@getstrata/bootstrap 0.2.2 → 0.2.4

package/dist/bootstrap/app.d.ts

@@ -0,0 +1,7 @@
+declare class App {
+    private server?;
+    serve(): void;
+    stop(force?: boolean): void;
+    private resolvePort;
+}
+export default App;

package/dist/bootstrap/createRoutes.d.ts

@@ -0,0 +1,3 @@
+import type { AppDependencies, AppRouteMap } from "./contracts";
+declare function createRoutes(dependencies: AppDependencies): AppRouteMap;
+export { createRoutes };

package/dist/bootstrap/createSpaRoutes.d.ts

@@ -0,0 +1,5 @@
+import type { AppDependencies, AppRouteMap } from "./contracts";
+declare const SPA_DIST_DIRECTORY: string;
+declare function createSpaRoutes(_dependencies: AppDependencies): AppRouteMap;
+declare function mergeSpaRoutes(dependencies: AppDependencies, routes: AppRouteMap): AppRouteMap;
+export { createSpaRoutes, mergeSpaRoutes, SPA_DIST_DIRECTORY };

package/dist/bootstrap/dependencies.d.ts

@@ -0,0 +1,4 @@
+import { createAppContext } from "./context";
+declare function createAppDependencies(): import("./contracts").AppDependencies;
+export type { AppContext, AppDependencies } from "./contracts";
+export { createAppContext, createAppDependencies };

package/dist/bootstrap/health.d.ts

@@ -0,0 +1,8 @@
+import type { AppDependencies } from "./contracts";
+declare function checkDatabase(): Promise<boolean>;
+declare function checkRedis(redisUrl: string): Promise<boolean>;
+declare function createHealthRoutes(dependencies: AppDependencies): {
+    "/health": () => Promise<Response>;
+    "/ready": () => Promise<Response>;
+};
+export { checkDatabase, checkRedis, createHealthRoutes };

package/dist/bootstrap/metricsRoutes.d.ts

@@ -0,0 +1,4 @@
+declare function createMetricsRoutes(): {
+    "/metrics": () => Promise<Response>;
+};
+export { createMetricsRoutes };

package/dist/bootstrap/middleware.d.ts

@@ -0,0 +1,4 @@
+import { type Middleware } from "../core/http/middleware";
+import type { AppDependencies } from "./contracts";
+declare function createDefaultMiddleware(dependencies: AppDependencies): Middleware[];
+export { createDefaultMiddleware };

package/dist/bootstrap/public-api.d.ts

@@ -13,4 +13,4 @@ export { createWebRoutes, mergeWebRoutes } from "./createWebRoutes.ts";
 export { createHttpKernel, type HttpKernel, type MiddlewareGroupName } from "./httpKernel.ts";
 export { prefixRouteMap } from "./prefixRouteMap.ts";
 export { coreProviders } from "./providers/index.ts";
-export { CookieSessionStore, createCsrfProtection, createWebServer, type ParsedForm, parseFormBody, type SessionUser, slugify, type WebServerOptions, } from "./web/index.ts";
+export { CookieSessionStore, createCsrfProtection, createRouteKernel, createWebServer, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";

package/dist/bootstrap/routes.d.ts

@@ -0,0 +1,2 @@
+declare const routes: import("./contracts").AppRouteMap;
+export { routes };

package/dist/bootstrap/scimRoutes.d.ts

@@ -0,0 +1,24 @@
+import type { RouteHandler } from "../core/http/middleware";
+import type { AppDependencies } from "./contracts";
+declare function createScimRoutes(dependencies: AppDependencies): {
+    "/scim/v2/ServiceProviderConfig": {
+        GET: RouteHandler;
+    };
+    "/scim/v2/Users": {
+        GET: RouteHandler;
+        POST: RouteHandler;
+    };
+    "/scim/v2/Users/:id": {
+        GET: RouteHandler;
+        PATCH: RouteHandler;
+        DELETE: RouteHandler;
+    };
+    "/scim/v2/Groups": {
+        GET: RouteHandler;
+    };
+    "/scim/v2/Groups/:id": {
+        GET: RouteHandler;
+        PATCH: RouteHandler;
+    };
+};
+export { createScimRoutes };

package/dist/bootstrap/server.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/bootstrap/web/forms.d.ts

@@ -1,10 +1,6 @@
+export { type CsrfProtectionOptions, createCsrfProtection, } from "../../core/http/csrfProtection.ts";
 export interface ParsedForm {
     fields: Record<string, string>;
     files: Record<string, File>;
 }
 export declare function parseFormBody(request: Request): Promise<ParsedForm>;
-export declare function createCsrfProtection(secret: string): {
-    generate: (sessionKey: string) => string;
-    verify: (token: string | undefined, maxAgeMs?: number) => boolean;
-    secret: string;
-};

package/dist/bootstrap/web/index.d.ts

@@ -2,6 +2,7 @@
  * Web-focused bootstrap utilities for sibling apps (getstrata, marketing sites).
  */
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
-export { createWebServer, type WebServerOptions } from "./server.ts";
+export { createRouteKernel, routeParams, toRouteRequest, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./routing.ts";
+export { convertAppRoutesToBunRoutes, createWebServer, type WebServerOptions } from "./server.ts";
 export { CookieSessionStore, type SessionUser } from "./session.ts";
 export { slugify } from "./slug.ts";

package/dist/bootstrap/web/routing.d.ts

@@ -0,0 +1,21 @@
+import type { RouteHandler, RouteRequest } from "@getstrata/core";
+import type { AppDependencies } from "../contracts.ts";
+import type { HttpKernel } from "../httpKernel.ts";
+/** Read Bun native `:param` values from a route handler request. */
+export declare function routeParams(request: Request): Record<string, string>;
+/**
+ * Attach decoded route params to Bun's native Request for RouteRequest handlers.
+ * Mutates the request in place so instanceof Request and Bun internals stay valid.
+ */
+export declare function toRouteRequest<TParams extends Record<string, string>>(request: Request): RouteRequest<TParams>;
+/** Laravel-style secured route-model binding for string keys (slugs, UUIDs). */
+export declare function wrapSecuredRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: {
+    resource: string;
+    action: "view" | "create" | "update" | "delete";
+}, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): RouteHandler;
+/** Converts kernel login throttle 429 JSON into an HTML response for web forms. */
+export declare function wrapWebLogin(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
+/** Converts kernel register throttle 429 JSON into an HTML response for web forms. */
+export declare function wrapWebRegister(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
+/** Convenience alias: HttpKernel is the Laravel-style router middleware wrapper. */
+export declare function createRouteKernel(dependencies: AppDependencies): HttpKernel;

package/dist/bootstrap/web/server.d.ts

@@ -1,7 +1,13 @@
+import type { BunRequest } from "bun";
+import type { AppRouteMap } from "../contracts.ts";
 export interface WebServerOptions {
     port: number;
-    handle: (request: Request) => Promise<Response | null> | Response | null;
+    handle?: (request: Request) => Promise<Response | null> | Response | null;
+    routes?: AppRouteMap;
     publicDir?: string;
     onRequest?: (request: Request) => Promise<void> | void;
 }
+type BunRouteHandler = (request: BunRequest) => Response | Promise<Response>;
+declare function convertAppRoutesToBunRoutes(routes: AppRouteMap): Record<string, Record<string, BunRouteHandler>>;
 export declare function createWebServer(options: WebServerOptions): Bun.Server<undefined>;
+export { convertAppRoutesToBunRoutes };

package/dist/bootstrap/web/session.d.ts

@@ -20,6 +20,5 @@ export declare class CookieSessionStore {
     destroy(sessionId: string): Promise<void>;
     read(request: Request): Promise<SessionUser | null>;
     private sign;
-    private parseCookie;
 }
 export {};

package/dist/core/auth/scimAuthMiddleware.d.ts

@@ -0,0 +1,3 @@
+import type { Middleware } from "../http/middleware";
+declare function createScimAuthMiddleware(): Middleware;
+export { createScimAuthMiddleware };

package/dist/core/crypto/nonCryptographicHash.d.ts

@@ -0,0 +1,2 @@
+declare function nonCryptographicDigest(input: string): string;
+export { nonCryptographicDigest };

package/dist/core/http/cookies.d.ts

@@ -0,0 +1,4 @@
+import type { BunRequest } from "bun";
+declare function readRequestCookie(request: Request, name: string): string | null;
+declare function readBunRequestCookie(request: BunRequest, name: string): string | null;
+export { readBunRequestCookie, readRequestCookie };

package/dist/core/http/csrfProtection.d.ts

@@ -0,0 +1,12 @@
+declare const DEFAULT_CSRF_TTL_MS: number;
+interface CsrfProtectionOptions {
+    expiresIn?: number;
+    maxAge?: number;
+}
+declare function createCsrfProtection(secret: string, options?: CsrfProtectionOptions): {
+    generate(_sessionKey?: string): string;
+    verify(token: string | undefined, _sessionKey?: string): boolean;
+    secret: string;
+};
+export type { CsrfProtectionOptions };
+export { createCsrfProtection, DEFAULT_CSRF_TTL_MS };

package/dist/core/http/scimThrottleMiddleware.d.ts

@@ -0,0 +1,9 @@
+import type { Middleware } from "./middleware";
+interface ScimThrottleOptions {
+    redisUrl?: string;
+    maxAttempts: number;
+    decaySeconds: number;
+}
+declare function createScimThrottleMiddleware(options: ScimThrottleOptions): Middleware;
+export type { ScimThrottleOptions };
+export { createScimThrottleMiddleware };

package/dist/core/security/scimTenantTokens.d.ts

@@ -0,0 +1,3 @@
+declare function parseScimTenantTokens(raw: string | undefined): Map<number, string>;
+declare function resolveScimTenantFromToken(token: string): number | null;
+export { parseScimTenantTokens, resolveScimTenantFromToken };

package/dist/core/security/timingSafeCompare.d.ts

@@ -0,0 +1,2 @@
+declare function timingSafeCompareString(left: string, right: string): boolean;
+export { timingSafeCompareString };

package/dist/framework/public-api.d.ts

@@ -14,6 +14,7 @@ export { CACHE_TAGS } from "../core/cache/tags.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";
 export { default as BaseRepository } from "../core/database/baseRepository.ts";
 export { bindDatabaseConnection } from "../core/database/bindConnection.ts";
+export { createDatabaseConnection } from "../core/database/connection.ts";
 export { getActiveDatabaseConnection, runWithDatabaseConnection, } from "../core/database/connectionContext.ts";
 export { withMigrationLock } from "../core/database/migrations/advisoryLock.ts";
 export { freshDatabase, getMigrationStatus, loadMigrationsFromDirectory, migrateDatabase, rollbackDatabase, } from "../core/database/migrations/runner.ts";
@@ -36,7 +37,10 @@ export { BadRequestError, ConflictError, ForbiddenError, NotFoundError, Precondi
 export { EventBus } from "../core/events/eventBus.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
+export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
+export { createCsrfProtection } from "../core/http/csrfProtection.ts";
+export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";
 export { assertIfMatch, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
 export { FormRequest } from "../core/http/formRequest.ts";
 export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";

package/dist/index.js

@@ -3748,76 +3748,61 @@ function htmlResponse(html, init = {}) {
   });
 }
 // ../../src/core/http/csrfToken.ts
-import { createHmac as createHmac3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+
+// ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";
 var CSRF_TTL_MS = 60 * 60 * 1000;
 function resolveCsrfSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
 }
-function signCsrfToken(token, issuedAt) {
-  const payload = `${token}.${issuedAt}`;
-  const signature = createHmac3("sha256", resolveCsrfSecret()).update(payload).digest("hex");
-  return `${payload}.${signature}`;
+function csrfVerifyOptions() {
+  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function readCsrfCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === CSRF_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseSignedCsrfValue(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
-    return null;
-  }
-  const [token, issuedAtRaw, cookieSignature] = parts;
-  if (!token || !issuedAtRaw || !cookieSignature) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt)) {
-    return null;
-  }
-  if (Date.now() - issuedAt > CSRF_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signCsrfToken(token, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(cookieSignature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
   }
-  return { token, issuedAt };
+  return timingSafeEqual2(leftBuffer, rightBuffer);
 }
 function createCsrfTokenCookie() {
-  const token = randomBytes(24).toString("hex");
-  const issuedAt = Date.now();
-  const value = signCsrfToken(token, issuedAt);
+  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
     token,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(value)}; Path=/; SameSite=Lax; Max-Age=3600`
+    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}`
   };
 }
 function resolveCsrfToken(request) {
-  const cookieValue = readCsrfCookie(request);
-  if (cookieValue) {
-    const parsed = parseSignedCsrfValue(cookieValue);
-    if (parsed) {
-      return { token: parsed.token };
-    }
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
+  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
+    return { token: cookieValue };
   }
   return createCsrfTokenCookie();
 }
@@ -3840,6 +3825,10 @@ async function readSubmittedCsrfTokenFromBody(request) {
     if (typeof field === "string" && field.trim().length > 0) {
       return field.trim();
     }
+    const legacyField = formData.get("_csrf");
+    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
+      return legacyField.trim();
+    }
   }
   return null;
 }
@@ -3847,20 +3836,14 @@ function verifyCsrfToken(request, submittedToken) {
   if (!submittedToken) {
     return false;
   }
-  const cookieValue = readCsrfCookie(request);
+  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
   if (!cookieValue) {
     return false;
   }
-  const parsed = parseSignedCsrfValue(cookieValue);
-  if (!parsed) {
-    return false;
-  }
-  const submittedBuffer = Buffer.from(submittedToken);
-  const expectedBuffer = Buffer.from(parsed.token);
-  if (submittedBuffer.length !== expectedBuffer.length) {
+  if (!tokensMatch(submittedToken, cookieValue)) {
     return false;
   }
-  return timingSafeEqual2(submittedBuffer, expectedBuffer);
+  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
 }
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
@@ -3871,14 +3854,14 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
 }
 function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac4("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
+  const signature = createHmac3("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
   return `${payload}.${issuedAt}.${signature}`;
 }
 function readFlashCookie(request) {
@@ -4967,9 +4950,9 @@ function createTenantMiddleware() {
 }
 
 // ../../src/core/tracing/otel.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 function randomHex(bytes) {
-  return randomBytes2(bytes).toString("hex");
+  return randomBytes(bytes).toString("hex");
 }
 function createSpan(input) {
   const spanId = randomHex(8);
@@ -5302,6 +5285,25 @@ function prefixRouteMap(prefix, routes) {
   }
   return prefixed;
 }
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+
 // ../../src/bootstrap/web/forms.ts
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type") ?? "";
@@ -5331,30 +5333,86 @@ async function parseFormBody(request) {
   }
   return { fields, files };
 }
-function createCsrfProtection(secret) {
-  const tokenCache = new Map;
-  function generate(sessionKey) {
-    const token = `${sessionKey}.${Date.now().toString(36)}.${Math.random().toString(36).slice(2)}`;
-    tokenCache.set(token, Date.now());
-    return token;
-  }
-  function verify(token, maxAgeMs = 60 * 60 * 1000) {
-    if (!token || !tokenCache.has(token))
-      return false;
-    const created = tokenCache.get(token) ?? 0;
-    if (Date.now() - created > maxAgeMs) {
-      tokenCache.delete(token);
-      return false;
+// ../../src/bootstrap/web/routing.ts
+import { securedBindRouteModelByKey, withErrorHandling } from "@getstrata/core";
+function routeParams(request) {
+  const normalized = {};
+  const raw = request.params;
+  if (raw && typeof raw === "object") {
+    for (const [key, value] of Object.entries(raw)) {
+      normalized[key] = decodeURIComponent(String(value));
+    }
+  }
+  return normalized;
+}
+function toRouteRequest(request) {
+  const params = routeParams(request);
+  Object.defineProperty(request, "params", {
+    value: params,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+  return request;
+}
+function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
+  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  return async (request) => bound(toRouteRequest(request));
+}
+function wrapWebLogin(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+}
+function wrapWebRegister(kernel, handler, onThrottled) {
+  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+}
+function wrapWebThrottle(kernel, scope, handler, onThrottled) {
+  const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);
+  return async (request) => {
+    const response = await throttled(request);
+    if (response.status === 429) {
+      return onThrottled(request);
     }
-    return true;
-  }
-  return { generate, verify, secret };
+    return response;
+  };
+}
+function createRouteKernel(dependencies) {
+  return createHttpKernel(dependencies);
 }
 // ../../src/bootstrap/web/server.ts
+function wrapRouteHandler2(handler) {
+  return async (request) => {
+    const response = await handler(request);
+    return response ?? new Response("Not Found", { status: 404 });
+  };
+}
+function convertAppRoutesToBunRoutes(routes) {
+  const bunRoutes = {};
+  for (const [path, handler] of Object.entries(routes)) {
+    if (typeof handler === "function") {
+      bunRoutes[path] = { GET: wrapRouteHandler2(handler) };
+      continue;
+    }
+    if (handler && typeof handler === "object" && !Array.isArray(handler)) {
+      const methods = {};
+      for (const [method, methodHandler] of Object.entries(handler)) {
+        if (typeof methodHandler !== "function") {
+          continue;
+        }
+        methods[method.toUpperCase()] = wrapRouteHandler2(methodHandler);
+      }
+      if (Object.keys(methods).length > 0) {
+        bunRoutes[path] = methods;
+      }
+    }
+  }
+  return bunRoutes;
+}
 function createWebServer(options) {
   const publicDir = options.publicDir ?? "./public";
+  const bunRoutes = options.routes ? convertAppRoutesToBunRoutes(options.routes) : undefined;
   return Bun.serve({
     port: options.port,
+    ...bunRoutes ? { routes: bunRoutes } : {},
     async fetch(request) {
       await options.onRequest?.(request);
       const url = new URL(request.url);
@@ -5364,14 +5422,16 @@ function createWebServer(options) {
           return new Response(file);
         }
       }
-      const response = await options.handle(request);
-      return response ?? new Response("Not Found", { status: 404 });
+      if (options.handle) {
+        const response = await options.handle(request);
+        return response ?? new Response("Not Found", { status: 404 });
+      }
+      return new Response("Not Found", { status: 404 });
     }
   });
 }
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes as randomBytes3 } from "crypto";
-
+import { createHash, randomBytes as randomBytes2 } from "crypto";
 class CookieSessionStore {
   sql;
   secret;
@@ -5397,7 +5457,7 @@ class CookieSessionStore {
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
   async create(user) {
-    const id = randomBytes3(32).toString("hex");
+    const id = randomBytes2(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,
@@ -5410,8 +5470,8 @@ class CookieSessionStore {
     await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
-    const cookie = this.parseCookie(request.headers.get("cookie") ?? "");
-    const raw = cookie[this.cookieName];
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
     if (!raw)
       return null;
     const [sessionId, signature] = raw.split(".");
@@ -5435,27 +5495,22 @@ class CookieSessionStore {
   sign(value) {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
   }
-  parseCookie(header) {
-    const out = {};
-    for (const part of header.split(";")) {
-      const idx = part.indexOf("=");
-      if (idx === -1)
-        continue;
-      out[part.slice(0, idx).trim()] = decodeURIComponent(part.slice(idx + 1).trim());
-    }
-    return out;
-  }
 }
 // ../../src/bootstrap/web/slug.ts
 function slugify(value) {
   return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 export {
+  wrapWebRegister,
+  wrapWebLogin,
+  wrapSecuredRouteModelByKey,
+  toRouteRequest,
   slugify,
   setActiveApplicationContext2 as setActiveApplicationContext,
   scheduleRunCommand,
   runProviderPhase,
   runDueScheduledTasks,
+  routeParams,
   resolveService,
   resolveApplicationQueue2 as resolveApplicationQueue,
   prefixRouteMap,
@@ -5464,6 +5519,7 @@ export {
   getRequiredDependency,
   createWebServer,
   createWebRoutes,
+  createRouteKernel,
   createHttpKernel,
   createCsrfProtection,
   createAppContext,

package/dist/modules/scim/controller.d.ts

@@ -0,0 +1,15 @@
+import type { AppDependencies } from "@getstrata/bootstrap/contracts";
+declare class ScimController {
+    private readonly service;
+    constructor(dependencies: AppDependencies);
+    readonly serviceProviderConfig: () => Promise<Response>;
+    readonly listUsers: (request: Request) => Promise<Response>;
+    readonly createUser: (request: Request) => Promise<Response>;
+    readonly showUser: (request: Request) => Promise<Response>;
+    readonly patchUser: (request: Request) => Promise<Response>;
+    readonly deleteUser: (request: Request) => Promise<Response>;
+    readonly listGroups: (request: Request) => Promise<Response>;
+    readonly showGroup: (request: Request) => Promise<Response>;
+    readonly patchGroup: (request: Request) => Promise<Response>;
+}
+export default ScimController;

package/dist/modules/scim/scimResponse.d.ts

@@ -0,0 +1,10 @@
+import { type EtagVersioned } from "@getstrata/core/http/etag";
+interface ScimResponseOptions {
+    status?: number;
+    request?: Request;
+    etagSource?: EtagVersioned;
+}
+declare function scimResponse(data: unknown, options?: ScimResponseOptions): Response;
+declare function assertScimIfMatch(request: Request, etagSource: EtagVersioned): void;
+export type { ScimResponseOptions };
+export { assertScimIfMatch, scimResponse };

package/dist/modules/scim/service.d.ts

@@ -0,0 +1,217 @@
+import type { AppDependencies } from "@getstrata/bootstrap/contracts";
+import OrganizationMemberRepository from "../organization/memberRepository";
+import type UserRepository from "../user/repository";
+interface ScimUserPayload {
+    userName?: string;
+    name?: {
+        formatted?: string;
+    };
+    active?: boolean;
+    emails?: Array<{
+        value: string;
+        primary?: boolean;
+    }>;
+}
+interface ScimPatchOperation {
+    op: string;
+    path?: string;
+    value?: unknown;
+}
+declare class ScimService {
+    private readonly users;
+    private readonly members;
+    constructor(users: UserRepository, members: OrganizationMemberRepository);
+    serviceProviderConfig(): {
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"[];
+        patch: {
+            supported: boolean;
+        };
+        bulk: {
+            supported: boolean;
+        };
+        filter: {
+            supported: boolean;
+        };
+        changePassword: {
+            supported: boolean;
+        };
+        sort: {
+            supported: boolean;
+        };
+        etag: {
+            supported: boolean;
+        };
+        authenticationSchemes: {
+            type: string;
+            name: string;
+            description: string;
+        }[];
+    };
+    listUsers(startIndex?: number, count?: number): Promise<{
+        schemas: "urn:ietf:params:scim:api:messages:2.0:ListResponse"[];
+        totalResults: number;
+        startIndex: number;
+        itemsPerPage: number;
+        Resources: {
+            schemas: "urn:ietf:params:scim:schemas:core:2.0:User"[];
+            id: string;
+            userName: string;
+            name: {
+                formatted: string;
+            };
+            displayName: string;
+            active: boolean;
+            emails: {
+                value: string;
+                primary: boolean;
+                type: string;
+            }[];
+            roles: {
+                value: string;
+                primary: boolean;
+            }[];
+            meta: {
+                resourceType: string;
+                created: string | undefined;
+                lastModified: string | undefined;
+            };
+        }[];
+    }>;
+    getUser(id: number): Promise<{
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:User"[];
+        id: string;
+        userName: string;
+        name: {
+            formatted: string;
+        };
+        displayName: string;
+        active: boolean;
+        emails: {
+            value: string;
+            primary: boolean;
+            type: string;
+        }[];
+        roles: {
+            value: string;
+            primary: boolean;
+        }[];
+        meta: {
+            resourceType: string;
+            created: string | undefined;
+            lastModified: string | undefined;
+        };
+    }>;
+    findUserRecord(id: number): Promise<import("../user/types").UserRecord>;
+    createUser(payload: ScimUserPayload): Promise<{
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:User"[];
+        id: string;
+        userName: string;
+        name: {
+            formatted: string;
+        };
+        displayName: string;
+        active: boolean;
+        emails: {
+            value: string;
+            primary: boolean;
+            type: string;
+        }[];
+        roles: {
+            value: string;
+            primary: boolean;
+        }[];
+        meta: {
+            resourceType: string;
+            created: string | undefined;
+            lastModified: string | undefined;
+        };
+    }>;
+    patchUser(id: number, operations: ScimPatchOperation[]): Promise<{
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:User"[];
+        id: string;
+        userName: string;
+        name: {
+            formatted: string;
+        };
+        displayName: string;
+        active: boolean;
+        emails: {
+            value: string;
+            primary: boolean;
+            type: string;
+        }[];
+        roles: {
+            value: string;
+            primary: boolean;
+        }[];
+        meta: {
+            resourceType: string;
+            created: string | undefined;
+            lastModified: string | undefined;
+        };
+    }>;
+    deleteUser(id: number): Promise<{
+        id: number;
+        updated_at: Date;
+    }>;
+    listGroups(startIndex?: number, count?: number): Promise<{
+        schemas: "urn:ietf:params:scim:api:messages:2.0:ListResponse"[];
+        totalResults: number;
+        startIndex: number;
+        itemsPerPage: number;
+        Resources: {
+            schemas: "urn:ietf:params:scim:schemas:core:2.0:Group"[];
+            id: string;
+            displayName: string;
+            externalId: string;
+            members: {
+                value: string;
+                display: string;
+            }[];
+            meta: {
+                resourceType: string;
+                lastModified: string;
+            };
+        }[];
+    }>;
+    getGroup(id: number): Promise<{
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:Group"[];
+        id: string;
+        displayName: string;
+        externalId: string;
+        members: {
+            value: string;
+            display: string;
+        }[];
+        meta: {
+            resourceType: string;
+            lastModified: string;
+        };
+    }>;
+    findOrganizationRecord(id: number): Promise<{
+        id: number;
+        name: string;
+        slug: string;
+        updated_at: Date;
+    }>;
+    patchGroup(id: number, operations: ScimPatchOperation[]): Promise<{
+        schemas: "urn:ietf:params:scim:schemas:core:2.0:Group"[];
+        id: string;
+        displayName: string;
+        externalId: string;
+        members: {
+            value: string;
+            display: string;
+        }[];
+        meta: {
+            resourceType: string;
+            lastModified: string;
+        };
+    }>;
+    private toScimGroup;
+    private toScimUser;
+}
+declare function createScimService(dependencies: AppDependencies): ScimService;
+export default ScimService;
+export type { ScimPatchOperation, ScimUserPayload };
+export { createScimService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -16,42 +16,42 @@
       "default": "./dist/index.js"
     },
     "./applicationRegistry": {
-      "types": "./dist/entries/applicationRegistry.d.ts",
+      "types": "./dist/bootstrap/applicationRegistry.d.ts",
       "import": "./dist/entries/applicationRegistry.js",
       "default": "./dist/entries/applicationRegistry.js"
     },
     "./config": {
-      "types": "./dist/entries/config.d.ts",
+      "types": "./dist/bootstrap/config.d.ts",
       "import": "./dist/entries/config.js",
       "default": "./dist/entries/config.js"
     },
     "./context": {
-      "types": "./dist/entries/context.d.ts",
+      "types": "./dist/bootstrap/context.d.ts",
       "import": "./dist/entries/context.js",
       "default": "./dist/entries/context.js"
     },
     "./contracts": {
-      "types": "./dist/entries/contracts.d.ts",
+      "types": "./dist/bootstrap/contracts.d.ts",
       "import": "./dist/entries/contracts.js",
       "default": "./dist/entries/contracts.js"
     },
     "./createWebRoutes": {
-      "types": "./dist/entries/createWebRoutes.d.ts",
+      "types": "./dist/bootstrap/createWebRoutes.d.ts",
       "import": "./dist/entries/createWebRoutes.js",
       "default": "./dist/entries/createWebRoutes.js"
     },
     "./httpKernel": {
-      "types": "./dist/entries/httpKernel.d.ts",
+      "types": "./dist/bootstrap/httpKernel.d.ts",
       "import": "./dist/entries/httpKernel.js",
       "default": "./dist/entries/httpKernel.js"
     },
     "./providers": {
-      "types": "./dist/entries/providers.d.ts",
+      "types": "./dist/bootstrap/providers/index.d.ts",
       "import": "./dist/entries/providers.js",
       "default": "./dist/entries/providers.js"
     },
     "./providers/view": {
-      "types": "./dist/entries/providers/view.d.ts",
+      "types": "./dist/bootstrap/providers/view/index.d.ts",
       "import": "./dist/entries/providers/view.js",
       "default": "./dist/entries/providers/view.js"
     }
@@ -73,7 +73,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.5",
+    "@getstrata/core": "^0.5.9",
     "typescript": "^5.9.0"
   }
 }