@getstrata/bootstrap 0.2.28 → 0.2.29

package/dist/entries/queue/defaultJobs.js

@@ -1,474 +1,16 @@
 // @bun
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
-}
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveRepositoryConnection()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-
-// ../../src/core/errors/http.ts
-class HttpError extends Error {
-  status;
-  details;
-  constructor(status, message, details) {
-    super(message);
-    this.name = new.target.name;
-    this.status = status;
-    this.details = details;
-  }
-}
-
-class BadRequestError extends HttpError {
-  constructor(message = "Bad Request", details) {
-    super(400, message, details);
-  }
-}
-class ConflictError extends HttpError {
-  constructor(message = "Conflict", details) {
-    super(409, message, details);
-  }
-}
-
-class UnprocessableEntityError extends HttpError {
-  constructor(message = "Unprocessable Entity", details) {
-    super(422, message, details);
-  }
-}
-class ForbiddenError extends HttpError {
-  constructor(message = "Forbidden", details) {
-    super(403, message, details);
-  }
-}
-
-class UnauthorizedError extends HttpError {
-  constructor(message = "Unauthorized", details) {
-    super(401, message, details);
-  }
-}
-class PreconditionFailedError extends HttpError {
-  constructor(message = "Precondition Failed", details) {
-    super(412, message, details);
-  }
-}
-
-// ../../src/core/security/safeUrl.ts
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
-}
-var jobRegistry = readSharedJobRegistry();
-
-// ../../src/core/contracts/di.ts
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${key}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_POLICY_GATE_TOKEN = "core.policyGate";
-var CORE_AUTH_TOKEN = "core.auth";
-
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
-}
-var appLogger = new Logger("app");
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-function resolveApplicationAuth() {
-  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
-}
-function resolveApplicationPolicyGate() {
-  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
-}
+var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/queue/defaultJobs.ts
+import DispatchWebhookJob from "@getstrata/core/jobs/dispatchWebhookJob";
+import InvalidateCacheTagsJob from "@getstrata/core/jobs/invalidateCacheTagsJob";
+import { jobRegistry } from "@getstrata/core/queue/jobRegistry";
+import { resolveApplicationCache } from "@getstrata/core/runtime/applicationRegistry";
 function registerDefaultJobs() {
   jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache());
+    return new InvalidateCacheTagsJob(resolveApplicationCache());
   });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
+  jobRegistry.register("webhook.dispatch", () => new DispatchWebhookJob);
 }
 export {
   registerDefaultJobs

package/dist/entries/routeRegistry.js

@@ -1,4 +1,6 @@
 // @bun
+var __jsonParse = (a) => JSON.parse(a);
+
 // ../../src/bootstrap/routeRegistry.ts
 class RouteRegistry {
   routes = [];

package/dist/entries/schedule.js

@@ -0,0 +1,49 @@
+// @bun
+var __jsonParse = (a) => JSON.parse(a);
+
+// ../../src/bootstrap/schedule.ts
+import { exportPendingAuditLogs } from "@getstrata/core/audit/exportAuditLogs";
+import { appLogger } from "@getstrata/core/logging/logger";
+import { appSchedule } from "@getstrata/core/scheduler/schedule";
+
+// ../../src/config/features.ts
+function readFeatureFlags() {
+  return {
+    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
+    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
+    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
+    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
+    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
+    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
+    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
+    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
+  };
+}
+var featureFlags = readFeatureFlags();
+function isFeatureEnabled(feature) {
+  return readFeatureFlags()[feature];
+}
+
+// ../../src/bootstrap/schedule.ts
+appSchedule.command("* * * * *", "heartbeat", () => {
+  appLogger.debug("Scheduler heartbeat");
+});
+appSchedule.command("* * * * *", "audit-export", async () => {
+  if (!isFeatureEnabled("siemExport")) {
+    return;
+  }
+  try {
+    const exported = await exportPendingAuditLogs();
+    if (exported > 0) {
+      appLogger.info(`Exported ${exported} audit log entries to SIEM.`);
+    }
+  } catch (error) {
+    appLogger.error("Audit export failed.", { error: String(error) });
+  }
+});
+export {
+  appSchedule
+};

package/dist/entries/secretsGuard.js

@@ -1,4 +1,6 @@
 // @bun
+var __jsonParse = (a) => JSON.parse(a);
+
 // ../../src/config/app.ts
 var appConfig = {
   name: "WorkHub",
@@ -36,6 +38,13 @@ var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
 // ../../src/domain/scim.ts
 var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
 var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
+var SCIM_SCHEMAS = {
+  user: "urn:ietf:params:scim:schemas:core:2.0:User",
+  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
+  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
+  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
+  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
+};
 
 // ../../src/bootstrap/secretsGuard.ts
 var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);

package/dist/entries/web/forms.js

@@ -1,24 +1,10 @@
 // @bun
-// ../../src/core/http/csrfProtection.ts
-var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
-function createCsrfProtection(secret, options = {}) {
-  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
-  const maxAge = options.maxAge ?? expiresIn;
-  return {
-    generate(_sessionKey) {
-      return Bun.CSRF.generate(secret, { expiresIn });
-    },
-    verify(token, _sessionKey) {
-      if (!token) {
-        return false;
-      }
-      return Bun.CSRF.verify(token, { secret, maxAge });
-    },
-    secret
-  };
-}
+var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/forms.ts
+import {
+  createCsrfProtection
+} from "@getstrata/core/http/csrfProtection";
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type") ?? "";
   const fields = {};