/slug.js"
     }
   },
   "main": "./dist/index.js",
@@ -82,14 +112,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/membershipService.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/membershipService.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.24",
+    "@getstrata/core": "^0.5.25",
     "typescript": "^5.9.0"
   }
 }