@getstrata/bootstrap 0.2.46 → 0.2.48

package/dist/entries/createRoutes.js

@@ -2,12 +2,12 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/createRoutes.ts
-import { jsonResponse as jsonResponse4 } from "@getstrata/core/http";
 import { applyMiddlewareToRoutes as applyMiddlewareToRoutes3 } from "@getstrata/core/http/middleware";
+import { jsonResponse as jsonResponse4 } from "@getstrata/core/http/response";
 import { htmlResponse as htmlResponse2 } from "@getstrata/core/view";
 
 // ../../index.html
-var strata_default = __jsonParse("{\"index\":\"../../index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"../../index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
+var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"_.._/_.._/index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
 
 // ../../src/config/app.ts
 var appConfig = {
@@ -211,7 +211,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return this.wrap("web", handler);
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -221,19 +221,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -332,7 +332,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -366,6 +366,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -449,7 +455,7 @@ function buildModuleRoutes(dependencies, options = {}) {
 
 // ../../src/bootstrap/createSpaRoutes.ts
 import { join as join2 } from "path";
-import { jsonResponse } from "@getstrata/core/http";
+import { jsonResponse } from "@getstrata/core/http/response";
 var SPA_DIST_DIRECTORY = join2(process.cwd(), "frontend/dist");
 var SPA_INDEX_FILE = join2(SPA_DIST_DIRECTORY, "index.html");
 function createSpaRoutes(_dependencies) {
@@ -496,7 +502,7 @@ function buildWebModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const middleware = kernel.globalMiddleware();
   const moduleRoutes = { ...seedRoutes };
   for (const module of modules) {
     if (!module.webRoutes) {
@@ -547,7 +553,7 @@ function mergeWebRoutes(dependencies, routes) {
 }
 
 // ../../src/bootstrap/health.ts
-import { jsonResponse as jsonResponse2 } from "@getstrata/core/http";
+import { jsonResponse as jsonResponse2 } from "@getstrata/core/http/response";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/config/database.ts
@@ -731,15 +737,41 @@ function createHealthRoutes(dependencies) {
 }
 
 // ../../src/bootstrap/metricsRoutes.ts
+import { timingSafeEqual } from "crypto";
 import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function authorizeMetrics(request) {
+  const expected = process.env.METRICS_TOKEN?.trim();
+  const authorization = request.headers.get("authorization") ?? "";
+  const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length) : "";
+  if (expected) {
+    return presented.length > 0 && tokensMatch(presented, expected);
+  }
+  if ((process.env.APP_ENV ?? "local") === "production") {
+    return false;
+  }
+  return true;
+}
 function createMetricsRoutes() {
   return {
-    "/metrics": async () => new Response(prometheusRegistry.renderMetrics(), {
-      status: 200,
-      headers: {
-        "content-type": "text/plain; version=0.0.4; charset=utf-8"
+    "/metrics": async (request) => {
+      if (!authorizeMetrics(request)) {
+        return new Response("Not Found", { status: 404 });
       }
-    })
+      return new Response(prometheusRegistry.renderMetrics(), {
+        status: 200,
+        headers: {
+          "content-type": "text/plain; version=0.0.4; charset=utf-8"
+        }
+      });
+    }
   };
 }
 
@@ -749,16 +781,16 @@ import { withMiddleware as withMiddleware2 } from "@getstrata/core/http/routeMid
 import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
 
 // ../../src/modules/scim/controller.ts
-import { withErrorHandling } from "@getstrata/core/http";
+import { withErrorHandling } from "@getstrata/core/http/response";
 
 // ../../src/modules/scim/scimResponse.ts
-import { jsonResponse as jsonResponse3 } from "@getstrata/core/http";
 import {
   applyConditionalGet,
   assertIfMatch,
   etagFromResource,
   isEtagEnabled
 } from "@getstrata/core/http/etag";
+import { jsonResponse as jsonResponse3 } from "@getstrata/core/http/response";
 function scimResponse(data, options = {}) {
   const status = options.status ?? 200;
   const response = jsonResponse3(data, {
@@ -797,8 +829,6 @@ import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
 import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
 var SCIM_SCHEMAS = {
   user: "urn:ietf:params:scim:schemas:core:2.0:User",
   group: "urn:ietf:params:scim:schemas:core:2.0:Group",
@@ -942,7 +972,7 @@ import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExp
 import { verifyTotp } from "@getstrata/core/security/totp";
 import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
 
-// ../../src/domain/abilities.ts
+// ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
   "projects:read",
@@ -972,107 +1002,6 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId2(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
 

package/dist/entries/createSpaRoutes.js

@@ -3,7 +3,7 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/createSpaRoutes.ts
 import { join } from "path";
-import { jsonResponse } from "@getstrata/core/http";
+import { jsonResponse } from "@getstrata/core/http/response";
 
 // ../../src/config/frontend.ts
 function readFrontendMode() {
@@ -58,7 +58,7 @@ function mergeSpaRoutes(dependencies, routes) {
   };
 }
 export {
-  mergeSpaRoutes,
+  SPA_DIST_DIRECTORY,
   createSpaRoutes,
-  SPA_DIST_DIRECTORY
+  mergeSpaRoutes
 };

package/dist/entries/createWebRoutes.js

@@ -180,7 +180,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return this.wrap("web", handler);
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -190,19 +190,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -301,7 +301,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -335,6 +335,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -423,7 +429,7 @@ function buildWebModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const middleware = kernel.globalMiddleware();
   const moduleRoutes = { ...seedRoutes };
   for (const module of modules) {
     if (!module.webRoutes) {
@@ -473,6 +479,6 @@ function mergeWebRoutes(dependencies, routes) {
   };
 }
 export {
-  mergeWebRoutes,
-  createWebRoutes
+  createWebRoutes,
+  mergeWebRoutes
 };

package/dist/entries/dependencies.js

@@ -50,7 +50,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -84,6 +84,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/providers/auth.ts
 import {
   AuthManager,
@@ -500,55 +506,28 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
-var SCIM_SCHEMAS = {
-  user: "urn:ietf:params:scim:schemas:core:2.0:User",
-  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
-  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
-  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
-  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-};
-
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+function isEnabled(value, defaultEnabled) {
+  if (value === undefined) {
+    return defaultEnabled;
+  }
+  return defaultEnabled ? value !== "false" : value === "true";
+}
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
+  const appEnv = env.APP_ENV ?? "local";
   if (appEnv !== "production") {
     return;
   }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
+  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
   if (devHeadersEnabled) {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
@@ -561,18 +540,17 @@ function assertProductionSecrets(env = process.env) {
   if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
   if (corsOrigins.includes("*")) {
     throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
   }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
   if (!env.OAUTH_STATE_SECRET?.trim()) {
@@ -584,6 +562,10 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  }
 }
 
 // ../../src/bootstrap/context.ts
@@ -641,6 +623,6 @@ function createAppDependencies() {
   return createAppContext().dependencies;
 }
 export {
-  createAppDependencies,
-  createAppContext
+  createAppContext,
+  createAppDependencies
 };

package/dist/entries/discoverModules.js

@@ -26,7 +26,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -60,8 +60,15 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 export {
-  ensureModulesLoaded,
+  configureModulesDirectory,
   discoverModules,
-  configureModulesDirectory
+  ensureModulesLoaded,
+  resetDiscoverModulesForTests
 };

package/dist/entries/health.js

@@ -2,7 +2,7 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/health.ts
-import { jsonResponse } from "@getstrata/core/http";
+import { jsonResponse } from "@getstrata/core/http/response";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/config/database.ts
@@ -209,7 +209,7 @@ function createHealthRoutes(dependencies) {
   };
 }
 export {
-  createHealthRoutes,
+  checkDatabase,
   checkRedis,
-  checkDatabase
+  createHealthRoutes
 };

package/dist/entries/http/securedRouteModelBinding.js

@@ -7,6 +7,6 @@ import {
   securedBindRouteModelByKey
 } from "@getstrata/core/http/securedRouteModelBinding";
 export {
-  securedBindRouteModelByKey,
-  securedBindRouteModel
+  securedBindRouteModel,
+  securedBindRouteModelByKey
 };

package/dist/entries/httpKernel.js

@@ -169,7 +169,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return this.wrap("web", handler);
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -179,19 +179,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -265,6 +265,6 @@ function createHttpKernel(dependencies) {
   return new HttpKernel(dependencies);
 }
 export {
-  createHttpKernel,
-  HttpKernel
+  HttpKernel,
+  createHttpKernel
 };

package/dist/entries/listeners/invalidateCacheOnModelWrite.js

@@ -44,7 +44,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -78,6 +78,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 
 // ../../src/bootstrap/cache/modelCacheTags.ts
 function cacheTagsForModelWrite(tableName, action) {