@getstrata/bootstrap 0.2.20 → 0.2.21

package/dist/entries/http/securedRouteModelBinding.js

@@ -90,6 +90,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -160,6 +161,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/httpKernel.js

@@ -78,6 +78,7 @@ function resolveRegisterRateLimit() {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";

package/dist/entries/membershipService.js

@@ -25,6 +25,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -95,6 +96,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/providers/view.js

@@ -83,6 +83,7 @@ function htmlResponse(html, init = {}) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";

package/dist/entries/providers.js

@@ -47,6 +47,7 @@ function resolveAbilitiesForRole(role) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -1277,7 +1278,6 @@ function modelEventName(tableName, action) {
 }
 
 // ../../src/bootstrap/providers/events.ts
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var eventsProvider = {
   name: "core.events",
   register({ container }) {
@@ -3332,6 +3332,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/queue/defaultJobs.js

@@ -410,6 +410,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -480,6 +481,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/routeRegistry.js

@@ -0,0 +1,29 @@
+// @bun
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
+export {
+  routeRegistry,
+  RouteRegistry
+};

package/dist/entries/secretsGuard.js

@@ -0,0 +1,91 @@
+// @bun
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/domain/auth.ts
+var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+
+// ../../src/bootstrap/secretsGuard.ts
+var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? appConfig.env;
+  if (appEnv !== "production") {
+    return;
+  }
+  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
+  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  if (devHeadersEnabled) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
+  }
+  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
+  }
+  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+  }
+  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
+  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+  if (corsOrigins.includes("*")) {
+    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+  }
+  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (!env.TOKEN_HASH_PEPPER?.trim()) {
+    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  }
+  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
+    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
+  }
+}
+export {
+  assertProductionSecrets
+};

package/dist/entries/web/routing.js

@@ -93,6 +93,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -163,6 +164,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/framework/public-api.d.ts

@@ -95,7 +95,7 @@ export { AsyncQueue, createQueue, Job, SyncQueue } from "../core/queue/index.ts"
 export { createFailedJobService, createProductionQueue, createQueueWorker, createTrackedJob, FailedJobRepository, FailedJobService, jobRegistry, QueueWorker, RedisQueue, ResilientQueue, runQueueJob, } from "../core/queue/publicQueue.ts";
 export type { QueueMetricsSnapshot } from "../core/queue/queueMetrics.ts";
 export { collectQueueMetrics } from "../core/queue/queueMetrics.ts";
-export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConfig, resolveApplicationDependencies, resolveApplicationLogger, resolveApplicationPolicyGate, resolveApplicationQueue, setActiveApplicationContext, } from "../core/runtime/applicationRegistry.ts";
+export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConfig, resolveApplicationDependencies, resolveApplicationEventBus, resolveApplicationLogger, resolveApplicationPolicyGate, resolveApplicationQueue, setActiveApplicationContext, } from "../core/runtime/applicationRegistry.ts";
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
 export { guestCanViewResource, isPublicReadsEnabled } from "../core/security/publicReads.ts";

package/dist/index.js

@@ -529,6 +529,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -563,6 +564,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }
@@ -1790,7 +1794,6 @@ function modelEventName(tableName, action) {
 }
 
 // ../../src/bootstrap/providers/events.ts
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var eventsProvider = {
   name: "core.events",
   register({ container }) {
@@ -4677,7 +4680,17 @@ class RouteRegistry {
     return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
   }
 }
-var routeRegistry = new RouteRegistry;
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
 
 // ../../src/bootstrap/createWebRoutes.ts
 function registerRoute(method, path, middleware) {
@@ -4739,6 +4752,10 @@ function mergeWebRoutes(dependencies, routes) {
     ...routes
   };
 }
+// ../../src/bootstrap/dependencies.ts
+function createAppDependencies() {
+  return createAppContext().dependencies;
+}
 // ../../src/core/crypto/nonCryptographicHash.ts
 function nonCryptographicDigest(input) {
   return Bun.hash(input).toString(16);
@@ -5270,12 +5287,14 @@ export {
   scheduleRunCommand,
   runProviderPhase,
   runDueScheduledTasks,
+  routeRegistry,
   routeParams,
   resolveService,
   resolveMembershipService,
   resolveApplicationQueue,
   resolveApplicationPolicyGate,
   resolveApplicationLogger,
+  resolveApplicationEventBus,
   resolveApplicationDependencies,
   resolveApplicationConfig,
   resolveApplicationCache,
@@ -5291,14 +5310,17 @@ export {
   createRouteKernel,
   createHttpKernel,
   createCsrfProtection,
+  createAppDependencies,
   createAppContext,
   coreProviders,
   collectProviders,
   cacheTagsForModelWrite,
+  assertProductionSecrets,
   assertAppDependenciesComplete,
   appSchedule,
   ServiceContainer,
   Schedule,
+  RouteRegistry,
   REDIS_URL_CONFIG_KEY,
   DEFAULT_APP_PORT,
   DATABASE_URL_CONFIG_KEY,
@@ -5306,6 +5328,7 @@ export {
   CORE_TOKEN_SERVICE_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_AUTH_TOKEN,

package/dist/modules/scim/controller.d.ts

@@ -1,4 +1,4 @@
-import type { AppDependencies } from "@getstrata/bootstrap/contracts";
+import type { AppDependencies } from "@getstrata/core/contracts/di";
 import type ScimService from "./service";
 declare class ScimController {
     private readonly service;

package/dist/modules/scim/service.d.ts

@@ -1,4 +1,4 @@
-import type { AppDependencies } from "@getstrata/bootstrap/contracts";
+import type { AppDependencies } from "@getstrata/core/contracts/di";
 import OrganizationMemberRepository from "../organization/memberRepository";
 import OrganizationRepository from "../organization/repository";
 import type UserRepository from "../user/repository";

package/dist/modules/user/provider.d.ts

@@ -1,4 +1,4 @@
-import type { ServiceProvider } from "@getstrata/bootstrap/contracts";
+import type { ServiceProvider } from "@getstrata/core/contracts/di";
 declare const userRepositoryToken = "user.repository";
 declare const apiTokenRepositoryToken = "user.apiTokenRepository";
 declare const tokenServiceToken = "core.tokenService";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -45,6 +45,11 @@
       "import": "./dist/entries/createWebRoutes.js",
       "default": "./dist/entries/createWebRoutes.js"
     },
+    "./dependencies": {
+      "types": "./dist/bootstrap/dependencies.d.ts",
+      "import": "./dist/entries/dependencies.js",
+      "default": "./dist/entries/dependencies.js"
+    },
     "./http/securedRouteModelBinding": {
       "types": "./dist/bootstrap/http/securedRouteModelBinding.d.ts",
       "import": "./dist/entries/http/securedRouteModelBinding.js",
@@ -75,6 +80,16 @@
       "import": "./dist/entries/providers/view.js",
       "default": "./dist/entries/providers/view.js"
     },
+    "./routeRegistry": {
+      "types": "./dist/bootstrap/routeRegistry.d.ts",
+      "import": "./dist/entries/routeRegistry.js",
+      "default": "./dist/entries/routeRegistry.js"
+    },
+    "./secretsGuard": {
+      "types": "./dist/bootstrap/secretsGuard.d.ts",
+      "import": "./dist/entries/secretsGuard.js",
+      "default": "./dist/entries/secretsGuard.js"
+    },
     "./web/forms": {
       "types": "./dist/bootstrap/web/forms.d.ts",
       "import": "./dist/entries/web/forms.js",
@@ -112,14 +127,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/membershipService.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/dependencies.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/membershipService.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.28",
+    "@getstrata/core": "^0.5.29",
     "typescript": "^5.9.0"
   }
 }