@getstrata/bootstrap 0.2.47 → 0.2.48

package/dist/entries/secretsGuard.js

@@ -1,64 +1,28 @@
 // @bun
 var __jsonParse = (a) => JSON.parse(a);
 
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
-var SCIM_SCHEMAS = {
-  user: "urn:ietf:params:scim:schemas:core:2.0:User",
-  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
-  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
-  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
-  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-};
-
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+function isEnabled(value, defaultEnabled) {
+  if (value === undefined) {
+    return defaultEnabled;
+  }
+  return defaultEnabled ? value !== "false" : value === "true";
+}
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
+  const appEnv = env.APP_ENV ?? "local";
   if (appEnv !== "production") {
     return;
   }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
+  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
   if (devHeadersEnabled) {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
@@ -71,18 +35,17 @@ function assertProductionSecrets(env = process.env) {
   if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
   if (corsOrigins.includes("*")) {
     throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
   }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
   if (!env.OAUTH_STATE_SECRET?.trim()) {
@@ -94,6 +57,10 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  }
 }
 export {
   assertProductionSecrets

package/dist/entries/web/forms.js

@@ -34,6 +34,6 @@ async function parseFormBody(request) {
   return { fields, files };
 }
 export {
-  parseFormBody,
-  createCsrfProtection
+  createCsrfProtection,
+  parseFormBody
 };

package/dist/entries/web/routing.js

@@ -178,7 +178,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return this.wrap("web", handler);
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -188,19 +188,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -319,10 +319,10 @@ function createRouteKernel(dependencies) {
   return createHttpKernel(dependencies);
 }
 export {
-  wrapWebRegister,
-  wrapWebLogin,
-  wrapSecuredRouteModelByKey,
-  toRouteRequest,
+  createRouteKernel,
   routeParams,
-  createRouteKernel
+  toRouteRequest,
+  wrapSecuredRouteModelByKey,
+  wrapWebLogin,
+  wrapWebRegister
 };

package/dist/entries/web/server.js

@@ -54,6 +54,6 @@ function createWebServer(options) {
   });
 }
 export {
-  createWebServer,
-  convertAppRoutesToBunRoutes
+  convertAppRoutesToBunRoutes,
+  createWebServer
 };

package/dist/index.js

@@ -1,96 +1,7 @@
 // @bun
 // ../../src/bootstrap/public-api.ts
-import { appSchedule as appSchedule3, runDueScheduledTasks as runDueScheduledTasks2, Schedule as Schedule2 } from "@getstrata/core/scheduler/schedule";
+import { appSchedule, runDueScheduledTasks, Schedule } from "@getstrata/core/scheduler/schedule";
 
-// ../../src/core/scheduler/schedule.ts
-class Schedule {
-  tasks = [];
-  command(expression, name, run) {
-    this.tasks.push({ expression, name, run });
-    return this;
-  }
-  dueTasks(now = new Date) {
-    const minute = now.getMinutes();
-    return this.tasks.filter((task) => {
-      if (task.expression === "* * * * *") {
-        return true;
-      }
-      if (task.expression.startsWith("*/")) {
-        const interval = Number.parseInt(task.expression.slice(2), 10);
-        return Number.isInteger(interval) && interval > 0 && minute % interval === 0;
-      }
-      return false;
-    });
-  }
-  tasksList() {
-    return [...this.tasks];
-  }
-}
-var appSchedule = new Schedule;
-async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
-  const due = schedule.dueTasks(now);
-  for (const task of due) {
-    await task.run();
-  }
-  return due.length;
-}
-
-// ../../src/bootstrap/schedule.ts
-import { exportPendingAuditLogs } from "@getstrata/core/audit/exportAuditLogs";
-import { appLogger } from "@getstrata/core/logging/logger";
-import { appSchedule as appSchedule2 } from "@getstrata/core/scheduler/schedule";
-
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/bootstrap/schedule.ts
-appSchedule2.command("* * * * *", "heartbeat", () => {
-  appLogger.debug("Scheduler heartbeat");
-});
-appSchedule2.command("* * * * *", "audit-export", async () => {
-  if (!isFeatureEnabled("siemExport")) {
-    return;
-  }
-  try {
-    const exported = await exportPendingAuditLogs();
-    if (exported > 0) {
-      appLogger.info(`Exported ${exported} audit log entries to SIEM.`);
-    }
-  } catch (error) {
-    appLogger.error("Audit export failed.", { error: String(error) });
-  }
-});
-
-// ../../src/cli/commands/scheduleRun.ts
-async function scheduleRunCommand() {
-  const due = appSchedule.dueTasks();
-  if (due.length === 0) {
-    console.log("No scheduled tasks due.");
-    return;
-  }
-  for (const task of due) {
-    console.log(`Running scheduled task: ${task.name}`);
-  }
-  await runDueScheduledTasks(appSchedule);
-}
 // ../../src/bootstrap/applicationRegistry.ts
 import {
   resolveApplicationAuth,
@@ -271,7 +182,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return this.wrap("web", handler);
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -281,19 +192,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrap("web", withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -392,7 +303,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -514,7 +425,7 @@ function buildWebModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const middleware = kernel.globalMiddleware();
   const moduleRoutes = { ...seedRoutes };
   for (const module of modules) {
     if (!module.webRoutes) {
@@ -907,27 +818,28 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
-
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
+var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+function isEnabled(value, defaultEnabled) {
+  if (value === undefined) {
+    return defaultEnabled;
+  }
+  return defaultEnabled ? value !== "false" : value === "true";
+}
 function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
+  const appEnv = env.APP_ENV ?? "local";
   if (appEnv !== "production") {
     return;
   }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
+  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
+  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
+  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
   if (devHeadersEnabled) {
     throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
@@ -940,18 +852,17 @@ function assertProductionSecrets(env = process.env) {
   if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
     throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
   }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
   }
   const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
   if (corsOrigins.includes("*")) {
     throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
   }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
+  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
     throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
   }
   if (!env.OAUTH_STATE_SECRET?.trim()) {
@@ -963,6 +874,10 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  }
 }
 
 // ../../src/bootstrap/context.ts
@@ -1249,66 +1164,65 @@ function slugify(value) {
   return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 export {
-  wrapWebRegister,
-  wrapWebLogin,
-  wrapSecuredRouteModelByKey,
-  toRouteRequest,
-  slugify,
-  setActiveApplicationContext,
-  securedBindRouteModelByKey,
-  securedBindRouteModel,
-  scheduleRunCommand,
-  runProviderPhase,
-  runDueScheduledTasks2 as runDueScheduledTasks,
-  routeRegistry,
-  routeParams,
-  resolveService,
-  resolveMembershipService,
-  resolveApplicationQueue,
-  resolveApplicationPolicyGate,
-  resolveApplicationLogger,
-  resolveApplicationEventBus,
-  resolveApplicationDependencies,
-  resolveApplicationConfig,
-  resolveApplicationCache,
-  resolveApplicationAuth,
-  registerDefaultJobs,
-  prefixRouteMap,
-  parseFormBody,
-  mergeWebRoutes,
-  getRequiredDependency,
-  ensureModulesLoaded,
-  discoverModules,
-  discoverModelTableNames,
-  createWebServer,
-  createWebRoutes,
-  createRouteKernel,
-  createHttpKernel,
-  createCsrfProtection,
-  createAppDependencies,
-  createAppContext,
-  coreProviders,
-  configureModulesDirectory,
-  collectProviders,
-  cacheTagsForModelWrite,
-  buildWebModuleRoutes,
-  buildModuleRoutes,
-  assertProductionSecrets,
-  assertAppDependenciesComplete,
-  appSchedule3 as appSchedule,
-  ServiceContainer,
-  Schedule2 as Schedule,
-  RouteRegistry,
-  REDIS_URL_CONFIG_KEY,
-  DEFAULT_APP_PORT,
-  DATABASE_URL_CONFIG_KEY,
-  CookieSessionStore,
-  CORE_TOKEN_SERVICE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_CACHE_TOKEN,
+  APP_PORT_CONFIG_KEY,
   CORE_AUTH_TOKEN,
-  APP_PORT_CONFIG_KEY
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN,
+  CookieSessionStore,
+  DATABASE_URL_CONFIG_KEY,
+  DEFAULT_APP_PORT,
+  REDIS_URL_CONFIG_KEY,
+  RouteRegistry,
+  Schedule,
+  ServiceContainer,
+  appSchedule,
+  assertAppDependenciesComplete,
+  assertProductionSecrets,
+  buildModuleRoutes,
+  buildWebModuleRoutes,
+  cacheTagsForModelWrite,
+  collectProviders,
+  configureModulesDirectory,
+  coreProviders,
+  createAppContext,
+  createAppDependencies,
+  createCsrfProtection,
+  createHttpKernel,
+  createRouteKernel,
+  createWebRoutes,
+  createWebServer,
+  discoverModelTableNames,
+  discoverModules,
+  ensureModulesLoaded,
+  getRequiredDependency,
+  mergeWebRoutes,
+  parseFormBody,
+  prefixRouteMap,
+  registerDefaultJobs,
+  resolveApplicationAuth,
+  resolveApplicationCache,
+  resolveApplicationConfig,
+  resolveApplicationDependencies,
+  resolveApplicationEventBus,
+  resolveApplicationLogger,
+  resolveApplicationPolicyGate,
+  resolveApplicationQueue,
+  resolveMembershipService,
+  resolveService,
+  routeParams,
+  routeRegistry,
+  runDueScheduledTasks,
+  runProviderPhase,
+  securedBindRouteModel,
+  securedBindRouteModelByKey,
+  setActiveApplicationContext,
+  slugify,
+  toRouteRequest,
+  wrapSecuredRouteModelByKey,
+  wrapWebLogin,
+  wrapWebRegister
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.47",
+  "version": "0.2.48",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -172,14 +172,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.33",
+    "@getstrata/core": "^0.5.57",
     "typescript": "^5.9.0"
   }
 }