@getstrata/bootstrap 0.2.20 → 0.2.22

package/dist/entries/discoverModules.js

@@ -0,0 +1,65 @@
+// @bun
+// ../../src/bootstrap/discoverModules.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
+function readDiscoverModulesState() {
+  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = { appModules: [] };
+  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
+  return state;
+}
+function configureModulesDirectory(modulesDir) {
+  readDiscoverModulesState().configuredModulesDir = modulesDir;
+}
+function resolveModulesDirectory(options) {
+  const state = readDiscoverModulesState();
+  if (options?.modulesDir) {
+    return options.modulesDir;
+  }
+  if (state.configuredModulesDir) {
+    return state.configuredModulesDir;
+  }
+  return join(import.meta.dir, "../modules");
+}
+async function loadDiscoveredModules(options) {
+  const modulesDirectory = resolveModulesDirectory(options);
+  let moduleNames;
+  try {
+    moduleNames = readdirSync(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL(join(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+async function ensureModulesLoaded(options) {
+  const state = readDiscoverModulesState();
+  if (state.appModules.length > 0) {
+    return state.appModules;
+  }
+  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
+    state.appModules.splice(0, state.appModules.length, ...modules);
+    return state.appModules;
+  });
+  return state.modulesReady;
+}
+function discoverModules() {
+  return readDiscoverModulesState().appModules;
+}
+export {
+  ensureModulesLoaded,
+  discoverModules,
+  configureModulesDirectory
+};

package/dist/entries/http/securedRouteModelBinding.js

@@ -90,6 +90,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -160,6 +161,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/httpKernel.js

@@ -78,6 +78,7 @@ function resolveRegisterRateLimit() {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";

package/dist/entries/membershipService.js

@@ -25,6 +25,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -95,6 +96,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/providers/view.js

@@ -83,6 +83,7 @@ function htmlResponse(html, init = {}) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";

package/dist/entries/providers.js

@@ -47,6 +47,7 @@ function resolveAbilitiesForRole(role) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -1277,7 +1278,6 @@ function modelEventName(tableName, action) {
 }
 
 // ../../src/bootstrap/providers/events.ts
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var eventsProvider = {
   name: "core.events",
   register({ container }) {
@@ -3332,6 +3332,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }
@@ -3348,9 +3351,63 @@ function resolveApplicationDependencies() {
   return requireActiveApplicationContext().dependencies;
 }
 // ../../src/bootstrap/discoverModules.ts
-var appModules = [];
+import { readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
+function readDiscoverModulesState() {
+  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = { appModules: [] };
+  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
+  return state;
+}
+function configureModulesDirectory(modulesDir) {
+  readDiscoverModulesState().configuredModulesDir = modulesDir;
+}
+function resolveModulesDirectory(options) {
+  const state = readDiscoverModulesState();
+  if (options?.modulesDir) {
+    return options.modulesDir;
+  }
+  if (state.configuredModulesDir) {
+    return state.configuredModulesDir;
+  }
+  return join2(import.meta.dir, "../modules");
+}
+async function loadDiscoveredModules(options) {
+  const modulesDirectory = resolveModulesDirectory(options);
+  let moduleNames;
+  try {
+    moduleNames = readdirSync2(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
+    const moduleUrl = pathToFileURL2(join2(modulesDirectory, moduleName, "index.ts")).href;
+    const loaded = await import(moduleUrl);
+    return loaded.default;
+  }));
+  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+async function ensureModulesLoaded(options) {
+  const state = readDiscoverModulesState();
+  if (state.appModules.length > 0) {
+    return state.appModules;
+  }
+  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
+    state.appModules.splice(0, state.appModules.length, ...modules);
+    return state.appModules;
+  });
+  return state.modulesReady;
+}
 function discoverModules() {
-  return appModules;
+  return readDiscoverModulesState().appModules;
 }
 
 // ../../src/bootstrap/cache/modelCacheTags.ts
@@ -3671,7 +3728,7 @@ var queue_default = queueProvider;
 
 // ../../src/core/storage/storage.ts
 import { mkdir, readFile, unlink, writeFile } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 var {S3Client } = globalThis.Bun;
 
 class LocalStorageDriver {
@@ -3683,7 +3740,7 @@ class LocalStorageDriver {
     return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
   }
   resolvePath(path) {
-    return join2(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
   }
   async put(path, contents) {
     const absolutePath = this.resolvePath(path);
@@ -3816,9 +3873,9 @@ function currentRequestMeta() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
 class EtaViewEngine {

package/dist/entries/queue/defaultJobs.js

@@ -410,6 +410,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -480,6 +481,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/entries/routeRegistry.js

@@ -0,0 +1,29 @@
+// @bun
+// ../../src/bootstrap/routeRegistry.ts
+class RouteRegistry {
+  routes = [];
+  register(route) {
+    this.routes.push(route);
+  }
+  clear() {
+    this.routes.length = 0;
+  }
+  list() {
+    return [...this.routes].sort((left, right) => left.path.localeCompare(right.path));
+  }
+}
+var ROUTE_REGISTRY_KEY = Symbol.for("@getstrata/routeRegistry");
+function readSharedRouteRegistry() {
+  const globalRegistry = globalThis[ROUTE_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new RouteRegistry;
+  globalThis[ROUTE_REGISTRY_KEY] = registry;
+  return registry;
+}
+var routeRegistry = readSharedRouteRegistry();
+export {
+  routeRegistry,
+  RouteRegistry
+};

package/dist/entries/secretsGuard.js

@@ -0,0 +1,91 @@
+// @bun
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/domain/auth.ts
+var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+
+// ../../src/bootstrap/secretsGuard.ts
+var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? appConfig.env;
+  if (appEnv !== "production") {
+    return;
+  }
+  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
+  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  if (devHeadersEnabled) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
+  }
+  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
+  }
+  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+  }
+  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
+  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+  if (corsOrigins.includes("*")) {
+    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+  }
+  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (!env.TOKEN_HASH_PEPPER?.trim()) {
+    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  }
+  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
+    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
+  }
+}
+export {
+  assertProductionSecrets
+};

package/dist/entries/web/routing.js

@@ -93,6 +93,7 @@ function resolveService(dependencies, token) {
 var CORE_CONFIG_TOKEN = "core.config";
 var CORE_CACHE_TOKEN = "core.cache";
 var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
 var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
@@ -163,6 +164,9 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationEventBus() {
+  return requireActiveApplicationContext().container.resolve(CORE_EVENT_BUS_TOKEN);
+}
 function resolveApplicationAuth() {
   return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
 }

package/dist/framework/public-api.d.ts

@@ -95,7 +95,7 @@ export { AsyncQueue, createQueue, Job, SyncQueue } from "../core/queue/index.ts"
 export { createFailedJobService, createProductionQueue, createQueueWorker, createTrackedJob, FailedJobRepository, FailedJobService, jobRegistry, QueueWorker, RedisQueue, ResilientQueue, runQueueJob, } from "../core/queue/publicQueue.ts";
 export type { QueueMetricsSnapshot } from "../core/queue/queueMetrics.ts";
 export { collectQueueMetrics } from "../core/queue/queueMetrics.ts";
-export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConfig, resolveApplicationDependencies, resolveApplicationLogger, resolveApplicationPolicyGate, resolveApplicationQueue, setActiveApplicationContext, } from "../core/runtime/applicationRegistry.ts";
+export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConfig, resolveApplicationDependencies, resolveApplicationEventBus, resolveApplicationLogger, resolveApplicationPolicyGate, resolveApplicationQueue, setActiveApplicationContext, } from "../core/runtime/applicationRegistry.ts";
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
 export { guestCanViewResource, isPublicReadsEnabled } from "../core/security/publicReads.ts";